Commit graph

2001 commits

Author SHA1 Message Date
Dmitry Stogov
09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00
Dmitry Stogov
bdf6779c7d Merge branch 'PHP-8.1'
* PHP-8.1:
  Use proper functions
2021-12-01 22:45:26 +03:00
Dmitry Stogov
10cfe9f13b Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Use proper functions
2021-12-01 22:45:15 +03:00
Dmitry Stogov
9f6ab78610 Use proper functions 2021-12-01 22:43:19 +03:00
Dmitry Stogov
db806d70ed Merge branch 'PHP-8.1'
* PHP-8.1:
  Fixed crash in ZEND_ASSIGN_DIM_OP because of array cloberring by user error handler
2021-11-30 23:34:50 +03:00
Dmitry Stogov
b594a95a2f Fixed crash in ZEND_ASSIGN_DIM_OP because of array cloberring by user error handler
Fixes oss-fuzz #36214
2021-11-30 23:33:34 +03:00
Dmitry Stogov
532f2ca7ff Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix crash after indirect modification of string by user error handler
2021-11-30 16:10:11 +03:00
Dmitry Stogov
afd881718e Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix crash after indirect modification of string by user error handler
2021-11-30 16:09:58 +03:00
Dmitry Stogov
df434f056f Fix crash after indirect modification of string by user error handler
Fixes oss-fuzz #39346
2021-11-30 16:07:38 +03:00
Nikita Popov
16e9e666ba Encode string offset error reason in extended_value
For FETCH_DIM_W etc encode the context it is being used in
(dim, obj, ref or incdec) so we can throw an appropriate error
message for invalid string offset use, in a way that does not
require inspecting neighboring opcodes. The implementation is
similar to the flags used for FETCH_OBJ.

This means that we do not have to be careful about preserving
following opcodes during optimization.

Closes GH-7599.
2021-10-21 09:52:09 +02:00
Nikita Popov
a38bad87d5 Consolidate UNSET_DIM handling for string offset error
The immediate error here is the nested indexing in write context,
the fact that it's ultimately wrapped in an unset() doesn't matter.
Same as $str[0][0] += 1 will throw "Cannot use string offset as an
array", so should this case.
2021-10-20 13:05:38 +02:00
Nikita Popov
ca7a11c9cf Consolidate string offset by reference errors
Use the same error message for all scenarios where a reference to
a string offset is acquired.
2021-10-20 13:00:48 +02:00
Nikita Popov
a58201369c Remove impossible cases from string offset error handling
As far as I can see, these cases should not be reachable.
2021-10-20 12:51:42 +02:00
Nikita Popov
3ce472d1a6 Fix message for some string offset uses as object
Even if the object property is incremented afterwards, the
immediate error is the use as object, not the increment.

Also consolidate tests for this error message. Previously they
were spread across a number of bug-specific tests.
2021-10-20 12:44:05 +02:00
Nikita Popov
da0d246e19 Drop FREE_OP_VAR_PTR() distinction
FREE_OP_VAR_PTR() is like FREE_OP(), but only frees VAR, rather
than VARs and TMPs. I don't think this distinction makes sense
anymore, as opcodes using FREE_OP_VAR_PTR() generally only accept
VAR or CV. For the cases where other op types are accepted and
only freeing VAR is desired we already have FREE_OP_IF_VAR().

This drops FREE_OP_VAR_PTR(), leaving only FREE_OP() and
FREE_OP_IF_VAR().
2021-10-20 12:02:09 +02:00
Dmitry Stogov
ddaf64b56c Avoid non-immutable map_ptr indirection 2021-10-14 12:16:18 +03:00
Nikita Popov
b14076a845 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix build without global registers
2021-10-05 16:46:10 +02:00
Nikita Popov
dab6527352 Fix build without global registers 2021-10-05 16:45:44 +02:00
Nikita Popov
fef61a8e11 Merge branch 'PHP-8.1'
* PHP-8.1:
  Reuse wrong string offset logic in jit
2021-10-05 16:33:39 +02:00
Nikita Popov
a4fa00ead3 Reuse wrong string offset logic in jit
JIT contains a copy of this function that effectively only differs
by fetching current_execute_data from EG. We can do that in the VM
version as well, as this is just used to throw an error.

Export the VM function and reuse it in JIT.
2021-10-05 16:33:31 +02:00
codinghuang
5bda4cd25a Support specifying start position in compile_string
Add additional zend_compile_position argument, which can be either
AT_SHEBANG, AT_OPEN_TAG or AFTER_OPEN_TAG. The previous behavior
corresponds to AFTER_OPEN_TAG.

Closes GH-7462.
2021-09-30 10:21:33 +02:00
Nikita Popov
6381a16f3f Avoid use after free in internal prop type verification
This issue only applies to debug builds: read_property can free
the object, but we'd try to check the object handlers afterwards.
Rewrite the check in a way that only accessed the object before
the read_property call.

Fixes oss-fuzz #38297.
2021-09-09 15:30:32 +02:00
Nikita Popov
99510ed009 Remove unnecessary argument from zend_throw_auto_init_*
This is now always "array", so inline it.
2021-09-06 11:46:20 +02:00
Nikita Popov
14f599ea7d Use zend_long for resource ID
Currently, resource IDs are limited to 32-bits. As resource IDs
are not reused, this means that resource ID overflow for
long-running processes is very possible.

This patch switches resource IDs to use zend_long instead, which
means that on 64-bit systems, 64-bit resource IDs will be used.
This makes resource ID overflow practically impossible.

The tradeoff is an 8 byte increase in zend_resource size.

Closes GH-7436.
2021-08-31 14:58:59 +02:00
Nikita Popov
5b2ddf5a17 Export zend_use_resource_as_offset()
Use a common implementation to generate this error message, as
we do so in quite a few places dealing with array keys.
2021-08-31 10:58:01 +02:00
Nikita Popov
315f40942b
Always use CE_CACHE, remove TYPE_HAS_CE (#7336)
Currently, CE_CACHE on strings is only used with opcache interned strings. This
patch extends usage to non-opcache interned strings as well. This means that
most type strings can now make use of CE_CACHE even if opcache is not loaded,
which allows us to remove TYPE_HAS_CE kind, and fix some discrepancies
depending on whether a type stores a resolved or non-resolved name.

There are two cases where CE_CACHE will not be used:

 * When opcache is not used and a permanent interned string (that is not an
   internal class name) is used as a type name during the request. In this case
   we can't allocate a map_ptr index for the permanent string, as it would be
   not be in the permanent map_ptr index space.
 * When opcache is used but the script is not cached (e.g. eval'd code or
   opcache full). If opcache is used, we can't allocate additional map_ptr
   indexes at runtime, because they may conflict with indexes allocated by
   opcache.

In these two cases we would end up not using CE caching for property types
(argument/return types still have the separate cache slot).
2021-08-11 10:28:52 +02:00
Joe Watkins
05ef6334cd
Fix bug #81303 improve match errors 2021-08-02 17:31:26 +02:00
Nikita Popov
7b85d3bbdd Add support for verifying optimizer func info
This is guarded by -DZEND_VERIFY_FUNC_INFO=1. Enable this on the
variation job.

Closes GH-6924.
2021-07-21 12:24:30 +02:00
Levi Morrison
ae8647d9d3
Remove leading underscore for _zend_hash_find_known_hash (#7260)
Convert zend_hash_find_ex(..., 1) to zend_hash_find_known_hash(...)
Convert zend_hash_find_ex(..., 0) to zend_hash_find(...)

Also add serializable changes to UPGRADING.INTERNALS summary
2021-07-20 17:07:17 -06:00
Nikita Popov
c50f4dece0 Fix typo in comment
[ci skip]
2021-07-20 12:44:05 +02:00
Nikita Popov
6780aaa532 Implement readonly properties
Add support for readonly properties, for which only a single
initializing assignment from the declaring scope is allowed.

RFC: https://wiki.php.net/rfc/readonly_properties_v2

Closes GH-7089.
2021-07-20 12:05:46 +02:00
Kamil Tekiela
052af90b86 Deprecate autovivification on false
Deprecate automatically converting "false" into an empty array
on write operands. Autovivification continues to be supported
for "null" values, as well as undefined/uninitialized values.

RFC: https://wiki.php.net/rfc/autovivification_false

Closes GH-7131.

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
2021-07-19 14:49:37 +02:00
Nikita Popov
ee65e92070 Check internal function type consistency in zend_call_function
We do this for calls in the engine, but not those going through
zend_call_function().
2021-07-13 11:50:07 +02:00
Nikita Popov
a80360dbed Deprecate direct access to static trait members
Static trait members may only be accessed through a class in which
the trait is used, not directly on the trait.

A complication here is that we should not store static
methods/properties for which a deprecation is triggered in a
cache slot. As the check for this is simple and cheap, I'm handling
this in the cache slot population code in the VM. The alternative
would be to pass the cache slot down into the fetching code.

Part of https://wiki.php.net/rfc/deprecations_php_8_1.
2021-07-09 14:12:28 +02:00
George Peter Banyard
069a9fa5e4
Pure Intersection types (#6799)
Implement pure intersection types RFC

RFC: https://wiki.php.net/rfc/pure-intersection-types

Co-authored-by: Nikita Popov <nikic@php.net>
Co-authored-by: Ilija Tovilo <ilutov@php.net>
2021-07-05 14:11:03 +02:00
Nikita Popov
629965c80f Handle promoted exception in int|string type
Fixes oss-fuzz #35790.
2021-07-05 10:48:20 +02:00
Nikita Popov
3321440166 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix return value of wrong fucntion by-ref assign
2021-07-02 11:18:46 +02:00
Nikita Popov
6617829f1b Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix return value of wrong fucntion by-ref assign
2021-07-02 11:18:09 +02:00
Nikita Popov
96bf925cde Fix return value of wrong fucntion by-ref assign
We should be using the result of zend_assign_to_variable() here,
which will deref prior to potential freeing.

Fixes oss-fuzz #29899.
2021-07-02 11:15:31 +02:00
Patrick Allaert
aff365871a Fixed some spaces used instead of tabs 2021-06-29 11:30:26 +02:00
Dmitry Stogov
973ae8d3e2 Move the whole "cold" path into the "cold" function. 2021-06-23 14:55:58 +03:00
George Peter Banyard
4939d2cec1
Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix test
  Fix bug #81159: Object to int warning when using an object as a string offset
  Fix bug #81163 indirect vars in __sleep
2021-06-18 18:11:46 +01:00
George Peter Banyard
f0fd5922ee
Fix bug #81159: Object to int warning when using an object as a string offset
Closes GH-7167
2021-06-18 18:07:22 +01:00
Dmitry Stogov
3a78259525 JIT: Avoid too aggressive loop unrolling
This fixes tests/func/010.phpt failure with tracing JIT on ARM64.
2021-06-16 16:44:27 +03:00
Joe Watkins
cb3964aae4
move zend_vm_stack_new_page into header for sharing with fibers 2021-06-10 15:20:29 +02:00
George Peter Banyard
b6958bb847
Implement "Deprecate implicit non-integer-compatible float to int conversions" RFC. (#6661)
RFC: https://wiki.php.net/rfc/implicit-float-int-deprecate

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
2021-05-31 15:48:45 +01:00
Nikita Popov
c27dedb0c7 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fixed bug #81090
2021-05-31 12:34:21 +02:00
Nikita Popov
ee74f2e57f Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fixed bug #81090
2021-05-31 12:33:59 +02:00
Nikita Popov
82f6f6da67 Fixed bug #81090
For concatenation, the in-place variant can be much more efficient,
because it will reallocate the string in-place. Special-case the
typed property compound assignment code for the case where we
concatenate to a string, in which case we know that the result
will also be a string, and we don't need the type check anyway.
2021-05-31 12:31:56 +02:00
Dmitry Stogov
5fe2062585 Correct DWARF frame description.
Now GDB correctly shows backtraces that involves JIT-ed code for
functional/tracing JIT, HYBRID/CALL VM, x86/AArch64 CPU.
(opcache.jit_debug=0x100 should be set).
2021-05-18 18:21:08 +03:00