ARM64 function JIT causes impossible assertion

[danog]

Description

Ref vimeo/psalm#9350

Enabling JIT on an ARM64 machine with opcache.jit=1205 triggers an impossible assertion (count($result_type_parts) === $combinations where $result_type_parts is an array with 1 element and $combinations is 1).

Using opcache.jit=1254 fixes the issue.
Running var_dump($result_type_parts, $combinations); before the assertion also fixes the issue.

To reproduce, enable opcache, enable assertions, create an empty composer project, install vimeo/psalm:5.7.1 and scan the following file (vendor/bin/psalm --no-cache a.php):

<?php

$v = __DIR__ . '';

Expected result: No AssertionError, like when running on x86_64

Actual result:

[daniil@pi4 t]$ vendor/bin/psalm --no-cache a.php
Warning: "findUnusedCode" will be defaulted to "true" in Psalm 6. You should explicitly enable or disable this setting.
Warning: "findUnusedCode" will be defaulted to "true" in Psalm 6. You should explicitly enable or disable this setting.
Target PHP version: 8.2 (inferred from current PHP version).
Scanning files...
Analyzing files...

Uncaught AssertionError: assert(count($result_type_parts) === $combinations) in /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOp/ConcatAnalyzer.php:181
Stack trace:
#0 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOp/ConcatAnalyzer.php(181): assert()
#1 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php(138): Psalm\Internal\Analyzer\Statements\Expression\BinaryOp\ConcatAnalyzer::analyze()
#2 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/ExpressionAnalyzer.php(265): Psalm\Internal\Analyzer\Statements\Expression\BinaryOpAnalyzer::analyze()
#3 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/ExpressionAnalyzer.php(85): Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer::handleExpression()
#4 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php(242): Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer::analyze()
#5 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/ExpressionAnalyzer.php(536): Psalm\Internal\Analyzer\Statements\Expression\AssignmentAnalyzer::analyze()
#6 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/ExpressionAnalyzer.php(178): Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer::analyzeAssignment()
#7 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/Statements/ExpressionAnalyzer.php(85): Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer::handleExpression()
#8 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/StatementsAnalyzer.php(560): Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer::analyze()
#9 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/StatementsAnalyzer.php(195): Psalm\Internal\Analyzer\StatementsAnalyzer::analyzeStatement()
#10 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/FileAnalyzer.php(179): Psalm\Internal\Analyzer\StatementsAnalyzer->analyze()
#11 /home/daniil/repos/psalm/src/Psalm/Internal/Codebase/Analyzer.php(1581): Psalm\Internal\Analyzer\FileAnalyzer->analyze()
#12 /home/daniil/repos/psalm/src/Psalm/Internal/Codebase/Analyzer.php(522): Psalm\Internal\Codebase\Analyzer->analysisWorker()
#13 /home/daniil/repos/psalm/src/Psalm/Internal/Codebase/Analyzer.php(272): Psalm\Internal\Codebase\Analyzer->doAnalysis()
#14 /home/daniil/repos/psalm/src/Psalm/Internal/Analyzer/ProjectAnalyzer.php(1183): Psalm\Internal\Codebase\Analyzer->analyzeFiles()
#15 /home/daniil/repos/psalm/src/Psalm/Internal/Cli/Psalm.php(374): Psalm\Internal\Analyzer\ProjectAnalyzer->checkPaths()
#16 /home/daniil/repos/psalm/psalm(9): Psalm\Internal\Cli\Psalm::run()
#17 {main}
(Psalm dev-master@589fee7b224f4ccb7c878aa3781c38c3a7dbea0a crashed due to an uncaught Throwable)

Note that psalm will always overwrite the opcache.jit config value to 1205, to modify it edit vendor/vimeo/psalm/src/Psalm/Internal/Fork/PsalmRestarter.php:97

PHP Version

PHP 8.2.2

Operating System

Manjaro arm64

[dstogov]

It seems we have a general bug at least in PHP-8.1 and above. There is an assertion related to typed references in PHP debug build.

