Browse Source
Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient op_array->T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence)
Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient op_array->T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence)
Squashed commit of the following: commitpull/1393/merge38e22106d4Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 15:12:19 2015 +0300 Added NEWS entry commit0a355935bfAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 15:06:32 2015 +0300 Inline function, to eliminate repeatable checks commitd937584f3aMerge:034162632677f5Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 14:35:49 2015 +0300 Merge branch 'master' into temporary_cleaning * master: Fixed bug #70006 (cli - function with default arg = STDOUT crash output). Fix x86 build Fixed use after free on closure_call_leak_with_exception.phpt Fixed test commit0341626ea9Merge:74869fadec35deAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 12:00:53 2015 +0300 Merge branch 'temporary_cleaning' of https://github.com/laruence/php-src into temporary_cleaning * 'temporary_cleaning' of https://github.com/laruence/php-src: Fixed checkpoint get Fixed crash of invalid pointer derefer cleanup commit74869fa673Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 11:45:34 2015 +0300 Fixed wrong GOTO resolution commitdec35ded32Author: Xinchen Hui <laruence@gmail.com> Date: Tue Jul 7 15:58:49 2015 +0800 Fixed checkpoint get commitb0f419540aAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 10:47:11 2015 +0300 Fixed crash of invalid pointer derefer (laruence) commit7a428d98caAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 10:35:47 2015 +0300 Fixed identation commit9c3a4dce9cAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 10:33:52 2015 +0300 Fixed invalid size commit653abc670bAuthor: Xinchen Hui <laruence@gmail.com> Date: Tue Jul 7 11:29:14 2015 +0800 Fixed crash of invalid pointer derefer commite04500cedaAuthor: Xinchen Hui <laruence@gmail.com> Date: Tue Jul 7 11:28:26 2015 +0800 cleanup commit34183e1687Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 04:49:46 2015 +0300 op_array->T_liveliness compression commit2f6ad84579Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 04:44:44 2015 +0300 White spaces commitbe83f115a3Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 04:42:26 2015 +0300 Identation commit1f5084b990Merge:91b620d1adf3dfAuthor: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 04:41:54 2015 +0300 Merge branch 'master' into temporary_cleaning * master: Throw TypeError for invalid callback Fix crash when exception occurs during nested rope Fix crash when exception is thrown during ROPE_END Small cleanup in ternary compilation move the define to the right place fix ext/ldap build Rectify information about invalid shift warning being now ArithmeticError commit91b620d684Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 04:32:04 2015 +0300 Replace GOTO by FREE/FE_FREE and JMP at compile time commit7052e56979Author: Dmitry Stogov <dmitry@zend.com> Date: Tue Jul 7 02:25:08 2015 +0300 Use zend_regenerate_var_liveliness_info() to regenerate information after pass two. commitae72b0dc67Merge:a81c4bba919fe8Author: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 21:02:34 2015 +0300 Merge branch 'master' into temporary_cleaning * master: Do not display EXT_TYPE_UNUSED in phpdbg opcodes Run debug build with opcache on travis commita81c4bb8c6Author: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 20:59:34 2015 +0300 Improved algorithm. It's actually the same algorithm with second loop removed and simpler temporary data structures. The only difference may be in "re-defined" vatriable handling. Now live-range in that case started from the seconnd definition (this must be more safe). commit9a16810f7aMerge:bbfbe47001ecd3Author: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 17:57:45 2015 +0300 Merge branch 'master' into temporary_cleaning * master: Simplify TMP var number decoding (without HashTable) commitbbfbe470c8Merge:0bda4ab436b01eAuthor: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 17:02:01 2015 +0300 Merge branch 'master' into temporary_cleaning * master: Avoid dangerous optimization Fixed JMPZNZ instruction printing Attempt at falling back on ldap_find_control for Mac OS commit0bda4abea7Author: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 16:05:33 2015 +0300 Fixed live-range construction for OP_DATA opcode Added comments about algorithm assumtions commit521ad9df98Merge:4398daba09dcb0Author: Bob Weinand <bobwei9@hotmail.com> Date: Mon Jul 6 14:54:15 2015 +0200 Merge branch 'master' of https://github.com/php/php-src into temporary_cleaning commit4398dab82fAuthor: Bob Weinand <bobwei9@hotmail.com> Date: Mon Jul 6 13:51:27 2015 +0200 Add a few phpt tests related to temporary cleaning commit739656f83fAuthor: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 14:28:49 2015 +0300 Fixed Zend/tests/foreach_004.phpt failure (FE_FETCH shouldn't be included into TMP vatriablr live range) commit3df462a2bcAuthor: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 13:41:02 2015 +0300 Improve data layout (reduce the op_array structure size on 64-bit systems) commit883b73c56eAuthor: Dmitry Stogov <dmitry@zend.com> Date: Mon Jul 6 13:28:45 2015 +0300 Removed op_array->brk_cont_array commitae5e58b598Author: Bob Weinand <bobwei9@hotmail.com> Date: Mon Jul 6 04:22:58 2015 +0200 Fix bug with brk_cont variable free / free loop vars via temporary liveliness info commitb4223ca627Author: Bob Weinand <bobwei9@hotmail.com> Date: Mon Jul 6 04:07:07 2015 +0200 Fix bugs / cleanup fixes commitea33189d22Author: Xinchen Hui <laruence@gmail.com> Date: Sun Jul 5 20:58:38 2015 +0800 Removed useless TsTop commit1dbb007e4aMerge:550bbf83a8af24Author: Xinchen Hui <laruence@gmail.com> Date: Sat Jul 4 15:06:44 2015 +0800 Merge branch 'temporary_cleaning' of https://github.com/dstogov/php-src into temporary_cleaning commit3a8af24529Author: Dmitry Stogov <dmitry@zend.com> Date: Fri Jul 3 16:15:36 2015 +0300 More exceptions from regular liveliness analyses (with explanation in comments). Mark old "unexplained" exceptions with ???. commitba721efa2cAuthor: Dmitry Stogov <dmitry@zend.com> Date: Fri Jul 3 14:16:09 2015 +0300 Print list of live temp variables (at least for internal debugging) commit8d1f88fe91Author: Dmitry Stogov <dmitry@zend.com> Date: Fri Jul 3 13:31:56 2015 +0300 Use op_array->T_liveliness to free incomplete ropes and restore error_reporting level on exception commit80c1d0d779Author: Dmitry Stogov <dmitry@zend.com> Date: Fri Jul 3 11:05:39 2015 +0300 Don't keep empty T_liveliness commit501ae8aaacAuthor: Dmitry Stogov <dmitry@zend.com> Date: Thu Jul 2 22:31:48 2015 +0300 Reverted changes to Zend/zend_arena.h. Reuse CG(arena) instead of creating a new one. commita4fce36907Merge:6ff7246fd0fcceAuthor: Dmitry Stogov <dmitry@zend.com> Date: Thu Jul 2 22:01:42 2015 +0300 Merge branch 'temporary_cleaning' of github.com:bwoebi/php-src into temporary_cleaning * 'temporary_cleaning' of github.com:bwoebi/php-src: Fix remaining issues with compacted temporaries Fix regression from last commit (+1 ?!) Fix off-by-one (opcache may remove last ZEND_RETURN) Speed algorithm up, more fail safety when reusing temporaries Dumb bug in opcode.c (forgot to update Ts[i]) Fix opcache support Exempt ROPE temporaries from freeing Hmm, we need temporary info for all the opcodes Add opcache support for cleaning in optimization step (Opcache seems to have a few unrelated issues which blow up together with that patch) Add proper temporary cleaning upon frame abortion Fix arena on small sizes (size < sizeof(zend_arena)) commitfd0fcce811Author: Bob Weinand <bobwei9@hotmail.com> Date: Thu Jul 2 20:00:33 2015 +0200 Fix remaining issues with compacted temporaries commit427dc58bbbAuthor: Bob Weinand <bobwei9@hotmail.com> Date: Wed Jul 1 22:49:12 2015 +0200 Fix regression from last commit (+1 ?!) commit1adcf56a6eAuthor: Bob Weinand <bobwei9@hotmail.com> Date: Wed Jul 1 22:17:07 2015 +0200 Fix off-by-one (opcache may remove last ZEND_RETURN) commit25b231b784Author: Bob Weinand <bobwei9@hotmail.com> Date: Wed Jul 1 20:59:24 2015 +0200 Speed algorithm up, more fail safety when reusing temporaries commit22d9d05350Author: Bob Weinand <bobwei9@hotmail.com> Date: Wed Jul 1 16:48:46 2015 +0200 Dumb bug in opcode.c (forgot to update Ts[i]) commit6538269bfaAuthor: Bob Weinand <bobwei9@hotmail.com> Date: Wed Jul 1 13:05:52 2015 +0200 Fix opcache support commit333a7c4a88Author: Bob Weinand <bobwei9@hotmail.com> Date: Sat Jun 27 22:40:21 2015 +0200 Exempt ROPE temporaries from freeing commit02585f7708Author: Bob Weinand <bobwei9@hotmail.com> Date: Fri Jun 26 16:20:55 2015 +0200 Hmm, we need temporary info for all the opcodes commitcbcaedbd78Author: Bob Weinand <bobwei9@hotmail.com> Date: Fri Jun 26 01:04:09 2015 +0200 Add opcache support for cleaning in optimization step (Opcache seems to have a few unrelated issues which blow up together with that patch) commitfef649f406Author: Bob Weinand <bobwei9@hotmail.com> Date: Fri Jun 26 01:02:27 2015 +0200 Add proper temporary cleaning upon frame abortion commit1cec2e7271Author: Bob Weinand <bobwei9@hotmail.com> Date: Thu Jun 25 23:33:21 2015 +0200 Fix arena on small sizes (size < sizeof(zend_arena))
Dmitry Stogov
11 years ago
24 changed files with 712 additions and 390 deletions
-
5NEWS
-
29Zend/tests/jump15.phpt
-
23Zend/tests/temporary_cleaning_001.phpt
-
32Zend/tests/temporary_cleaning_002.phpt
-
19Zend/tests/temporary_cleaning_003.phpt
-
44Zend/tests/temporary_cleaning_004.phpt
-
48Zend/tests/temporary_cleaning_005.phpt
-
203Zend/zend_compile.c
-
62Zend/zend_compile.h
-
131Zend/zend_execute.c
-
237Zend/zend_opcode.c
-
25Zend/zend_vm_def.h
-
35Zend/zend_vm_execute.h
-
2Zend/zend_vm_opcodes.c
-
1Zend/zend_vm_opcodes.h
-
83ext/opcache/Optimizer/block_pass.c
-
16ext/opcache/Optimizer/nop_removal.c
-
1ext/opcache/Optimizer/pass1_5.c
-
40ext/opcache/Optimizer/zend_optimizer.c
-
3ext/opcache/Optimizer/zend_optimizer_internal.h
-
6ext/opcache/zend_file_cache.c
-
9ext/opcache/zend_persist.c
-
8ext/opcache/zend_persist_calc.c
-
40sapi/phpdbg/phpdbg_opcode.c
@ -0,0 +1,29 @@ |
|||
--TEST-- |
|||
jump 15: goto from loop (forward) |
|||
--FILE-- |
|||
<?php |
|||
$ar = array("1","2","3"); |
|||
foreach ($ar as $val) { |
|||
switch ($val) { |
|||
case "1": |
|||
echo "1: ok\n"; |
|||
break; |
|||
