Fix GH-24388: Tracing JIT segfault when a trace runs out of side exits

Author: lazerg

NEWS

@@ -70,6 +70,8 @@ PHP                                                                        NEWS
     SCCP is disabled). (Lazizbek Ergashev)
   . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
     property). (Lazizbek Ergashev)
+  . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
+    exits). (Lazizbek Ergashev)
 
 - PDO:
   . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a

ext/opcache/jit/zend_jit_ir.c

@@ -4921,6 +4921,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o
 
 		exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 		exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+		if (!exit_addr) {
+			return 0;
+		}
 		ir_GUARD_NOT(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
 
 		if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4962,6 +4965,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o
 
 			exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 			exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+			if (!exit_addr) {
+				return 0;
+			}
 			ir_GUARD(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
 
 			if (opline->result_type != IS_UNUSED) {

ext/opcache/tests/jit/gh24388.phpt

@@ -0,0 +1,31 @@
+--TEST--
+GH-24388 (Tracing JIT: segfault when a trace runs out of side exits)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+$file = __DIR__ . "/gh24388.inc";
+
+$code = '<?php function f(int $k, int $a) { switch ($k) {';
+for ($i = 0; $i < 507; $i++) {
+    $code .= "case $i: \$l = $i; break;";
+}
+$code .= '} return ++$a; }';
+$code .= 'for ($i = 0; $i < 200; $i++) { $a = 3; f(0, $a); }';
+file_put_contents($file, $code);
+
+include $file;
+?>
+DONE
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh24388.inc");
+?>
+--EXPECT--
+DONE