Skip to content

PHP 8.5.10 crashed in Windows when Opcache.JIT is enabled #23484

Description

@vibbow

Description

It might be related with #21710

After upgrade PHP to 8.5.10, and enabled JIT (and disabled file cache), PHP still crashed.

System Environment:

Windows 2022 + IIS + PHP (FastCGI)

Following is the crash file analysis

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 343

    Key  : Analysis.Elapsed.mSec
    Value: 1649

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 1

    Key  : Analysis.Init.CPU.mSec
    Value: 640

    Key  : Analysis.Init.Elapsed.mSec
    Value: 81169

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 129

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29617.1000

    Key  : Analysis.Version.Description
    Value: 10.2604.29.1 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2604.29.1

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_php8.dll!zend_jit_trace_build_tssa

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7ffb2c472d16

    Key  : Failure.Exception.IP.Module
    Value: php8

    Key  : Failure.Exception.IP.Offset
    Value: 0x3b2d16

    Key  : Failure.Hash
    Value: {2e6b5565-e3de-8646-ebfd-977f85e741e7}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 1237225

    Key  : Timeline.Process.Start.DeltaSec
    Value: 229

    Key  : WER.OS.Branch
    Value: fe_release

    Key  : WER.OS.Version
    Value: 10.0.20348.1

    Key  : WER.Process.Version
    Value: 8.5.10.0


FILE_IN_CAB:  php-cgi.exe.7072.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffb2c472d16 (php8!zend_jit_trace_build_tssa+0x0000000000004506)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000253b5b07f6c
Attempt to read from address 00000253b5b07f6c

PROCESS_NAME:  php-cgi.exe

READ_ADDRESS:  00000253b5b07f6c 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000253b5b07f6c

STACK_TEXT:  
00000092`861f0650 00007ffb`2c4775eb     : 00000092`861f7350 00000000`0000003a 00000000`0000000d 00000000`00000000 : php8!zend_jit_trace_build_tssa+0x4506
00000092`861f07e0 00007ffb`2c48a175     : 000001d3`00000020 00007ffb`5183a8c1 000001d3`c093ae80 00000000`00000005 : php8!zend_jit_trace+0x15b
00000092`861f1120 00007ffb`2c48a8ee     : 00000000`00000000 00007ffb`359c12ee 000001d3`be213ad0 00000000`00000000 : php8!zend_jit_compile_side_trace+0x185
00000092`861f72d0 00007ffb`2c42ce26     : 00000000`40000000 000001d3`bd6cdd20 000001d3`be13c600 00000092`861fb460 : php8!zend_jit_trace_hot_side+0x4de
00000092`861fb3a0 00001000`20000574     : 00000000`0000000d 000001d3`0000003a 00000000`00000000 000001d3`be213cf0 : php8!zend_jit_trace_exit+0x6a6
00000092`861fb440 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00001000`20000574


STACK_COMMAND: ~0s; .ecxr ; kb

IP_IN_PAGED_CODE: 
php8!zend_jit_trace_build_tssa+4506 [C:\Users\runneradmin\AppData\Local\Temp\php-4b164008-6ffd-4215-abda-6879932a9885\config\vs17\x64\php-8.5.10\ext\opcache\jit\zend_jit_trace.c @ 2492]
00007ffb`2c472d16 8b54c22c        mov     edx,dword ptr [rdx+rax*8+2Ch]

FAULTING_SOURCE_LINE:  C:\Users\runneradmin\AppData\Local\Temp\php-4b164008-6ffd-4215-abda-6879932a9885\config\vs17\x64\php-8.5.10\ext\opcache\jit\zend_jit_trace.c

FAULTING_SOURCE_FILE:  C:\Users\runneradmin\AppData\Local\Temp\php-4b164008-6ffd-4215-abda-6879932a9885\config\vs17\x64\php-8.5.10\ext\opcache\jit\zend_jit_trace.c

FAULTING_SOURCE_LINE_NUMBER:  2492

FAULTING_SOURCE_CODE:  
  2488: 					if (ssa->var_info
  2489: 					 && zend_jit_trace_copy_ssa_var_info(op_array, ssa, ssa_opcodes, tssa, v, NULL)) {
  2490: 						/* pass */
  2491: 					} else {
> 2492: 						ssa_vars[v].alias = zend_jit_var_may_alias(op_array, ssa, i);
  2493: 						if (op_array->arg_info) {
  2494: 							zend_arg_info *arg_info = &op_array->arg_info[i];
  2495: 							zend_class_entry *ce;
  2496: 							uint32_t tmp = zend_fetch_arg_info_type(script, arg_info, &ce);
  2497: 


SYMBOL_NAME:  php8!zend_jit_trace_build_tssa+4506

MODULE_NAME: php8

IMAGE_NAME:  php8.dll

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_php8.dll!zend_jit_trace_build_tssa

OS_VERSION:  10.0.20348.1

BUILDLAB_STR:  fe_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  8.5.10.0

FAILURE_ID_HASH:  {2e6b5565-e3de-8646-ebfd-977f85e741e7}

Followup:     MachineOwner

PHP.ini (diff from php.ini-production)

realpath_cache_size = 16M
realpath_cache_ttl = 600
expose_php = Off
max_execution_time = 60
memory_limit = 512M
error_log = "D:\PHP\Temp\php85_errors.log"
post_max_size = 72M
extension_dir = "D:\PHP\8.5\ext"
sys_temp_dir = "D:\PHP\Temp\"

cgi.force_redirect = 0
cgi.fix_pathinfo = 1
fastcgi.impersonate = 1
fastcgi.logging = 0

upload_tmp_dir = "D:\PHP\Temp\Upload\"
upload_max_filesize = 64M

extension=bz2
extension=curl
extension=exif
extension=fileinfo
extension=gd
extension=gmp
extension=intl
extension=mbstring
extension=mysqli
extension=openssl
extension=pdo_mysql
extension=pdo_sqlite
extension=shmop
extension=sockets
extension=sodium
extension=sqlite3
extension=xsl
extension=zip
extension=com_dotnet
extension=imagick
extension=redis
extension=yaml
extension=maxminddb
extension=ssh2

date.timezone = "Asia/Shanghai"

;SMTP = localhost
;smtp_port = 25
sendmail_path = "D:\PHP\Shared\sendmail\sendmail.exe -t"

session.save_path = "D:\PHP\Temp\Session\"
session.cookie_httponly = 1

opcache.enable=1
opcache.memory_consumption=512
opcache.interned_strings_buffer=32
opcache.max_accelerated_files=32531
opcache.validate_timestamps=1
opcache.revalidate_freq=60
opcache.error_log = "D:\PHP\Temp\php85_opcache_errors.log"
opcache.jit = tracing
opcache.jit_buffer_size = 512M

curl.cainfo = "D:\PHP\Shared\cert\cacert.pem"
openssl.cafile = "D:\PHP\Shared\cert\cacert.pem"

PHP Version

PHP 8.5.10 (cli) (built: Aug 25 2026 21:23:48) (NTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies

Operating System

Windows Server 2022

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions