Skip to content

Commit f2381ae

Browse files
authored
Fix JIT crash with large number of match/switch arms (#8961)
Switch statements may generate a large number of exit points. Once the max number of exit points is reached, get_exit_addr() returns NULL. This was not checked, and this resulted in a jump table with some 0 addresses.
1 parent b734d45 commit f2381ae

File tree

5 files changed

+1103
-1
lines changed

5 files changed

+1103
-1
lines changed

.editorconfig

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ end_of_line = lf
99
charset = utf-8
1010
tab_width = 4
1111

12-
[{*.{awk,bat,c,cpp,d,h,l,re,skl,w32,y},Makefile*}]
12+
[{*.{awk,bat,c,cpp,d,dasc,h,l,re,skl,w32,y},Makefile*}]
1313
indent_size = 4
1414
indent_style = tab
1515

ext/opcache/jit/zend_jit_arm64.dasc

+6
Original file line numberDiff line numberDiff line change
@@ -13992,6 +13992,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
1399213992
} else {
1399313993
exit_point = zend_jit_trace_get_exit_point(target, 0);
1399413994
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13995+
if (!exit_addr) {
13996+
return 0;
13997+
}
1399513998
| .addr &exit_addr
1399613999
}
1399714000
}
@@ -14154,6 +14157,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1415414157
} else {
1415514158
exit_point = zend_jit_trace_get_exit_point(target, 0);
1415614159
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14160+
if (!exit_addr) {
14161+
return 0;
14162+
}
1415714163
| .addr &exit_addr
1415814164
}
1415914165
}

ext/opcache/jit/zend_jit_x86.dasc

+6
Original file line numberDiff line numberDiff line change
@@ -14877,6 +14877,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
1487714877
} else {
1487814878
exit_point = zend_jit_trace_get_exit_point(target, 0);
1487914879
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14880+
if (!exit_addr) {
14881+
return 0;
14882+
}
1488014883
| .aword &exit_addr
1488114884
}
1488214885
}
@@ -15043,6 +15046,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1504315046
} else {
1504415047
exit_point = zend_jit_trace_get_exit_point(target, 0);
1504515048
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
15049+
if (!exit_addr) {
15050+
return 0;
15051+
}
1504615052
| .aword &exit_addr
1504715053
}
1504815054
}

0 commit comments

Comments
 (0)