Skip to content

Commit 32d3cae

Browse files
GirgiasGirgias
authored
Handle trampolines correctly in new FCC API + usages (php#9877)
1 parent 0e540ed commit 32d3cae

10 files changed

+369
-1
lines changed

‎Zend/zend_API.h‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -742,6 +742,15 @@ static zend_always_inline bool zend_fcc_equals(const zend_fcall_info_cache* a, c
742742

743743
static zend_always_inline void zend_fcc_addref(zend_fcall_info_cache *fcc)
744744
{
745+
ZEND_ASSERT(ZEND_FCC_INITIALIZED(*fcc) && "FCC Not initialized, possibly refetch trampoline freed by ZPP?");
746+
/* If the cached trampoline is set, free it */
747+
if (UNEXPECTED(fcc->function_handler == &EG(trampoline))) {
748+
zend_function *copy = (zend_function*)emalloc(sizeof(zend_function));
749+
750+
memcpy(copy, fcc->function_handler, sizeof(zend_function));
751+
fcc->function_handler->common.function_name = NULL;
752+
fcc->function_handler = copy;
753+
}
745754
if (fcc->object) {
746755
GC_ADDREF(fcc->object);
747756
}
@@ -758,9 +767,12 @@ static zend_always_inline void zend_fcc_dup(/* restrict */ zend_fcall_info_cache
758767

759768
static zend_always_inline void zend_fcc_dtor(zend_fcall_info_cache *fcc)
760769
{
770+
ZEND_ASSERT(fcc->function_handler);
761771
if (fcc->object) {
762772
OBJ_RELEASE(fcc->object);
763773
}
774+
/* Need to free potential trampoline (__call/__callStatic) copied function handler before releasing the closure */
775+
zend_release_fcall_info_cache(fcc);
764776
if (fcc->closure) {
765777
OBJ_RELEASE(fcc->closure);
766778
}
@@ -806,7 +818,14 @@ ZEND_API void zend_call_known_function(
806818
static zend_always_inline void zend_call_known_fcc(
807819
zend_fcall_info_cache *fcc, zval *retval_ptr, uint32_t param_count, zval *params, HashTable *named_params)
808820
{
809-
zend_call_known_function(fcc->function_handler, fcc->object, fcc->called_scope, retval_ptr, param_count, params, named_params);
821+
zend_function *func = fcc->function_handler;
822+
/* Need to copy trampolines as they get released after they are called */
823+
if (UNEXPECTED(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
824+
func = (zend_function*) emalloc(sizeof(zend_function));
825+
memcpy(func, fcc->function_handler, sizeof(zend_function));
826+
zend_string_addref(func->op_array.function_name);
827+
}
828+
zend_call_known_function(func, fcc->object, fcc->called_scope, retval_ptr, param_count, params, named_params);
810829
}
811830

812831
/* Call the provided zend_function instance method on an object. */

‎ext/libxml/libxml.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1057,6 +1057,12 @@ PHP_FUNCTION(libxml_set_external_entity_loader)
10571057
zend_fcc_dtor(&LIBXML(entity_loader_callback));
10581058
}
10591059
if (ZEND_FCI_INITIALIZED(fci)) { /* argument not null */
1060+
if (!ZEND_FCC_INITIALIZED(fcc)) {
1061+
zend_is_callable_ex(&fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL);
1062+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1063+
* with it outselves. It is important that it is not refetched on every call,
1064+
* because calls may occur from different scopes. */
1065+
}
10601066
zend_fcc_dup(&LIBXML(entity_loader_callback), &fcc);
10611067
}
10621068
RETURN_TRUE;

‎ext/libxml/tests/libxml_set_external_entity_loader_trampoline.phpt‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
--TEST--
2+
libxml_set_external_entity_loader() trampoline callback
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$xml = <<<XML
8+
<!DOCTYPE foo PUBLIC "-//FOO/BAR" "http://example.com/foobar">
9+
<foo>bar</foo>
10+
XML;
11+
12+
class TrampolineTest {
13+
const DTD = '<!ELEMENT foo (#PCDATA)>';
14+
15+
public function __call(string $name, array $arguments) {
16+
echo 'Trampoline for ', $name, PHP_EOL;
17+
var_dump($arguments);
18+
$f = fopen("php://temp", "r+");
19+
fwrite($f, self::DTD);
20+
rewind($f);
21+
return $f;
22+
}
23+
}
24+
$o = new TrampolineTest();
25+
$callback = [$o, 'entity_loader'];
26+
27+
libxml_set_external_entity_loader($callback);
28+
29+
$dd = new DOMDocument;
30+
$r = $dd->loadXML($xml);
31+
var_dump($dd->validate());
32+
33+
echo "Done.\n";
34+
35+
?>
36+
--EXPECT--
37+
Trampoline for entity_loader
38+
array(3) {
39+
[0]=>
40+
string(10) "-//FOO/BAR"
41+
[1]=>
42+
string(25) "http://example.com/foobar"
43+
[2]=>
44+
array(4) {
45+
["directory"]=>
46+
NULL
47+
["intSubName"]=>
48+
NULL
49+
["extSubURI"]=>
50+
NULL
51+
["extSubSystem"]=>
52+
NULL
53+
}
54+
}
55+
bool(true)
56+
Done.

‎ext/spl/spl_iterators.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1439,6 +1439,12 @@ static spl_dual_it_object* spl_dual_it_construct(INTERNAL_FUNCTION_PARAMETERS, z
14391439
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Of", &zobject, ce_inner, &fci, &intern->u.callback_filter) == FAILURE) {
14401440
return NULL;
14411441
}
1442+
if (!ZEND_FCC_INITIALIZED(intern->u.callback_filter)) {
1443+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1444+
* with it outselves. It is important that it is not refetched on every call,
1445+
* because calls may occur from different scopes. */
1446+
zend_is_callable_ex(&fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &intern->u.callback_filter, NULL);
1447+
}
14421448
zend_fcc_addref(&intern->u.callback_filter);
14431449
break;
14441450
}

‎ext/spl/tests/RecursiveCallbackFilterIterator_trampoline_usage.phpt‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
RecursiveCallbackFilterIterator with trampoline callback
3+
--FILE--
4+
<?php
5+
6+
function test($value, $key, $inner) {
7+
if ($inner->hasChildren()) {
8+
return true;
9+
}
10+
printf("%s / %s / %d / %d\n"
11+
, print_r($value, true)
12+
, $key
13+
, $value == $inner->current()
14+
, $key == $inner->key()
15+
);
16+
return $value === 1 || $value === 4;
17+
}
18+
19+
class TrampolineTest {
20+
public function __call(string $name, array $arguments) {
21+
echo 'Trampoline for ', $name, PHP_EOL;
22+
return test(...$arguments);
23+
}
24+
}
25+
$o = new TrampolineTest();
26+
$callback = [$o, 'trampoline'];
27+
28+
$it = new RecursiveArrayIterator([1, [2, 3], [4, 5]]);
29+
$it = new RecursiveCallbackFilterIterator($it, $callback);
30+
$it = new RecursiveIteratorIterator($it);
31+
32+
foreach($it as $value) {
33+
echo "=> $value\n";
34+
}
35+
?>
36+
--EXPECT--
37+
Trampoline for trampoline
38+
1 / 0 / 1 / 1
39+
=> 1
40+
Trampoline for trampoline
41+
Trampoline for trampoline
42+
2 / 0 / 1 / 1
43+
Trampoline for trampoline
44+
3 / 1 / 1 / 1
45+
Trampoline for trampoline
46+
Trampoline for trampoline
47+
4 / 0 / 1 / 1
48+
=> 4
49+
Trampoline for trampoline
50+
5 / 1 / 1 / 1

