Coverage Report

Created: 2026-10-28 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/sapi/fuzzer/fuzzer-tracing-jit.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright © The PHP Group and Contributors.                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to the Modified BSD License that is      |
6
   | bundled with this package in the file LICENSE, and is available      |
7
   | through the World Wide Web at <https://www.php.net/license/>.        |
8
   |                                                                      |
9
   | SPDX-License-Identifier: BSD-3-Clause                                |
10
   +----------------------------------------------------------------------+
11
   | Authors: Nikita Popov <nikic@php.net>                                |
12
   +----------------------------------------------------------------------+
13
 */
14
15
#include "fuzzer-execute-common.h"
16
17
22.8k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
18
22.8k
  if (Size > MAX_SIZE) {
19
    /* Large inputs have a large impact on fuzzer performance,
20
     * but are unlikely to be necessary to reach new codepaths. */
21
7
    return 0;
22
7
  }
23
24
22.8k
  zend_string *jit_option = ZSTR_INIT_LITERAL("opcache.jit", 1);
25
26
  /* First run without JIT to determine whether we bail out. We should not run JITed code if
27
   * we bail out here, as the JIT code may loop infinitely. */
28
22.8k
  steps_left = MAX_STEPS;
29
22.8k
  bailed_out = false;
30
22.8k
  set_jit_option(jit_option, "off");
31
22.8k
  fuzzer_do_request_from_buffer(
32
22.8k
    FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
33
34
22.8k
  if (!bailed_out) {
35
22.1k
    steps_left = MAX_STEPS;
36
22.1k
    set_jit_option(jit_option, "tracing");
37
22.1k
    zend_execute_ex = orig_execute_ex;
38
    /* Trace & compile */
39
22.1k
    fuzzer_do_request_from_buffer(
40
22.1k
      FILE_NAME, (const char *) Data, Size, /* execute */ 1, NULL);
41
    /* Execute trace */
42
22.1k
    fuzzer_do_request_from_buffer(
43
22.1k
      FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
44
22.1k
    zend_execute_ex = fuzzer_execute_ex;
45
22.1k
  }
46
47
22.8k
  zend_string_release(jit_option);
48
49
22.8k
  return 0;
50
22.8k
}
51
52
16
int LLVMFuzzerInitialize(int *argc, char ***argv) {
53
16
  char ini_buf[512];
54
16
  snprintf(ini_buf, sizeof(ini_buf),
55
    /* The default opcache.jit=disable does not allow enabling the JIT at runtime. */
56
16
    "opcache.jit=off\n"
57
16
    "opcache.validate_timestamps=0\n"
58
16
    "opcache.file_update_protection=0\n"
59
16
    "opcache.memory_consumption=1024\n"
60
16
    "opcache.jit_buffer_size=128M\n"
61
16
    "opcache.jit_hot_func=1\n"
62
16
    "opcache.jit_hot_loop=1\n"
63
16
    "opcache.jit_hot_return=1\n"
64
16
    "opcache.jit_hot_side_exit=1\n"
65
16
    "opcache.jit_max_root_traces=100000\n"
66
16
    "opcache.jit_max_side_traces=100000\n"
67
16
    "opcache.jit_max_exit_counters=100000\n"
68
16
    "opcache.protect_memory=1\n");
69
70
16
  create_file();
71
16
  fuzzer_init_php_for_execute(ini_buf);
72
16
  return 0;
73
16
}