Commit graph

2412 commits

Author SHA1 Message Date
Demon
2be3aa86f0
Zend: fix undefined symbol 'execute_ex' on Windows ARM64 #19064; ext/gd: fix emmintrin.h not found on Windows ARM64 2025-07-10 22:13:29 +02:00
DanielEScherzer
cd751f98cb
Reapply GH-17712 with a fix for internal class constants (#18464)
Add recursion protection when emitting deprecation warnings for class
constants, since the deprecation message can come from an attribute that is
using the same constant for the message, or otherwise result in recursion.

But, internal constants are persisted, and thus cannot have recursion
protection. Otherwise, if a user error handler triggers bailout before the
recursion flag is removed then a subsequent request (e.g. with `--repeat 2`)
would start with that flag already applied. Internal constants can presumably
be trusted not to use deprecation messages that come from recursive attributes.

Fixes GH-18463
Fixes GH-17711
2025-05-25 16:43:36 -07:00
Niels Dossche
08cba2dcc1
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix OSS-Fuzz #418106144
  Fix OSS-Fuzz #417078295
2025-05-19 19:07:17 +02:00
Niels Dossche
46ac878f6a
Fix OSS-Fuzz #417078295
If the variable_ptr and fetched value are the same or overlap, then we
get a UAF. Prevent this by delaying destruction.

Closes GH-18588.
2025-05-19 19:04:58 +02:00
Levi Morrison
59e6165fa6
Merge branch 'PHP-8.3' into PHP-8.4 2025-05-19 09:53:15 -06:00
Levi Morrison
35455b17be
fix: dangling opline in ZEND_INIT_ARRAY (#18578)
This causes problems if an allocation profiler decides to walk the
stack, or if the engine itself OOMs on this opcode, and it tries to
print file and line information.
2025-05-19 09:45:28 -06:00
Ilija Tovilo
386ab1dad2
Revert "Fix infinite recursion on deprecated attribute evaluation"
This reverts commit 272f7f75e2.

Reverts GH-17712 for the PHP-8.4 branch. This will be reapplied later
with a fix for GH-18463 (GH-18464).
2025-04-30 20:52:56 +02:00
Niels Dossche
1a1a83f1fc
Fix GH-18136: tracing JIT floating point register clobbering on Windows and ARM64
On win64, xmm6-xmm15 are preserved registers, but the prologues and
epilogues of JITted code don't handle these. The issue occurs when
calling into the JIT code again via an internal handler
(like call_user_func). Therefore, we want to save/restore xmm registers
upon entering/leaving execute_ex. Since MSVC x64 does not support inline
assembly, we create an assembly wrapper around the real execute_ex
function.
The alternative is to always save/restore these xmm registers into the
fixed call frame, but this causes unnecessary overhead.
The same issue occurs for ARM64 platforms for floating point register
8 to 15. However, there we can use inline asm to fix this.

Closes GH-18352.
2025-04-21 13:15:43 +02:00
Ilija Tovilo
272f7f75e2
Fix infinite recursion on deprecated attribute evaluation
Fixes GH-17711
Fixes GH-18022
Closes GH-17712
2025-03-26 23:39:38 +01:00
Ilija Tovilo
9acfe6e11c
Fix skipped lazy init on primed SIMPLE_WRITE
Go through the normal assignment path, which includes an IS_UNDEF check.

Fixes GH-17998
Closes GH-17999
2025-03-08 12:32:18 +01:00
Niels Dossche
4a5854ee62
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
2024-11-15 20:03:26 +01:00
Niels Dossche
ed59c00661
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
2024-11-15 20:03:19 +01:00
Niels Dossche
553d79c709
Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
zend_is_callable_ex() can unfortunately emit a deprecation, and then
a user error handler can throw an exception. This causes an assert
failure at ZEND_VM_NEXT_OPCODE(). We fix this by checking if there's an
exception after zend_is_callable_ex().

Closes GH-16803.
2024-11-15 20:02:26 +01:00
Niels Dossche
e9283c0819
Fix GH-16574: Incorrect error "undefined method" messages
The `get_method` object handler may change the object pointer. SPL does
this in its iterator implementations. This causes the error message
to change to another class which is confusing to the user. JIT handles
this correctly. This patch aligns behaviour with JIT.

Closes GH-16576.
2024-10-25 18:33:24 +02:00
Arnaud Le Blanc
3151117987
Ensure to initialize lazy object in foreach
foreach() by-passes the get_properties() handler and did not always trigger
initialization.
2024-10-03 15:12:21 +02:00
Arnaud Le Blanc
c65e042c0b
Fix zend_get_property_info_for_slot() for lazy objects (#15855)
zend_get_property_info_for_slot(obj, slot) assumes that 'slot' belongs to 'obj', but that may not be the case for lazy proxies.

Fortunately, the property info is often already available in path when it is needed.

For other cases, I make zend_get_property_info_for_slot() aware of lazy objects, and add zend_get_property_info_for_slot_self() for cases where the 'slot' is known to belong to the object itself.

Fixes oss-fuzz #71446
2024-09-16 16:58:12 +02:00
Levi Morrison
6435bb5ae1
Interrupt while internal frame is on the stack (#14627)
* Check VM interrupt while internal frame is on top

* Use tab instead of spaces

* fix frame used in interrupt and refactor

* remove unused failures for zend_jit_check_timeout

* Fix JIT support

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>

* Fix the missing store to vm_interrupt

* Rename new functions

* Special case zend_interrupt_function in JIT code

* refactor to use ZEND_VM_SET_OPCODE_NO_INTERRUPT

* Split atomic exchange into load + store

It is difficult to determine performance of atomics sometimes. In this
case, the separate load+store is still correct, and a load does not
cause a modification, and might be faster for some platforms than an
exchange. A load+store is slower than an exchange, but we're fine
trading the penalty to the slow path and keeping the happy path faster.

---------

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
2024-09-05 00:35:55 +02:00
Jorg Adam Sowa
2a30f2ffc4
Add type indicator to array/arg unpack error messages (GH-15448) 2024-09-01 22:57:12 +02:00
Arnaud Le Blanc
58aa6fc830
Lazy objects
RFC: https://wiki.php.net/rfc/lazy-objects

Closes GH-15019
2024-08-30 17:30:03 +02:00
Gina Peter Banyard
a79c70f574
[RFC] Convert exit (and die) from language constructs to functions (#13483)
RFC: https://wiki.php.net/rfc/exit-as-function
2024-08-14 12:44:12 +01:00
Arnaud Le Blanc
c02c1d4474
Change YIELD/YIELD_FROM to do not increment opline (#15328)
YIELD and YIELD_FROM increment opline before returning, but in most places
we need the opline to point to the YIELD and YIELD_FROM.

Here I change YIELD / YIELD_FROM to not increment opline. This simplifies the
code and fixes GH-15275 in a better way.

Closes GH-15328
2024-08-10 16:09:47 +02:00
Ilija Tovilo
50217b35ea
Remove IS_STATIC_VAR_UNINITIALIZED (#15227)
This flag was never necessary. We know a static variable is uninitialized (i.e.
the initializer has never been called) iff the zval in the static variable array
does not contain a reference.

Prompted by a related issue in ext-uopz reported by Christoph.
2024-08-05 11:19:13 +02:00
Arnaud Le Blanc
1fbb666545
Use zend_std_build_properties() to access zend_object.properties
The zend_object.properties HashTable needs to be built just in time by calling
rebuild_object_properties() on the object before accessing it. Normally this is
done automatically in zend_std_get_properties(), but we do it manually in a few
places.

In this change I introduce an inline variant of zend_std_build_properties(), and
refactor these places to use it instead of calling rebuild_object_properties()
manually.

rebuild_object_properties() renamed as rebuild_object_properties_internal(), to
enforce usage of zend_std_get_properties() or zend_std_build_properties_ex().

Closes GH-14996
2024-07-18 22:18:38 +02:00
Ilija Tovilo
780a8280d2
[RFC] Property hooks (#13455)
RFC: https://wiki.php.net/rfc/property-hooks

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
2024-07-14 11:55:03 +02:00
Benjamin Eberlei
72c874691b
RFC: Add #[\Deprecated] Attribute (#11293)
see https://wiki.php.net/rfc/deprecated_attribute

Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
2024-07-02 09:44:25 +02:00
Bob Weinand
6a2c5318f9
Optimize observers (#13649)
Inline the lookup whether a function is observed at all.
This strategy is also used for FRAMELESS calls. If the frameless call is observed, we instead allocate a call frame and push the arguments, to call the the function afterwards.
Doing so is still a performance benefit as opposed to executing individual INIT_FCALL+SEND_VAL ops. Thus, even if the frameless call turns out to be observed, the call overhead is slightly lower than before.
If the internal function is not observed at all, the unavoidable overhead is fetching the FLF zend_function pointer and the run-time cache needs to be inspected.

As part of this work, it turned out to be most viable to put the result operand on the ZEND_OP_DATA instead of ZEND_FRAMELESS_ICALL_3, allowing seamless interoperability with the DO_ICALL opcode.
This is a bit unusual in comparison to all other ZEND_OP_DATA usages, but seems to not pose problems overall.

There is also a small issue resolved: trampolines would always use the ZEND_CALL_TRAMPOLINE_SPEC_OBSERVER function due to zend_observer_fcall_op_array_extension being set to -1 too late.
2024-06-15 14:42:27 +02:00
Levi Morrison
c461b60060
refactor: change zend_is_true to return bool (#14301)
Previously this returned `int`. Many functions actually take advantage
of the fact this returns exactly 0 or 1. For instance,
`main/streams/xp_socket.c` does:

    sockopts |= STREAM_SOCKOP_IPV6_V6ONLY_ENABLED * zend_is_true(tmpzval);

And `Zend/zend_compile.c` does:

    child = &ast->child[2 - zend_is_true(zend_ast_get_zval(ast->child[0]))];

I changed a few places trivially from `int` to `bool`, but there are
still many places such as the object handlers which return `int` that
should eventually be `bool`.
2024-05-24 15:16:36 -06:00
Ilija Tovilo
62ebe822de
Separate internal and user function extension handles
This allows us to skip zend_init_internal_run_time_cache() when opcache is
enabled. This function can be quite expensive.