‎ext/sqlite3/sqlite3.c‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -949,6 +949,12 @@ PHP_METHOD(SQLite3, createFunction)
949949
if (sqlite3_create_function(db_obj->db, sql_func, sql_func_num_args, flags | SQLITE_UTF8, func, php_sqlite3_callback_func, NULL, NULL) == SQLITE_OK) {
950950
func->func_name = estrdup(sql_func);
951951

952+
if (!ZEND_FCC_INITIALIZED(fcc)) {
953+
zend_is_callable_ex(&fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL);
954+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
955+
* with it outselves. It is important that it is not refetched on every call,
956+
* because calls may occur from different scopes. */
957+
}
952958
zend_fcc_dup(&func->func, &fcc);
953959

954960
func->argc = sql_func_num_args;
@@ -991,7 +997,19 @@ PHP_METHOD(SQLite3, createAggregate)
991997
if (sqlite3_create_function(db_obj->db, sql_func, sql_func_num_args, SQLITE_UTF8, func, NULL, php_sqlite3_callback_step, php_sqlite3_callback_final) == SQLITE_OK) {
992998
func->func_name = estrdup(sql_func);
993999

1000+
if (!ZEND_FCC_INITIALIZED(step_fcc)) {
1001+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1002+
* with it outselves. It is important that it is not refetched on every call,
1003+
* because calls may occur from different scopes. */
1004+
zend_is_callable_ex(&step_fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &step_fcc, NULL);
1005+
}
9941006
zend_fcc_dup(&func->step, &step_fcc);
1007+
if (!ZEND_FCC_INITIALIZED(fini_fcc)) {
1008+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1009+
* with it outselves. It is important that it is not refetched on every call,
1010+
* because calls may occur from different scopes. */
1011+
zend_is_callable_ex(&fini_fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fini_fcc, NULL);
1012+
}
9951013
zend_fcc_dup(&func->fini, &fini_fcc);
9961014

9971015
func->argc = sql_func_num_args;
@@ -1032,6 +1050,12 @@ PHP_METHOD(SQLite3, createCollation)
10321050
if (sqlite3_create_collation(db_obj->db, collation_name, SQLITE_UTF8, collation, php_sqlite3_callback_compare) == SQLITE_OK) {
10331051
collation->collation_name = estrdup(collation_name);
10341052

1053+
if (!ZEND_FCC_INITIALIZED(fcc)) {
1054+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1055+
* with it outselves. It is important that it is not refetched on every call,
1056+
* because calls may occur from different scopes. */
1057+
zend_is_callable_ex(&fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL);
1058+
}
10351059
zend_fcc_dup(&collation->cmp_func, &fcc);
10361060

10371061
collation->next = db_obj->collations;
@@ -1293,6 +1317,12 @@ PHP_METHOD(SQLite3, setAuthorizer)
12931317

12941318
/* Only enable userland authorizer if argument is not NULL */
12951319
if (ZEND_FCI_INITIALIZED(fci)) {
1320+
if (!ZEND_FCC_INITIALIZED(fcc)) {
1321+
zend_is_callable_ex(&fci.function_name, NULL, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL);
1322+
/* Call trampoline has been cleared by zpp. Refetch it, because we want to deal
1323+
* with it outselves. It is important that it is not refetched on every call,
1324+
* because calls may occur from different scopes. */
1325+
}
12961326
db_obj->authorizer_fcc = fcc;
12971327
zend_fcc_addref(&db_obj->authorizer_fcc);
12981328
}

