Skip to content

Another tailcall vm_interrupt bug #22265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
morrisonlevi wants to merge 5 commits into
base: PHP-8.5
Choose a base branch
from
+33 −0
Open

Another tailcall vm_interrupt bug #22265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e3df312
Add regression test for tailcall VM crash
morrisonlevi Jun 9, 2026
a0f68b1
Fix vm_interrupt for tailcall VM
morrisonlevi Jun 9, 2026
445c541
SAVE_OPLINE before ZEND_VM_LOOP_INTERRUPT
morrisonlevi Jun 9, 2026
6d5f173
Revert "Fix vm_interrupt for tailcall VM"
morrisonlevi Jun 9, 2026
c1599b5
Update NEWS
morrisonlevi Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ PHP NEWS
LXB_API as __declspec(dllimport) when linked statically into PHP.
(Luther Monson)

- Opcache:
. Fixed bug GH-22265 (Another tailcall vm_interrupt bug). (Levi Morrison)

- Phar:
. Fixed a bypass of the magic ".phar" directory protection in
Phar::addEmptyDir() for paths starting with "/.phar", while allowing
Expand Down
1 change: 1 addition & 0 deletions Zend/zend_execute.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4304,6 +4304,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_fcall_interrupt(zend_execute_data *ca

#define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \
if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
SAVE_OPLINE(); \

@iluuu1994 iluuu1994 Jun 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this probably only used in the HYBRID_DEFAULT branch. Though probably rather harmless in the other case.

ZEND_VM_LOOP_INTERRUPT(); \
} \
} while (0)
Expand Down
29 changes: 29 additions & 0 deletions ext/zend_test/tests/observer_vm_interrupt_tailcall_return.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
--TEST--
Observer: VM interrupt during tailcall return to caller
--DESCRIPTION--
This exercises a VM interrupt raised immediately before a user function returns
to a caller that invoked it through DO_FCALL. On the tailcall VM, the caller's
saved opline must point to the opcode after DO_FCALL before a pending interrupt
is handled.
--EXTENSIONS--
zend_test
--INI--
opcache.jit=0
zend_test.observer.set_vm_interrupt_on_begin=1
--FILE--
<?php
function interrupt_before_return(VmInterruptComparable $left, VmInterruptComparable $right): void
{
$left < $right;
}

function call_interrupt_before_return(): void
{
interrupt_before_return(new VmInterruptComparable(2), new VmInterruptComparable(1));
}

call_interrupt_before_return();
echo "ok\n";
?>
--EXPECT--
ok
Loading