Assertion failure in ext/opcache/jit/zend_jit.c:2897

[YuanchengJiang]

Description

The following code:

<?php
ini_set('opcache.jit', 'tracing');
class Test {
}
$appendProp2 = (function() {
})->bindTo($test, Test::class);
$appendProp2();

Resulted in this output:

/php-src/ext/opcache/jit/zend_jit.c:2897: int zend_real_jit_func(zend_op_array *, zend_script *, const zend_op *): Assertion `!op_array->scope' failed.
Aborted (core dumped)

To reproduce:

-d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1215"

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

cc @arnaud-lb This seems closure scope related, similar to what you fixed recently

[arnaud-lb]

Calling ini_set('opcache.jit', 'tracing') changes JIT_G(trigger) but does not update op arrays instrumentation. So if some op array was already instrumented, the old handlers may be called, and using JIT_G(trigger) to determine the trigger is wrong.

We can fix this with something like this:

diff --git a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c
index 0a3f107bb89..cfae01d1534 100644
--- a/ext/opcache/jit/zend_jit.c
+++ b/ext/opcache/jit/zend_jit.c
@@ -2871,7 +2871,7 @@ static void zend_jit_cleanup_func_info(zend_op_array *op_array)
        }
 }
 
-static int zend_real_jit_func(zend_op_array *op_array, zend_script *script, const zend_op *rt_opline)
+static int zend_real_jit_func(zend_op_array *op_array, zend_script *script, const zend_op *rt_opline, uint8_t trigger)
 {
        zend_ssa ssa;
        void *checkpoint;
@@ -2887,10 +2887,10 @@ static int zend_real_jit_func(zend_op_array *op_array, zend_script *script, cons
        memset(&ssa, 0, sizeof(zend_ssa));
 
        if (op_array->fn_flags & ZEND_ACC_CLOSURE) {
-               if (JIT_G(trigger) == ZEND_JIT_ON_FIRST_EXEC) {
+               if (trigger == ZEND_JIT_ON_FIRST_EXEC) {
                        zend_jit_op_array_extension *jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
                        op_array = (zend_op_array*) jit_extension->op_array;
-               } else if (JIT_G(trigger) == ZEND_JIT_ON_HOT_COUNTERS) {
+               } else if (trigger == ZEND_JIT_ON_HOT_COUNTERS) {
                        zend_jit_op_array_hot_extension *jit_extension = (zend_jit_op_array_hot_extension*)ZEND_FUNC_INFO(op_array);
                        op_array = (zend_op_array*) jit_extension->op_array;
                } else {
@@ -2960,7 +2960,7 @@ static int ZEND_FASTCALL zend_runtime_jit(void)
                        opline->handler = jit_extension->orig_handler;
 
                        /* perform real JIT for this function */
-                       zend_real_jit_func(op_array, NULL, NULL);
+                       zend_real_jit_func(op_array, NULL, NULL, ZEND_JIT_ON_FIRST_EXEC);
                } zend_catch {
                        do_bailout = true;
                } zend_end_try();
@@ -3006,7 +3006,7 @@ void zend_jit_check_funcs(HashTable *function_table, bool is_method) {
                        jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
                        opline->handler = jit_extension->orig_handler;
                        if (((double)counter / (double)zend_jit_profile_counter) > JIT_G(prof_threshold)) {
-                               zend_real_jit_func(op_array, NULL, NULL);
+                               zend_real_jit_func(op_array, NULL, NULL, ZEND_JIT_ON_PROF_REQUEST);
                        }
                }
        } ZEND_HASH_FOREACH_END();
@@ -3032,7 +3032,7 @@ void ZEND_FASTCALL zend_jit_hot_func(zend_execute_data *execute_data, const zend
                        }
 
                        /* perform real JIT for this function */
-                       zend_real_jit_func(op_array, NULL, opline);
+                       zend_real_jit_func(op_array, NULL, opline, ZEND_JIT_ON_HOT_COUNTERS);
                } zend_catch {
                        do_bailout = 1;
                } zend_end_try();
@@ -3203,7 +3203,7 @@ int zend_jit_op_array(zend_op_array *op_array, zend_script *script)
        } else if (JIT_G(trigger) == ZEND_JIT_ON_HOT_TRACE) {
                return zend_jit_setup_hot_trace_counters(op_array);
        } else if (JIT_G(trigger) == ZEND_JIT_ON_SCRIPT_LOAD) {
-               return zend_real_jit_func(op_array, script, NULL);
+               return zend_real_jit_func(op_array, script, NULL, ZEND_JIT_ON_SCRIPT_LOAD);
        } else {
                ZEND_UNREACHABLE();
        }

but we use JIT_G(trigger) in other places, e.g. here:

php-src/ext/opcache/jit/zend_jit_ir.c

Line 3660 in fc210b4

ZEND_ASSERT(JIT_G(trigger) != ZEND_JIT_ON_HOT_TRACE);

@dstogov did you intent 0695048 to let users change the JIT trigger at runtime, or was it only to let them enable JIT at runtime?

[dstogov]

@YuanchengJiang tanks for the report.
@arnaud-lb thank for analysing this.
Yes, I implemented the ability to use different JIT triggers on purpose.
I see, this may lead to different problems...

This one may be fixed by introducing JIT_G(real_trigger). I'll take care.