Segmentation fault in Zend/zend_object_handlers.c

[YuanchengJiang]

Description

The following code:

<?php
set_error_handler(function($code, $msg) {
$GLOBALS['a']=8;
});
trait Foo {
public string $bar {
get => $fusion->getBar();
}
}
class A {
use Foo;
}
$a = new A();
var_dump($a->bar);

Resulted in this output:

/php-src/Zend/zend_object_handlers.c:829:7: runtime error: member access within misaligned address 0xffffffffffffffff for type 'const zend_object_handlers' (aka 'const struct _zend_object_handlers'), which requires 8 byte alignment
0xffffffffffffffff: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_object_handlers.c:829:7 in

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[DanielEScherzer]

Minimal reproduction (though the address changes, original address can be produced by moving the property hook into a trait)

<?php
set_error_handler(function($code, $msg) {
    $GLOBALS['a']=8;
});
class A {
    public $bar {
        get => $fusion->getBar();
    }
}
$a = new A();
var_dump($a->bar);