Skip to content

Fix JIT crash with large number of match/switch arms #8961

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 18, 2022

Conversation

arnaud-lb
Copy link
Member

Switch statements may generate a large number of exit points. Once the max number of exit points is reached, get_exit_addr() returns NULL. This was not checked, and this resulted in a jump table with some 0 addresses.

Fixes #8030

There are a few other cases where get_exit_addr() is not checked, but I was unable to produce a crashing test for them. I will submit a separate PR.

@arnaud-lb arnaud-lb requested a review from dstogov July 9, 2022 14:17
@arnaud-lb arnaud-lb changed the base branch from master to PHP-8.1 July 9, 2022 21:07
Switch statements may generate a large number of exit points. Once the max
number of exit points is reached, get_exit_addr() returns NULL. This was not
checked, and this resulted in a jump table with some 0 addresses.
@arnaud-lb arnaud-lb marked this pull request as ready for review July 9, 2022 22:02
Copy link
Member

@dstogov dstogov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine. Please merge.

@arnaud-lb arnaud-lb merged commit f2381ae into php:PHP-8.1 Jul 18, 2022
arnaud-lb added a commit that referenced this pull request Jul 18, 2022
* PHP-8.1:
  [ci skip] NEWS
  Fix JIT crash with large number of match/switch arms (#8961)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Segfault with JIT and large match/switch statements
2 participants