Segmentation fault in ZEND_DO_UCALL_SPEC_RETVAL_USED_HANDLER

[pfustc]

Description

Hi @dstogov, I see another segmentation fault issue on x86 while running phpunit tests. It's reproducible with CALL VM and GCC global regs disabled. Please follow below steps to reproduce.

1. Configure and build php

$ cd /tmp
$ git clone git@github.com:php/php-src.git
$ cd php-src
$ php Zend/zend_vm_gen.php --with-vm-kind=CALL
$ bash buildconf
$ bash configure --enable-debug --enable-bcmath --enable-dba --enable-fpm --enable-ftp --enable-gd \
  --enable-mbstring --enable-xmlreader --disable-gcc-global-regs
$ make -j 50
$ make install

2. Build phpunit

$ cd /tmp
$ git clone https://github.com/sebastianbergmann/phpunit.git
$ cd phpunit
$ composer install

3. Run with some options

$ php -d opcache.enable_cli=1 -d opcache.jit=1205 -d opcache.jit_buffer_size=128M \
  -d opcache.protect_memory=1 ./phpunit
Segmentation fault (core dumped)

Some GDB output

Program received signal SIGSEGV, Segmentation fault.
0x0000555555bbd5f2 in ZEND_DO_UCALL_SPEC_RETVAL_USED_HANDLER (execute_data=0x7ffff5417c00) at /home/penli01/php-src/Zend/zend_vm_execute.h:1570
1570		zend_function *fbc = call->func;
(gdb) l
1565
1566	static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DO_UCALL_SPEC_RETVAL_USED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1567	{
1568		USE_OPLINE
1569		zend_execute_data *call = EX(call);
1570		zend_function *fbc = call->func;
1571		zval *ret;
1572
1573		SAVE_OPLINE();
1574		EX(call) = call->prev_execute_data;
(gdb) p call
$1 = (zend_execute_data *) 0x0

PHP Version

master @ c15988a

Operating System

Ubuntu 22.04