From 7ae8adc49f537bf026f45dac0c418e2befe2944d Mon Sep 17 00:00:00 2001 From: Derrick Austin Date: Sat, 17 Oct 2026 09:39:23 -0500 Subject: [PATCH] Fix AArch64 JIT stub handlers pointing at discarded veneers after opcache restart zend_jit_commit_veneers() replaces zend_jit_stub_handlers[] entries with veneers emitted inside trace code. zend_jit_restart() discards that code but kept the table, so traces compiled after opcache_reset() branched into unrelated code and PHP-FPM workers crashed or hung. Save the table at startup and restore it on restart. --- ext/opcache/jit/zend_jit.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c index a958a2453c4e..815bdeaa9380 100644 --- a/ext/opcache/jit/zend_jit.c +++ b/ext/opcache/jit/zend_jit.c @@ -695,6 +695,11 @@ static bool zend_may_be_dynamic_property(zend_class_entry *ce, zend_string *memb #include "jit/zend_jit_ir.c" +#if defined(IR_TARGET_AARCH64) +/* Stub addresses as generated at startup. Veneers overwrite zend_jit_stub_handlers[], and they are lost on restart. */ +static void *zend_jit_stub_handlers_saved[sizeof(zend_jit_stubs) / sizeof(zend_jit_stubs[0])]; +#endif + #if defined(__clang__) # pragma clang diagnostic pop #endif @@ -3726,6 +3731,9 @@ void zend_jit_startup(void *buf, size_t size, bool reattached) zend_jit_unprotect(); /* save JIT buffer pos */ dasm_ptr[1] = dasm_ptr[0]; +#if defined(IR_TARGET_AARCH64) + memcpy(zend_jit_stub_handlers_saved, zend_jit_stub_handlers, sizeof(zend_jit_stub_handlers_saved)); +#endif zend_jit_protect(); } @@ -3889,6 +3897,11 @@ void zend_jit_restart(void) /* restore JIT buffer pos */ dasm_ptr[0] = dasm_ptr[1]; +#if defined(IR_TARGET_AARCH64) + /* Veneers lived in the code that was just discarded */ + memcpy(zend_jit_stub_handlers, zend_jit_stub_handlers_saved, sizeof(zend_jit_stub_handlers_saved)); + memset(zend_jit_stub_handlers + (sizeof(zend_jit_stubs) / sizeof(zend_jit_stubs[0])), 0, sizeof(zend_jit_stub_handlers_saved)); +#endif zend_jit_trace_restart();