‎ext/sqlite3/tests/sqlite3_trampoline_create_aggregate.phpt‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
--TEST--
2+
SQLite3::createAggregate() trampoline callback
3+
--EXTENSIONS--
4+
sqlite3
5+
--FILE--
6+
<?php
7+
8+
require_once(__DIR__ . '/new_db.inc');
9+
10+
class TrampolineTest {
11+
public function __call(string $name, array $arguments) {
12+
echo 'Trampoline for ', $name, PHP_EOL;
13+
$context = $arguments[0];
14+
if ($name === 'finalize') {
15+
return implode(',', $context['values']);
16+
}
17+
if (empty($context)) {
18+
$context = ['total' => 0, 'values' => []];
19+
}
20+
$context['total'] += (int) $arguments[2];
21+
$context['values'][] = $context['total'];
22+
return $context;
23+
}
24+
}
25+
$o = new TrampolineTest();
26+
$step = [$o, 'step'];
27+
$finalize = [$o, 'finalize'];
28+
29+
echo "Creating Table\n";
30+
var_dump($db->exec('CREATE TABLE test (a INTEGER, b INTEGER)'));
31+
32+
echo "INSERT into table\n";
33+
var_dump($db->exec("INSERT INTO test (a, b) VALUES (1, -1)"));
34+
var_dump($db->exec("INSERT INTO test (a, b) VALUES (2, -2)"));
35+
var_dump($db->exec("INSERT INTO test (a, b) VALUES (3, -3)"));
36+
var_dump($db->exec("INSERT INTO test (a, b) VALUES (4, -4)"));
37+
var_dump($db->exec("INSERT INTO test (a, b) VALUES (4, -4)"));
38+
39+
$db->createAggregate('S', $step, $finalize, 1);
40+
41+
print_r($db->querySingle("SELECT S(a), S(b) FROM test", true));
42+
43+
echo "Closing database\n";
44+
var_dump($db->close());
45+
echo "Done\n";
46+
?>
47+
--EXPECT--
48+
Creating Table
49+
bool(true)
50+
INSERT into table
51+
bool(true)
52+
bool(true)
53+
bool(true)
54+
bool(true)
55+
bool(true)
56+
Trampoline for step
57+
Trampoline for step
58+
Trampoline for step
59+
Trampoline for step
60+
Trampoline for step
61+
Trampoline for step
62+
Trampoline for step
63+
Trampoline for step
64+
Trampoline for step
65+
Trampoline for step
66+
Trampoline for finalize
67+
Trampoline for finalize
68+
Array
69+
(
70+
[S(a)] => 1,3,6,10,14
71+
[S(b)] => -1,-3,-6,-10,-14
72+
)
73+
Closing database
74+
bool(true)
75+
Done

‎ext/sqlite3/tests/sqlite3_trampoline_create_collation.phpt‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
--TEST--
2+
Test SQLite3::createCollation() trampoline callback
3+
--EXTENSIONS--
4+
sqlite3
5+
--FILE--
6+
<?php
7+
8+
require_once __DIR__ . '/new_db.inc';
9+
10+
class TrampolineTest {
11+
public function __call(string $name, array $arguments) {
12+
echo 'Trampoline for ', $name, PHP_EOL;
13+
return strnatcmp(...$arguments);
14+
}
15+
}
16+
$o = new TrampolineTest();
17+
$callback = [$o, 'NAT'];
18+
19+
$db->createCollation('NAT', $callback);
20+
21+
$db->exec('CREATE TABLE t (s varchar(4))');
22+
23+
$stmt = $db->prepare('INSERT INTO t VALUES (?)');
24+
foreach(array('a1', 'a10', 'a2') as $s){
25+
$stmt->bindParam(1, $s);
26+
$stmt->execute();
27+
}
28+
29+
$defaultSort = $db->query('SELECT s FROM t ORDER BY s'); //memcmp() sort
30+
$naturalSort = $db->query('SELECT s FROM t ORDER BY s COLLATE NAT'); //strnatcmp() sort
31+
32+
echo "default\n";
33+
while ($row = $defaultSort->fetchArray()){
34+
echo $row['s'], "\n";
35+
}
36+
37+
echo "natural\n";
38+
while ($row = $naturalSort->fetchArray()){
39+
echo $row['s'], "\n";
40+
}
41+
42+
$db->close();
43+
44+
?>
45+
--EXPECT--
46+
Trampoline for NAT
47+
Trampoline for NAT
48+
default
49+
a1
50+
a10
51+
a2
52+
natural
53+
Trampoline for NAT
54+
Trampoline for NAT
55+
a1
56+
a2
57+
a10

0 commit comments

Comments
 (0)