Skip to content

Segmentation fault in the Zend engine (JIT enabled) #15652

Closed
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php

class C {}

trait T {
    public function equal(C $type): bool {
        return $type instanceof self && $this->value === $type->value;
    }
}

class C1 extends C {
    use T;
    public function __construct(private int $value) {}
}

class C2 extends C {
    use T;
}

$x = new C1(1);
var_dump($x->equal($x));
var_dump($x->equal($x));
$a = new C2("aaa");
var_dump($a->equal($a));
var_dump($a->equal($a));

Resulted in this output:

=================================================================
==1881556==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7fcf2b9bdbdc bp 0x7ffc63df4fd0 sp 0x7ffc63df4f30 T0)
==1881556==The signal is caused by a READ memory access.
==1881556==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x7fcf2b9bdbdc  (/dev/zero (deleted)+0x8000bdc)
    #1 0x5622d9599022 in zend_execute /php-src/Zend/zend_vm_execute.h:63873:2
    #2 0x5622da094e08 in zend_execute_script /php-src/Zend/zend.c:1913:3
    #3 0x5622d8c684c6 in php_execute_script_ex /php-src/main/main.c:2576:13
    #4 0x5622d8c68d68 in php_execute_script /php-src/main/main.c:2616:9
    #5 0x5622da0a2c53 in do_cli /php-src/sapi/cli/php_cli.c:935:5
    #6 0x5622da09e672 in main /php-src/sapi/cli/php_cli.c:1309:18
    #7 0x7fcf7220ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x8000bdc) 
==1881556==ABORTING

To reproduce:

opcache.enable_cli=1
opcache.jit_buffer_size=64M
opcache.jit=tracing
opcache.jit_hot_func=2

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions