Skip to content

JIT: Propagate trace too long from zend_jit_trace_record_fake_init_call() - #23569

Open
arnaud-lb wants to merge 1 commit into
php:masterfrom
arnaud-lb:record-fake-init-call-overflow
Open

JIT: Propagate trace too long from zend_jit_trace_record_fake_init_call()#23569
arnaud-lb wants to merge 1 commit into
php:masterfrom
arnaud-lb:record-fake-init-call-overflow

Conversation

@arnaud-lb

Copy link
Copy Markdown
Member

zend_jit_trace_record_fake_init_call() silently truncated its recording when the trace buffer became full: TRACE_RECORD() broke out of the loop and the index was returned as a success. Report the failure as -(int)stop instead.

The callers did check for a negative result, but mapped it to ZEND_JIT_TRACE_STOP_BAD_FUNC, which dates back to the time when -1 meant "this pending call can't be traced" (those returns were replaced by "continue recording" in 097edc8). BAD_FUNC is a successful stop reason, so the truncated recording (a start record, a partial fake init call sequence and an end record) is handed to the trace compiler; at trace start this produces a trace that loops forever. Propagate the reported stop reason instead, so that the incomplete recording is discarded as too long. zend_jit_trace_subtrace() now reports its own failure the same way instead of returning a bare -1.

cc @iliaal

…ll()

zend_jit_trace_record_fake_init_call() silently truncated its recording
when the trace buffer became full: TRACE_RECORD() broke out of the loop
and the index, already past the limit, was returned as a success. Report
the failure as -(int)ZEND_JIT_TRACE_STOP_TOO_LONG instead.

The callers did check for a negative result, but mapped it to
ZEND_JIT_TRACE_STOP_BAD_FUNC, which dates back to the time when -1 meant
"this pending call can't be traced" (those returns were replaced by
"continue recording" in 097edc8). BAD_FUNC is a successful stop
reason, so the truncated recording (a start record, a partial fake init
call sequence and an end record) is handed to the trace compiler; at
trace start this produces a trace that loops forever. Propagate the
reported stop reason instead, so that the incomplete recording is
discarded as too long. zend_jit_trace_subtrace() now reports its own
failure the same way instead of returning a bare -1, which would have
been propagated as ZEND_JIT_TRACE_STOP_RECURSIVE_CALL.
@arnaud-lb
arnaud-lb marked this pull request as ready for review September 4, 2026 19:00
@arnaud-lb
arnaud-lb requested a review from dstogov as a code owner September 4, 2026 19:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant