Skip to content

Fix GH-24388: Tracing JIT segfault when a trace runs out of side exits - #24395

Closed
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24388
Closed

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24388

Conversation

@lazerg

@lazerg lazerg commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Once a trace has used all ZEND_JIT_TRACE_MAX_EXITS exit points, zend_jit_trace_get_exit_addr() returns NULL. The two overflow guards in zend_jit_inc_dec() used that address without checking it, so the JIT emitted a guard to address 0 (assertion in debug builds, segfault in release). They now return 0 like the other guards do, and the trace gets abandoned instead.

Fixes #24388

@lazerg

lazerg commented Oct 18, 2026

Copy link
Copy Markdown
Contributor Author

The macOS failure is ext/zip/tests/oo_torrentzip.phpt, which fails the same way on other PRs right now (e.g. #24394). It is not caused by this change.

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks!

@ndossche ndossche closed this in 6db2baf Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tracing JIT: segfault when a trace runs out of side exits (switch with ~500 cases followed by ++$a)

2 participants