Repository navigation
Fix JIT fuzzers never enabling the JIT - #24717
Open
yumasansansan wants to merge 1 commit into
Open
yumasansansan wants to merge 1 commit into
yumasansansan wants to merge 1 commit into
Conversation
Since the default of opcache.jit changed from "tracing" to "disable" (c16ad91, RFC jit_config_defaults), JIT_G(enabled) is false after startup and zend_jit_config() rejects every runtime change of opcache.jit. The function-jit and tracing-jit fuzzers turn the JIT on at runtime without checking the result, so since PHP 8.4 they have only been running the VM. The OSS-Fuzz coverage report of 2026-10-24 shows 0.04% line coverage (40/103166) for ext/opcache/jit/. Start with opcache.jit=off, which keeps the JIT available, and abort if switching the JIT mode fails, so that this cannot regress silently.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
php-fuzz-function-jitandphp-fuzz-tracing-jitfuzzers switchopcache.jitat runtime (offfor the first run, thenfunction/tracing). Since c16ad91 (RFC jit_config_defaults, PHP 8.4) the default isopcache.jit=disable, which leavesJIT_G(enabled) = 0, andzend_jit_config()then refuses runtime changes with "Cannot change opcache.jit setting at run-time (JIT is disabled)". The fuzzers ignore the return value ofzend_alter_ini_entry_chars(), so the JIT has not been exercised by these fuzzers since PHP 8.4.Evidence:
zend_jit_config("function", ZEND_INI_STAGE_RUNTIME)is entered withJIT_G(enabled) == 0, andzend_jit_script()/zend_jit_op_array()are never called. With this patch they are.ext/opcache/jit/has 0.04% line coverage (40/103166 lines, 7/1407 functions), and the JIT fuzzers have lower total coverage thanphp-fuzz-execute.Zend/testsandext/opcache/tests/jit(6181 files, one run each, ASan build):Before the patch both fuzzers reach exactly the same edges, as neither runs the JIT.
The patch starts with
opcache.jit=off(JIT available but off) and makes a failure to switch the JIT mode abort the fuzzer, so a future change of the defaults shows up as a crash on OSS-Fuzz instead of silently disabling JIT fuzzing.Note: once this lands, OSS-Fuzz will start exercising the JIT again after a gap of about three years, so a burst of new JIT reports is to be expected.