Skip to content

Bound the LRUN page count in the zend_mm_gc() page scan (Zend/zend_al… - #23773

Open
jvoisin wants to merge 1 commit into
php:masterfrom
jvoisin:blrun
Open

jvoisin wants to merge 1 commit into
php:masterfrom
jvoisin:blrun

Conversation

@jvoisin

@jvoisin jvoisin commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

…loc.c)

The final loop of zend_mm_gc() walks the pages of each chunk, and dispatches on the page map entry to decide how far to advance:

if (info & ZEND_MM_IS_SRUN) {
    ...
    i += bin_pages[bin_num];
} else /* if (info & ZEND_MM_IS_LRUN) */ {
    i += ZEND_MM_LRUN_PAGES(info);
}

This is the same "reach the large-run case by elimination" pattern that 0c87849 promoted to a real check in zend_mm_free_heap(), zend_mm_size() and zend_mm_realloc_heap(), except this one was left behind. Promote the comment to a ZEND_MM_CHECK() that requires both the ZEND_MM_IS_LRUN bit and a non-zero page count before advancing, which guarantees forward progress and only fires on a corrupted heap. It costs a test and a branch.

…loc.c)

The final loop of zend_mm_gc() walks the pages of each chunk, and dispatches
on the page map entry to decide how far to advance:

    if (info & ZEND_MM_IS_SRUN) {
        ...
        i += bin_pages[bin_num];
    } else /* if (info & ZEND_MM_IS_LRUN) */ {
        i += ZEND_MM_LRUN_PAGES(info);
    }

This is the same "reach the large-run case by elimination" pattern that
0c87849 promoted to a real check in zend_mm_free_heap(), zend_mm_size() and
zend_mm_realloc_heap(), except this one was left behind. Promote the comment to
a ZEND_MM_CHECK() that requires both the ZEND_MM_IS_LRUN bit and a non-zero page
count before advancing, which guarantees forward progress and only fires on a
corrupted heap. It costs a test and a branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant