Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c

[YuanchengJiang]

Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c

[nielsdos]

Can confirm:

==208366== Invalid read of size 8
==208366==    at 0x7888BB4: zend_jit_cleanup_func_info (zend_jit.c:2745)
==208366==    by 0x7888DC8: zend_real_jit_func (zend_jit.c:2799)
==208366==    by 0x788944A: zend_jit_hot_func (zend_jit.c:2908)
==208366==    by 0xFE00283: ???
==208366==    by 0x8F32E0: zend_execute (zend_vm_execute.h:62776)
==208366==    by 0x82B332: zend_execute_script (zend.c:1899)
==208366==    by 0x778520: php_execute_script_ex (main.c:2507)
==208366==    by 0x77869E: php_execute_script (main.c:2547)
==208366==    by 0x9B8EAC: do_cli (php_cli.c:966)
==208366==    by 0x9B9C04: main (php_cli.c:1340)
==208366==  Address 0x7c58298 is 36,568 bytes inside a block of size 65,536 free'd
==208366==    at 0x48468CF: free (vg_replace_malloc.c:985)
==208366==    by 0x7E7D6B: __zend_free (zend_alloc.c:3115)
==208366==    by 0x7E6958: _efree (zend_alloc.c:2596)
==208366==    by 0x772E76: zend_arena_destroy (zend_arena.h:48)
==208366==    by 0x777827: php_request_shutdown (main.c:1920)
==208366==    by 0x7804F68: accel_finish_startup_preload (ZendAccelerator.c:4645)
==208366==    by 0x78053C5: accel_finish_startup (ZendAccelerator.c:4778)
==208366==    by 0x7800016: accel_post_startup (ZendAccelerator.c:3335)
==208366==    by 0x829046: zend_post_startup (zend.c:1081)
==208366==    by 0x777E6A: php_module_startup (main.c:2256)
==208366==    by 0x9B7DB2: php_cli_startup (php_cli.c:410)
==208366==    by 0x9B9B68: main (php_cli.c:1307)
==208366==  Block was alloc'd at
==208366==    at 0x4843788: malloc (vg_replace_malloc.c:442)
==208366==    by 0x7E7C39: __zend_malloc (zend_alloc.c:3087)
==208366==    by 0x7E68D2: _emalloc (zend_alloc.c:2586)
==208366==    by 0x7E9806: zend_arena_create (zend_arena.h:36)
==208366==    by 0x7EA6AB: init_compiler (zend_compile.c:434)
==208366==    by 0x829430: zend_activate (zend.c:1282)
==208366==    by 0x777301: php_request_startup (main.c:1778)
==208366==    by 0x7804E72: accel_finish_startup_preload (ZendAccelerator.c:4610)
==208366==    by 0x78053C5: accel_finish_startup (ZendAccelerator.c:4778)
==208366==    by 0x7800016: accel_post_startup (ZendAccelerator.c:3335)
==208366==    by 0x829046: zend_post_startup (zend.c:1081)
==208366==    by 0x777E6A: php_module_startup (main.c:2256)

Simplified command line: valgrind ./sapi/cli/php -c . -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.preload=./preload.inc" -d "opcache.jit=1235" -f ./test.php

EDIT: preload.inc can be simplified to:

<?php
class Foo {
    public static function test() {
        static $i = 0;
        var_dump(++$i);
    }
}

Foo::test();

[nielsdos]

The problem seems to be that the caller_info, callee_info and possibly call_map is allocated on the arena but not reset before being used by the next request? So we should probably set that to NULL somewhere although I'm not sure where.