Null pointer deref in observer API when calling cases() method on preloaded enum

[TimWolla]

Description

The following code:

test5.php

<?php

spl_autoload_register(static function ($class) {
	if ($class === 'MyEnum') {
		require_once(__DIR__ . '/preload.php');
	}
});

var_dump(MyEnum::cases());

preload.php

<?php

enum MyEnum
{
	case Foo;
}

executed as:

sapi/cli/php -d zend_extension=$(pwd)/modules/opcache.so -d opcache.enable_cli=1 -d opcache.preload=$(pwd)/preload.php -d zend_test.observer.enabled=1 -d zend_test.observer.observe_all=1 test5.php 

Resulted in this output:

<!-- init 'php-src/preload.php' -->
<file 'php-src/preload.php'>
</file 'php-src/preload.php'>
<!-- init 'php-src/test5.php' -->
<file 'php-src/test5.php'>
  <!-- init spl_autoload_register() -->
  <spl_autoload_register>
  </spl_autoload_register>
Zend/zend_observer.h:108:82: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Zend/zend_observer.h:108:82 in 
Zend/zend_observer.h:92:9: runtime error: load of null pointer of type 'zend_observer_fcall_begin_handler' (aka 'void (*)(struct _zend_execute_data *)')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Zend/zend_observer.h:92:9 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==511299==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55c2312b95f7 bp 0x7fff01e61950 sp 0x7fff01e61940 T0)
==511299==The signal is caused by a READ memory access.
==511299==Hint: address points to the zero page.
    #0 0x55c2312b95f7 in zend_observer_handler_is_unobserved php-src/Zend/zend_observer.h:92:18
    #1 0x55c2312b9571 in zend_observer_fcall_has_no_observers php-src/Zend/zend_observer.h:109:9
    #2 0x55c2312b8d30 in zend_observer_fcall_begin_specialized php-src/Zend/zend_observer.h:115:7
    #3 0x55c230ecc1a7 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER php-src/Zend/zend_vm_execute.h:2153:3
    #4 0x55c230c29d87 in execute_ex php-src/Zend/zend_vm_execute.h:58595:7
    #5 0x55c230c2afa2 in zend_execute php-src/Zend/zend_vm_execute.h:64247:2
    #6 0x55c2317528e8 in zend_execute_script php-src/Zend/zend.c:1943:3
    #7 0x55c2302e1ae6 in php_execute_script_ex php-src/main/main.c:2584:13
    #8 0x55c2302e2388 in php_execute_script php-src/main/main.c:2624:9
    #9 0x55c23176103a in do_cli php-src/sapi/cli/php_cli.c:946:5
    #10 0x55c23175ca32 in main php-src/sapi/cli/php_cli.c:1346:18
    #11 0x7f4cd2a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7f4cd2a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #13 0x55c22e403374 in _start (php-src/sapi/cli/php+0x1c03374) (BuildId: 3ddbca74c8670516864203a517f20c02cff6881a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV php-src/Zend/zend_observer.h:92:18 in zend_observer_handler_is_unobserved
==511299==ABORTING

But I expected this output instead:

<!-- init 'php-src/test5.php' -->
<file 'php-src/test5.php'>
  <!-- init spl_autoload_register() -->
  <spl_autoload_register>
  </spl_autoload_register>
  <!-- init MyEnum::cases() -->
  <MyEnum::cases>
  </MyEnum::cases>
  <!-- init var_dump() -->
  <var_dump>
array(1) {
  [0]=>
  enum(MyEnum::Foo)
}
  </var_dump>
</file 'php-src/test5.php'>

PHP Version

git master

Operating System

No response

[nielsdos]

Repros on 8.4 and master, seemingly not on 8.3.

[nielsdos]

Reverting 25d7616 fixes this

[nielsdos]

Yeah okay.
Preloading happens during post startup, where it copies the user classes to the CG class table, including the cases function. But setting up the persistent runtime cache happens prior to preloading. Moving it after the post startup will break the code that copies the runtime cache pointer.
cc @bwoebi

[bwoebi]

@nielsdos Fixing this was non-trivial :-( I hope #17835 will do. If you're willing to check it out...