From 05c7b00d796be26aac15994803444519992dd78e Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Thu, 11 Jun 2026 09:11:35 -0600 Subject: [PATCH 1/2] Fix another vm_interrupt bug for tailcall VM (#22265) --- NEWS | 3 ++ Zend/zend_execute.c | 7 +++++ ...observer_vm_interrupt_tailcall_return.phpt | 29 +++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 ext/zend_test/tests/observer_vm_interrupt_tailcall_return.phpt diff --git a/NEWS b/NEWS index f09487c5da06..08d381209f8e 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,9 @@ PHP NEWS LXB_API as __declspec(dllimport) when linked statically into PHP. (Luther Monson) +- Opcache: + . Fixed bug GH-22265 (Another tailcall vm_interrupt bug). (Levi Morrison) + - Phar: . Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 99e4cb131439..6405780f5051 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -4302,8 +4302,15 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_fcall_interrupt(zend_execute_data *ca } \ } while (0) +#if ZEND_VM_KIND == ZEND_VM_KIND_TAILCALL +# define ZEND_VM_KIND_TAILCALL_SAVE_OPLINE() SAVE_OPLINE() +#else +# define ZEND_VM_KIND_TAILCALL_SAVE_OPLINE() +#endif + #define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \ if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \ + ZEND_VM_KIND_TAILCALL_SAVE_OPLINE(); \ ZEND_VM_LOOP_INTERRUPT(); \ } \ } while (0) diff --git a/ext/zend_test/tests/observer_vm_interrupt_tailcall_return.phpt b/ext/zend_test/tests/observer_vm_interrupt_tailcall_return.phpt new file mode 100644 index 000000000000..95af2681c253 --- /dev/null +++ b/ext/zend_test/tests/observer_vm_interrupt_tailcall_return.phpt @@ -0,0 +1,29 @@ +--TEST-- +Observer: VM interrupt during tailcall return to caller +--DESCRIPTION-- +This exercises a VM interrupt raised immediately before a user function returns +to a caller that invoked it through DO_FCALL. On the tailcall VM, the caller's +saved opline must point to the opcode after DO_FCALL before a pending interrupt +is handled. +--EXTENSIONS-- +zend_test +--INI-- +opcache.jit=0 +zend_test.observer.set_vm_interrupt_on_begin=1 +--FILE-- + +--EXPECT-- +ok From c9cb1f9bec6f7dd40c49ca0e65eecfe2dfeaf7c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= Date: Thu, 11 Jun 2026 21:24:00 +0200 Subject: [PATCH 2/2] Clean Lexbor logs before each Uri\WhatWg\Url wither call (#22276) Clean Lexbor error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown. --- NEWS | 3 +++ .../multiple_error_with_warnings.phpt | 23 +++++++++++++++++++ ext/uri/uri_parser_whatwg.c | 16 +++++++++++++ 3 files changed, 42 insertions(+) create mode 100644 ext/uri/tests/whatwg/modification/multiple_error_with_warnings.phpt diff --git a/NEWS b/NEWS index 08d381209f8e..28337a592f0f 100644 --- a/NEWS +++ b/NEWS @@ -14,6 +14,9 @@ PHP NEWS . Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP. (Luther Monson) + . Clean error logs before each Uri\WhatWg\Url wither call so that errors from + previous wither calls are not returned the next time a UrlValidationError + is thrown. (kocsismate) - Opcache: . Fixed bug GH-22265 (Another tailcall vm_interrupt bug). (Levi Morrison) diff --git a/ext/uri/tests/whatwg/modification/multiple_error_with_warnings.phpt b/ext/uri/tests/whatwg/modification/multiple_error_with_warnings.phpt new file mode 100644 index 000000000000..b5dd89446601 --- /dev/null +++ b/ext/uri/tests/whatwg/modification/multiple_error_with_warnings.phpt @@ -0,0 +1,23 @@ +--TEST-- +Test Uri\WhatWg\Url component modification - error - modifying multiple components with warnings before throwing an exception +--FILE-- +withScheme("\tscheme") + ->withHost("\tex.com") + ->withQuery("\refoo=bar") + ->withFragment("\nfoo"); + +try { + $url->withScheme("0"); +} catch (Throwable $e) { + echo $e::class, ": ", $e->getMessage(), PHP_EOL; + var_dump($e->errors); +} + +?> +--EXPECT-- +Uri\WhatWg\InvalidUrlException: The specified scheme is malformed +array(0) { +} diff --git a/ext/uri/uri_parser_whatwg.c b/ext/uri/uri_parser_whatwg.c index 055f130af7c6..9364fd5d3d80 100644 --- a/ext/uri/uri_parser_whatwg.c +++ b/ext/uri/uri_parser_whatwg.c @@ -265,6 +265,8 @@ static zend_result php_uri_parser_whatwg_scheme_write(void *uri, zval *value, zv zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_protocol_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "scheme"); @@ -300,6 +302,8 @@ static zend_result php_uri_parser_whatwg_username_write(void *uri, zval *value, zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_username_set(lexbor_uri, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "username"); @@ -329,6 +333,8 @@ static zend_result php_uri_parser_whatwg_password_write(void *uri, zval *value, zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_password_set(lexbor_uri, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "password"); @@ -389,6 +395,8 @@ static zend_result php_uri_parser_whatwg_host_write(void *uri, zval *value, zval zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_hostname_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "host"); @@ -418,6 +426,8 @@ static zend_result php_uri_parser_whatwg_port_write(void *uri, zval *value, zval zval_long_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_port_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "port"); @@ -447,6 +457,8 @@ static zend_result php_uri_parser_whatwg_path_write(void *uri, zval *value, zval zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_pathname_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "path"); @@ -476,6 +488,8 @@ static zend_result php_uri_parser_whatwg_query_write(void *uri, zval *value, zva zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_search_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "query string"); @@ -505,6 +519,8 @@ static zend_result php_uri_parser_whatwg_fragment_write(void *uri, zval *value, zval_string_or_null_to_lexbor_str(value, &str); + lxb_url_parser_clean(&lexbor_parser); + if (lxb_url_api_hash_set(lexbor_uri, &lexbor_parser, str.data, str.length) != LXB_STATUS_OK) { throw_invalid_url_exception_during_write(errors, "fragment");