Endless loop in function JIT ir_find_loops in 8.4-dev

[danog]

Description

After e8ae27b (and the equivalent commit on 8.4-dev), enabling function JIT causes an endless loop in ir_find_loops when compiling https://github.com/danog/MadelineProto/blob/v8/src/TL/TL.php

#0  0x0000fffff1129338 in ir_find_loops (ctx=0xfffee2fbf020) at /php-src/ext/opcache/jit/ir/ir_cfg.c:1178
#1  0x0000fffff14811f8 in zend_jit_ir_compile (ctx=0xfffee2fbf020, size=0xfffee2a358e0, name=0x0) at ext/opcache/jit/zend_jit_ir.c:2799
#2  0x0000fffff141860c in zend_jit_finish (jit=0xfffee2fbf020) at ext/opcache/jit/zend_jit_ir.c:16774
#3  0x0000fffff12e2be0 in zend_jit (op_array=0xfffef0a06b88, ssa=0x521001a5b510, rt_opline=0x0) at /php-src/ext/opcache/jit/zend_jit.c:2938
#4  0x0000fffff12c01d4 in zend_jit_script (script=0xfffef09eed10) at /php-src/ext/opcache/jit/zend_jit.c:3442
#5  0x0000fffff10d7204 in zend_accel_script_persist (script=0xfffef09eed10, for_shm=1) at /php-src/ext/opcache/zend_persist.c:1486
#6  0x0000fffff10f1988 in cache_script_in_shared_memory (new_persistent_script=0x51500008a780, key=0x50700005cd70, from_shared_memory=0xfffee2c23320)
    at /php-src/ext/opcache/ZendAccelerator.c:1650
#7  0x0000fffff10ed770 in persistent_compile_file (file_handle=0xfffee2c23220, type=2) at /php-src/ext/opcache/ZendAccelerator.c:2186
#8  0x0000aaaaac226ffc in compile_filename (type=2, filename=0x50700005cd70) at Zend/zend_language_scanner.l:704
#9  0x0000aaaaac15062c in zend_include_or_eval (inc_filename_zv=0x5290019a59e0, type=2) at /php-src/Zend/zend_execute.c:5255
#10 0x0000aaaaac02424c in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (execute_data=0x5290019a5990, opline=0xfffef01feca0) at Zend/zend_vm_execute.h:41150
#11 0x0000aaaaabf30ee4 in execute_ex (ex=0x5290019a5900) at Zend/zend_vm_execute.h:58695
#12 0x0000aaaaabf0dc98 in zend_call_function (fci=0xfffee2c22a40, fci_cache=0xfffee2c22aa0) at /php-src/Zend/zend_execute_API.c:1012
#13 0x0000aaaaabf0f92c in zend_call_known_function (fn=0xfffef01fbb48, object=0x51100002bc40, called_scope=0xfffef01f6490, retval_ptr=0x0, param_count=1, params=0xfffee2b41530,
    named_params=0x0) at /php-src/Zend/zend_execute_API.c:1106
#14 0x0000aaaaab78a3b4 in spl_perform_autoload (class_name=0xfffee988cf38, lc_name=0x5060000eee80) at /php-src/ext/spl/php_spl.c:442
#15 0x0000aaaaabf1117c in zend_lookup_class_ex (name=0xfffee988cf38, key=0x5060000eee80, flags=0) at /php-src/Zend/zend_execute_API.c:1276
#16 0x0000aaaaaba8c3a4 in php_var_unserialize_internal (rval=0x51a0000c0278, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940)
    at ext/standard/var_unserializer.re:1233
#17 0x0000aaaaaba93a40 in process_nested_object_data (rval=0x50b000008308, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940, ht=0x5060000589a0, elements=9,
    obj=0x51a0000c0080) at ext/standard/var_unserializer.re:681
#18 0x0000aaaaaba90e28 in object_common (rval=0x50b000008308, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940, elements=50, has_unserialize=false)
    at ext/standard/var_unserializer.re:830
#19 0x0000aaaaaba8d05c in php_var_unserialize_internal (rval=0x50b000008308, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940)
    at ext/standard/var_unserializer.re:1346
#20 0x0000aaaaaba93a40 in process_nested_object_data (rval=0x5290019a5850, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940, ht=0x506000061a60, elements=1,
    obj=0x50b0000082e0) at ext/standard/var_unserializer.re:681
#21 0x0000aaaaaba90e28 in object_common (rval=0x5290019a5850, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940, elements=2, has_unserialize=false)
    at ext/standard/var_unserializer.re:830
#22 0x0000aaaaaba8d05c in php_var_unserialize_internal (rval=0x5290019a5850, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940)
    at ext/standard/var_unserializer.re:1346
#23 0x0000aaaaaba884e4 in php_var_unserialize (rval=0x5290019a5850, p=0xfffee2b5d920, max=0xfffee7f5f330 "", var_hash=0xfffee2b5d940) at ext/standard/var_unserializer.re:858
#24 0x0000aaaaabaa0dec in php_unserialize_with_options (return_value=0x5290019a5850, buf=0xfffee7e2a818 "O:30:\"danog\\MadelineProto\\APIWrapper\":2:{s:35:\"", buf_len=1264408,
    options=0x0, function_name=0xaaaaad1e46a0 <str> "unserialize") at /php-src/ext/standard/var.c:1461
#25 0x0000aaaaabaa1f94 in zif_unserialize (execute_data=0x5290019a58a0, return_value=0x5290019a5850) at /php-src/ext/standard/var.c:1519
#26 0x0000ffffe95fa94c in ?? ()
#27 0x00005290019a58b0 in ?? ()

To reproduce, build the image in https://github.com/danog/jit_bugs/, clone https://github.com/danog/MadelineProto/ commit 655cfef7c47bb895397fbda7b2bc84eed5d58116, edit /etc/php/php.ini within the image to use function JIT instead of tracing JIT, and run composer update && php examples/bot.php

Ping @dstogov, @nielsdos

PHP Version

8.4-dev

Operating System

No response

[nielsdos]

It hangs in the deserialize method. I've heavily simplified it to the following reproducer:

<?php

function deserialize($stream, array $type)
{
    $constructorData = findByType($type);
    if ($type['type'] === 'x') {
        return deserialize($stream, $constructorData);
    }
    foreach ($constructorData as $arg) {
        if ($arg) {
            deserialize($stream, $arg);
        }
    }
}

Running this through php -d opcache.jit=function shows that it hangs.
This only seems to happen with recursive_call_through_jmp in zend_jit_ir set to true. I believe the bug is related to, or in the IR construction via recursive_call_through_jmp

[dstogov]

Thank for catching this. I see the problem, but the fix may take a while.

[danog]

Could the commit bumping IR be reverted until a fix is found, to prevent it from ending up in the next release?

[dstogov]

yes. I'll do this.