JIT composer segfault when requiring phpoffice/phpspreadsheet

[danog]

Description

Seems to be different from the stack overflow issue.

Reproducer 9 at https://github.com/danog/jit_bugs

[daniil@arch-lenovo jit_bugs]$ bugs/9_composer.sh
About to run composer
Executing for the first time...
Composer is operating significantly slower than normal because you do not have the PHP curl extension enabled.
Loading composer repositories with package information
Updating dependencies
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7f2c3178d82f bp 0x000000000001 sp 0x7ffe5fd57660 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x7f2c3178d82f  (/dev/zero (deleted)+0x10033a82f)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x10033a82f)

Ping @dstogov

PHP Version

master @ b7bf5e5, PHP-8.2

Operating System

No response

[dstogov]

The problem in array key type inference. In the following test returning $a2 is inferred to HASH but it also may be a PACKED array.

<?php
function foo(array $a1) {
    $a2 = [];
    foreach ($a1 as $key => $val) {
        if ($val) {
	    $a2['dev'][] = $key;
	} else {
            $a2[0][] = $val;
        }
    }
    return $a2;
}

The problem exists in the old PHP versions as well.

[dstogov]

The reduced test case crashes with function and tracing JIT in master, PHP-8.3 and PHP-8.2.

<?php
function foo(array $a1) {
    $a2 = [];
    foreach ($a1 as $key => $val) {
        if (!$val) {
            $a2["bad"][] = $key;
        } else {
            $a2[0][] = $key;
        }
    }
    foreach ($a2 as $key => $val) {
    	var_dump($key);
    }
}
foo([1, 2, 3]);
foo([1, 2, 3]);
foo([0, 0]);
?>

PHP-8.1 is not affected because FE_FETCH always work with hash arrays