Race conditions on tracing globals in jit-tracing mode in ZTS
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
While testing opcache.jit=tracing with a threading extension and valgrind --tool=drd, a good number of my extension's tests started detecting race conditions in zend_jit_trace_hot_root and some other places.
I'm seeing races in the following places:
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7231
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7701
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L7731
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L8033
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_trace.c#L8051
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit.c#L5096
https://github.com/php/php-src/blob/PHP-8.3.13/ext/opcache/jit/zend_jit_vm_helpers.c#L899
and a few other places
Vast majority seem to have zend_jit_trace_hot_root() in the stack traces
I have a whole bunch of test outputs from my CI if these are any help. Unfortunately the traces are a bit jumbled up in some cases for whatever reason.
Basically it looks like races may occur if two threads try to perform tracing JIT at the same time.
test-results-8.3.13-valgrind-drd-opcache-jit-tracing.zip
from
https://github.com/pmmp/ext-pmmpthread/actions/runs/11915925430/job/33207393626
PHP Version
8.3.13
Operating System
ubuntu-20.04 (GitHub Actions)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the cited locations in ext/opcache/jit/zend_jit_trace.c, zend_jit.c, and zend_jit_vm_helpers.c, focusing on zend_jit_trace_hot_root and concurrent tracing. Reproduce the report with opcache.jit=tracing and valgrind --tool=drd using the linked test results as context. Done means the reported races no longer occur when multiple threads perform tracing JIT.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- compilers, performance
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100