Observer segfault when calling user function in internal function via trampoline

[YuanchengJiang]

Description

The following code:

<?php
class LocalSoapClient extends SoapClient {
function __doRequest($request, $location, $action, $version, $one_way = 0): string {
}
}
$client = new LocalSoapClient(__DIR__."/classmap003.wsdl",
array('classmap'=>array('A'=>'A','B'=>'B')));
print_r($client->f());

Resulted in this output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1778123==ERROR: AddressSanitizer: SEGV on unknown address 0x00131fff8007 (pc 0x557390644f96 bp 0x7ffef91295f0 sp 0x7ffef91294a0 T0)
==1778123==The signal is caused by a READ memory access.
    #0 0x557390644f96 in call_end_observers /php-src/Zend/zend_observer.c:300:80
    #1 0x557390645f4b in zend_observer_fcall_end_all /php-src/Zend/zend_observer.c:325:3
    #2 0x55738f086722 in php_request_shutdown /php-src/main/main.c:1902:3
    #3 0x55739079f2b0 in do_cli /php-src/sapi/cli/php_cli.c:1106:3
    #4 0x557390796524 in main /php-src/sapi/cli/php_cli.c:1310:18
    #5 0x7f69ba023d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7f69ba023e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #7 0x55738c603904 in _start (/php-src/sapi/cli/php+0x2403904) (BuildId: d9851980940e1525eb2e61068d0828e86059842d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /php-src/Zend/zend_observer.c:300:80 in call_end_observers
==1778123==ABORTING

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[YuanchengJiang]

some reports require certain dependency files (e.g., classmap003.wsdl), which can be found in the repo.

[devnexen]

sure but could not reproduce on my mac, get this instead php(90314,0x1f2723240) malloc: nano zone abandoned due to inability to reserve vm space., I may have more luck on linux.

[nielsdos]

The reason you couldn't reproduce this is because you need to use zend_test and use -d zend_test.observer.enabled=1 -d zend_test.observer.show_output=1 -d zend_test.observer.observe_all=1.

[YuanchengJiang]

indeed. sorry i forgot to add the configs

[nielsdos]

This bug is unrelated to soap, this is an engine bug that happens when an observer calls a user function while reusing the stack frame in ZEND_CALL_TRAMPOLINE. I'm on it.