Closes GH-14252
2024-05-21 11:56:38 +02:00
Tim Düsterhus
8094bd1b58
Make ReflectionGenerator::getFunction() legal after generator termination (#14167)
* Make `ReflectionGenerator::getFunction()` legal after generator termination

* Expose the generator function name via `Generator::__debugInfo()`

* Allow creating `ReflectionGenerator` after termination

* Reorder `struct _zend_generator` to avoid a hole

* Adjust `ext/reflection/tests/028.phpt`

This is legal now.

* Fix Generator Closure collection

* Add test to verify the Closure dies with the generator

* NEWS / UPGRADING
2024-05-21 08:54:51 +02:00
Ilija Tovilo
980f7bd2c9
Implement INIT_FCALL offset optimization
Closes GH-13634
2024-03-12 14:13:57 +01:00
Michael Voříšek
87edeed3b9
Remove UNEXPECTED from typed prop checks
Closes GH-13143
2024-02-12 11:35:43 +01:00
Ilija Tovilo
0b1ab42ab8
Fix refactoring mistake
Odd, I rebuilt the project but somehow missed this.
2024-02-06 17:50:53 +01:00
Ilija Tovilo
631bc81607
Implement stackless internal function calls
Co-authored-by: Dmitry Stogov <dmitry@zend.com>

Closes GH-12461
2024-02-06 17:42:28 +01:00
Niels Dossche
fe064d7f12 Fix GH-13142: Undefined variable name is shortened when contains \0
Uses the new %S formatter and introduces the necessary changes and
helpers.
2024-01-20 23:49:13 +01:00
Ilija Tovilo
ffc250d245
Add runtime type inference verification
Co-authored-by: Dmitry Stogov <dmitry@zend.com>

Closes GH-12930
2024-01-19 09:29:14 +01:00
Dmitry Stogov
8cc6b3576e
Fixed GH-12596: Segmentation fault on AArch64 release build with opcache.jit=1112 (#12813) 2023-12-05 12:04:00 +03:00
Ilija Tovilo
30acbba2ca
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix leak of call->extra_named_params on internal __call
2023-12-01 16:50:56 +01:00
Ilija Tovilo
b7a468cd06
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix leak of call->extra_named_params on internal __call
2023-12-01 16:50:49 +01:00
Ilija Tovilo
f203edd3c5
Fix leak of call->extra_named_params on internal __call
Fixes GH-12835
Closes GH-12836
2023-12-01 16:49:16 +01:00
Bob Weinand
78364ef97e Merge branch 'PHP-8.3' 2023-11-25 01:02:52 +01:00
Bob Weinand
88537c55b5 Merge branch 'PHP-8.2' into PHP-8.3 2023-11-25 01:01:56 +01:00
Bob Weinand
50ccea31f2 Merge branch 'PHP-8.1' into PHP-8.2 2023-11-25 00:59:26 +01:00
Florian Engelhardt
8d2df86b06
Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)
* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while the current chunk is full,
the `zend_array_dup()` call will trigger a OOM in ZendMM which will crash, as
the opline might be a dangling pointer.

* add missing test

* `assert()`ing seems easier than trying to make the compiler to not optimize

* moved from function call to INI setting, so we can use this in other places as well

* make `assert()` work no NDEBUG builds

* document magic number

* fix segfault in `ZEND_FUNC_GET_ARGS`

In case a `ZEND_FUNC_GET_ARGS` is being executed, while the current chunk is
full, the `zend_new_array()` call will trigger a OOM in ZendMM which will crash,
as the opline might be a dangling pointer.

---------

Co-authored-by: Florian Engelhardt <florian@engelhardt.tc>
2023-11-25 00:54:02 +01:00
Ilija Tovilo
1fdcfa4ebe
Fix use-after-free of name in var-var with malicious error handler
Fixes oss-fuzz #54325
Closes GH-12732
2023-11-22 21:08:55 -06:00
Ilija Tovilo
e0a6dbcbf4
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix use-after-free of name in var-var with malicious error handler
2023-11-20 14:06:40 +01:00
Ilija Tovilo
88d012f360
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix use-after-free of name in var-var with malicious error handler
2023-11-20 14:06:25 +01:00
Ilija Tovilo
ea52706a2a
Fix use-after-free of name in var-var with malicious error handler
Fixes oss-fuzz #54325
Closes GH-12732
2023-11-20 14:05:46 +01:00
Ilija Tovilo
c01fb83fee
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix inference of COPY_TMP
2023-11-07 12:04:24 +01:00
Ilija Tovilo
cb1e842929
Fix inference of COPY_TMP
Since GH-11592 COPY_TMP may receive and thus define references. Unfortunately,
the name COPY_TMP is no longer accurate.

Closes GH-12619
2023-11-07 12:02:45 +01:00
Ilija Tovilo
9ba9b8f874
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix OP1 leak in error path of post inc/dec
2023-11-02 19:32:02 +01:00