$ USE_ZEND_ALLOC=0 ../php8.1/CGI-DEBUG-64/sapi/cli/php -d opcache.jit=0 vendor/bin/psalm --init

Calculating best config level based on project files
Warning: "findUnusedCode" will be defaulted to "true" in Psalm 6. You should explicitly enable or disable this setting.
Calculating best config level based on project files
Warning: "findUnusedCode" will be defaulted to "true" in Psalm 6. You should explicitly enable or disable this setting.
Target PHP version: 8.1 (inferred from current PHP version).
Scanning files...
php: /home/dmitry/php/php8.1/Zend/zend_execute.c:3663: zend_ref_del_type_source: Assertion `source_list->ptr == prop' failed.

We must fix this problem first. It may be the reason of this issue.

[dstogov]

The C assertion at zend_execute.c:3663 is definitely function JIT related.
The reduced test case:

<?php
trait T {
	function foo() {
		return reset($this->a);
	}
}
class C {
	use T;
	private array $a = [1];
}
$o = new C;
$o->foo();
unset($o);
$o = new C;
$o->foo();
unset($o);

[dstogov]

The bug that caused C assertion is fixed in GIT PHP-8.1 and above.
@danog can you please verify the problem with PHP build that includes the corresponding fix.

[danog]

@dstogov The issue still occurs on arm64, with a debug build of commit b578f69

[danog]

Upon shutdown the debug arm64 build also spits out this:

[Mon Feb 20 20:32:16 2023]  Script:  '/home/daniil/repos/psalm/psalm'
/home/daniil/repos/php-src/Zend/zend_objects.c(187) :  Freeing 0x0000ffffac462980 (328 bytes), script=/home/daniil/repos/psalm/psalm
Last leak repeated 6940 times
[Mon Feb 20 20:32:16 2023]  Script:  '/home/daniil/repos/psalm/psalm'
/home/daniil/repos/php-src/Zend/zend_closures.c(524) :  Freeing 0x0000ffffac463880 (336 bytes), script=/home/daniil/repos/psalm/psalm
Last leak repeated 602 times
=== Total 7544 memory leaks detected ===

[danog]

Thanks, this fixed it!
However the leak messages are still present on shutdown:

[Tue Feb 21 10:01:29 2023]  Script:  '/home/daniil/repos/psalm/psalm'
/home/daniil/repos/php-src/Zend/zend_objects.c(187) :  Freeing 0x0000ffff9c462980 (328 bytes), script=/home/daniil/repos/psalm/psalm
Last leak repeated 6940 times
[Tue Feb 21 10:01:29 2023]  Script:  '/home/daniil/repos/psalm/psalm'
/home/daniil/repos/php-src/Zend/zend_closures.c(524) :  Freeing 0x0000ffff9c463880 (336 bytes), script=/home/daniil/repos/psalm/psalm
Last leak repeated 602 times
=== Total 7544 memory leaks detected ===

[dstogov]

These leaks are visible on x86_64/Linux as well. Disabling JIT doesn't fix them. So they are not JIT related.

I'm not sure if/when I'll be able to debug this.
Is it possible to run psalm without forking child process(es)?
Or may be start the child process directly?

@iluuu1994 may be you saw similar leaks and know the reason?

[danog]

@dstogov You can run Psalm without forking multiple threads by specifying --threads=1 .

[dstogov]

--threads==1 spawns new process and I have somehow debug it (attach gdb, etc)

[danog]

Ah yes, that happens due to the logic that disables xdebug and enables opcache, set the PSALM_ALLOW_XDEBUG=1 env variable to disable that logic too.

[dstogov]

PSALM_ALLOW_XDEBUG=1 also fixes the memory leaks :)

[danog]

Hmm, did you enable opcache/JIT in php.ini?

[dstogov]

The leaks are visible in spawned process only (even without JIT). I tried to disable it in PsalmRestarter.php:97.
With PSALM_ALLOW_XDEBUG=1 I don't see leaks with and without JIT.