Hang when using amphp and tracing JIT

[danog]

Description

Reproducer: https://paste.daniil.it/parallel_jit.tar.xz (run.sh script)

PHP Version

PHP 8.2.10

Operating System

Arch linux

[danog]

By the way @dstogov, this issue can be easily reproduced without even using network I/O by running the composite cancellation benchmark in https://github.com/amphp/amp:

php -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=1G -d opcache.jit_max_root_traces=1000000 -d opcache.jit_max_side_traces=1000000 -d opcache.jit_max_exit_counters=1000000 -d opcache.jit_hot_loop=1 -d opcache.jit_hot_func=1 -d opcache.jit_hot_return=1 -d opcache.jit_hot_side_exit=1 -d memory_limit=-1 vendor/bin/phpunit --debug --filter 'testBenchmark' test/Cancellation/CompositeCancellationTest.php

[danog]

@dstogov Finally managed to narrow it down to this specific closure execution: https://github.com/revoltphp/event-loop/blob/main/src/EventLoop/Internal/AbstractDriver.php#L593

Replacing that line with a call_user_func fixes the issue.

Replacing https://github.com/revoltphp/event-loop/blob/main/src/EventLoop/Internal/AbstractDriver.php#L86 with an indirect closure function (Closure $i): void { $this->setInterrupt($i); } also seems to fix the issue.

[danog]

It seems like the actual source of the problem is https://github.com/revoltphp/event-loop/blob/main/src/EventLoop/Internal/AbstractDriver.php#L565, the if is entering when it shouldn't, in fact adding the following assertion fails:

                    if (!isset($this->callbacks[$callback->id]) || !$callback->invokable) {
                        if (isset($this->callbacks[$callback->id]) && $callback->invokable) {
                            throw new AssertionError("Impossible");
                        }
                        unset($callback);

                        continue;
                    }

[danog]

In fact it's just the isset, splitting the if just this code can trigger the assertion:

                    if (!isset($this->callbacks[$callback->id])) {
                        if (isset($this->callbacks[$callback->id])) {
                            throw new AssertionError("Impossible");
                        }
                        unset($callback);

                        continue;
                    }

[danog]

Very strangely, the first few runs after modifying the file don't trigger the assertion (something to do with mtime maybe?)

[danog]

The affected trace seems to be trace 311 from the debug output, the zend bytecode seems correct, let's see if I can find the assembly...

https://paste.daniil.it/debug_run

0013 V4 = FETCH_THIS
0014 T6 = FETCH_OBJ_R CV0($callback) string("id") ; op1(object of class Revolt\EventLoop\Internal\TimerCallback) val(string)
0015 T5 = FETCH_OBJ_IS V4 string("callbacks") ; op1(object of class Revolt\EventLoop\Driver\UvDriver) val(array)
0016 T4 = ISSET_ISEMPTY_DIM_OBJ (isset) T5 T6 ; op1(array) op2(string) val(object)
0017 ;JMPNZ T4 0027