case "2": |
|||
echo "2: ok\n"; |
|||
goto L1; |
|||
case "3": |
|||
echo "bug\n"; |
|||
break; |
|||
} |
|||
} |
|||
echo "bug\n"; |
|||
L1: |
|||
try { |
|||
echo "3: ok\n"; |
|||
} finally { |
|||
} |
|||
?> |
|||
--EXPECT-- |
|||
1: ok |
|||
2: ok |
|||
3: ok |
|||
@ -0,0 +1,23 @@ |
|||
--TEST-- |
|||
Temporary leak on exception |
|||
--FILE-- |
|||
<?php |
|||
|
|||
function ops() { |
|||
throw new Exception(); |
|||
} |
|||
|
|||
try { |
|||
$x = 2; |
|||
$y = new stdClass; |
|||
while ($x-- && new stdClass) { |
|||
$r = [$x] + ($y ? ((array) $x) + [2] : ops()); |
|||
$y = (array) $y; |
|||
} |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
?> |
|||
==DONE== |
|||
--EXPECT-- |
|||
==DONE== |
|||
@ -0,0 +1,32 @@ |
|||
--TEST-- |
|||
Temporary leak on rope (encapsed string) |
|||
--FILE-- |
|||
<?php |
|||
class Obj { |
|||
function __get($x) { |
|||
throw new Exception(); |
|||
} |
|||
} |
|||
|
|||
$x = new Obj; |
|||
$y = 0; |
|||
|
|||
try { |
|||
$r = "$y|$x->x|"; |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
try { |
|||
$r = "$x->x|$y|"; |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
try { |
|||
$r = "$y|$y|$x->x"; |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
?> |
|||
==DONE== |
|||
--EXPECT-- |
|||
==DONE== |
|||
@ -0,0 +1,19 @@ |
|||
--TEST-- |
|||
Fundamental memory leak test on temporaries |
|||
--FILE-- |
|||
<?php |
|||
|
|||
function ops() { |
|||
throw new Exception(); |
|||
} |
|||
|
|||
try{ |
|||
$x = 1; |
|||
$r = [$x] + ops(); |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
?> |
|||
==DONE== |
|||
--EXPECT-- |
|||
==DONE== |
|||
@ -0,0 +1,44 @@ |
|||
--TEST-- |
|||
Temporary leak with switch |
|||
--FILE-- |
|||
<?php |
|||
|
|||
function ops() { |
|||
throw new Exception(); |
|||
} |
|||
|
|||
$a = [new stdClass, new stdClass]; |
|||
switch ($a[0]) { |
|||
case false: |
|||
break; |
|||
default: |
|||
try { |
|||
$x = 2; |
|||
$y = new stdClass; |
|||
while ($x-- && new stdClass) { |
|||
$r = [$x] + ($y ? ((array) $x) + [2] : ops()); |
|||
$y = (array) $y; |
|||
} |
|||
} catch (Exception $e) { |
|||
} |
|||
} |
|||
|
|||
try { |
|||
switch ($a[0]) { |
|||
case false: |
|||
break; |
|||
default: |
|||
$x = 2; |
|||
$y = new stdClass; |
|||
while ($x-- && new stdClass) { |
|||
$r = [$x] + ($y ? ((array) $x) + [2] : ops()); |
|||
$y = (array) $y; |
|||
} |
|||
} |
|||
} catch (Exception $e) { |
|||
} |
|||
|
|||
?> |
|||
==DONE== |
|||
--EXPECT-- |
|||
==DONE== |
|||
@ -0,0 +1,48 @@ |
|||
--TEST-- |
|||
Temporary leak with foreach |
|||
--FILE-- |
|||
<?php |
|||
|
|||
function ops() { |
|||
throw new Exception(); |
|||
} |
|||
|
|||
$a = [new stdClass, new stdClass]; |
|||
foreach ([$a, [new stdClass]] as $b) { |
|||
switch ($b[0]) { |
|||
case false: |
|||
break; |
|||
default: |
|||
try { |
|||
$x = 2; |
|||
$y = new stdClass; |
|||
while ($x-- && new stdClass) { |
|||
$r = [$x] + ($y ? ((array) $x) + [2] : ops()); |
|||
$y = (array) $y; |
|||
} |
|||
} catch (Exception $e) { |
|||
} |
|||
} |
|||
} |
|||
|
|||
foreach ([$a, [new stdClass]] as $b) { |
|||
try { |
|||
switch ($b[0]) { |
|||
case false: |
|||
break; |
|||
default: |
|||
$x = 2; |
|||
$y = new stdClass; |
|||
while ($x-- && new stdClass) { |
|||
$r = [$x] + ($y ? ((array) $x) + [2] : ops()); |
|||
$y = (array) $y; |
|||
} |
|||
} |
|||
} catch (Exception $e) { |
|||
} |
|||
} |
|||
|
|||
?> |
|||
==DONE== |
|||
--EXPECT-- |
|||
==DONE== |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue