php / php/php-src

Race conditions on tracing globals in jit-tracing mode in ZTS

Open
#16,860 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Category: JIT Status: Needs Triage
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

While testing opcache.jit=tracing with a threading extension and valgrind --tool=drd, a good number of my extension's tests started detecting race conditions in zend_jit_trace_hot_root and some other places.

I'm seeing races in the following places:
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7231
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7701
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7731
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L8033
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L8051

https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit.c#L5096

https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_vm_helpers.c#L899

and a few other places

Vast majority seem to have zend_jit_trace_hot_root() in the stack traces

I have a whole bunch of test outputs from my CI if these are any help. Unfortunately the traces are a bit jumbled up in some cases for whatever reason.

Basically it looks like races may occur if two threads try to perform tracing JIT at the same time.

test-results-8.3.13-valgrind-drd-opcache-jit-tracing.zip
from
https://github.com/pmmp/ext-pmmpthread/actions/runs/11915925430/job/33207393626

PHP Version

8.3.13

Operating System

ubuntu-20.04 (GitHub Actions)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the cited locations in ext/opcache/jit/zend_jit_trace.c, zend_jit.c, and zend_jit_vm_helpers.c, focusing on zend_jit_trace_hot_root and concurrent tracing. Reproduce the report with opcache.jit=tracing and valgrind --tool=drd using the linked test results as context. Done means the reported races no longer occur when multiple threads perform tracing JIT.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, php
Domain
compilers, performance
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.