Skip to content

Commit a651f70

Browse files
committed
Fix JIT crash with large number of match/switch arms
Switch statements may generate a large number of exit points. Once the max number of exit points is reached, get_exit_addr() returns NULL. This was not checked, and this resulted in a jump table with some 0 addresses.
1 parent d3c8652 commit a651f70

File tree

5 files changed

+1103
-1
lines changed

5 files changed

+1103
-1
lines changed

.editorconfig

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ end_of_line = lf
99
charset = utf-8
1010
tab_width = 4
1111

12-
[{*.{awk,bat,c,cpp,d,h,l,re,skl,w32,y},Makefile*}]
12+
[{*.{awk,bat,c,cpp,d,dasc,h,l,re,skl,w32,y},Makefile*}]
1313
indent_size = 4
1414
indent_style = tab
1515

ext/opcache/jit/zend_jit_arm64.dasc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13853,6 +13853,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
1385313853
} else {
1385413854
exit_point = zend_jit_trace_get_exit_point(target, 0);
1385513855
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13856+
if (!exit_addr) {
13857+
return 0;
13858+
}
1385613859
| .addr &exit_addr
1385713860
}
1385813861
}
@@ -14018,6 +14021,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1401814021
} else {
1401914022
exit_point = zend_jit_trace_get_exit_point(target, 0);
1402014023
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14024+
if (!exit_addr) {
14025+
return 0;
14026+
}
1402114027
| .addr &exit_addr
1402214028
}
1402314029
}

ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14757,6 +14757,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
1475714757
} else {
1475814758
exit_point = zend_jit_trace_get_exit_point(target, 0);
1475914759
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14760+
if (!exit_addr) {
14761+
return 0;
14762+
}
1476014763
| .aword &exit_addr
1476114764
}
1476214765
}
@@ -14926,6 +14929,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1492614929
} else {
1492714930
exit_point = zend_jit_trace_get_exit_point(target, 0);
1492814931
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14932+
if (!exit_addr) {
14933+
return 0;
14934+
}
1492914935
| .aword &exit_addr
1493014936
}
1493114937
}

0 commit comments

Comments
 (0)