Assertion failure in ext/opcache/jit/ir/ir_ra.c:1139

[YuanchengJiang]

Description

The following code:

<?php
class BugLoader extends php_user_filter {
public function filter($in, $out, &$consumed, $closing): int {
if (!class_exists("Test")) {
eval("class Test extends ArrayObject {}");
}
while ($bucket = stream_bucket_make_writeable($in)) {
}
}
}
stream_filter_register('bug.test', 'BugLoader');
include "php://filter/read=bug.test/resource=data://text/plain,<?php\n";

Resulted in this output:

/php-src/ext/opcache/jit/ir/ir_ra.c:1139: void ir_add_osr_entry_loads(ir_ctx *, ir_block *, uint32_t, ir_list *, uint32_t): Assertion `0' failed.
Aborted (core dumped)

To reproduce:

-d "zend_extension=/php-src/modules/opcache.so" -d "allow_url_include=1" -d "opcache.enable_cli=1" -d "opcache.jit=1213"

Related: #15903

PHP Version

nightly

Operating System

ubuntu 22.04

[iluuu1994]

Simplified reproducer:

function test($in, $cond) {
    if ($cond) {
        eval('');
    }
    while (stream_bucket_make_writeable($in)) {}
}

Which may be executed using -d opcache.jit=1203.

001+ ENTRY 4 (block 24 start 82) - live var 18
002+ php: /home/ilutov/Developer/php-src/ext/opcache/jit/ir/ir_ra.c:1139: ir_add_osr_entry_loads: Assertion `0' failed.
003+ 
004+ Termsig=6

/cc @dstogov

[dstogov]

I understood the problem, but it'll take time to fix this.

GCM algorithm moves invariant instructions out of the loops into the immediate dominator of the loop header. This may cause problem for register allocation across ENTRY instruction, so GCM prevents this moving for loops with ENTRY, but it can't handle ENTRY between LOOP header and its immediate dominator. This may be fixed by introducing a loop pre-header block (for loops with multiple forward edges) or by special support in GCM algorithm.

[cmb69]

This has apparently been fixed via 6896756.