Opcache bad signal 139 crash in ZTS bookworm (frankenphp)

[AlliBalliBaba]

Description

When starting an application that has lots of php files (Laravel) I sometimes get a crash with 'bad signal' 139.
I don't know if this is limited to the ZTS build of PHP, but it happens in the ZTS FrankenPHP bookworm Docker Image (PHP 8.3.15) with opcache and opcache_cli enabled.

The backtrace from the core-dump:

#0  runtime.raise () at /usr/local/go/src/runtime/sys_linux_amd64.s:154
#1  0x000000000045d0fb in runtime.raisebadsignal (sig=11, c=0xc00078fa50) at /usr/local/go/src/runtime/signal_unix.go:987
#2  0x000000000045d547 in runtime.badsignal (sig=11, c=0xc00078fa50) at /usr/local/go/src/runtime/signal_unix.go:1096
#3  0x000000000045bda8 in runtime.sigtrampgo (sig=11, info=0xc00078fbf0, ctx=0xc00078fac0) at /usr/local/go/src/runtime/signal_unix.go:468
#4  0x0000000000481126 in runtime.sigtramp () at /usr/local/go/src/runtime/sys_linux_amd64.s:352
#5  <signal handler called>
#6  0x00007f38055478b6 in zend_mm_alloc_small (heap=0x7f376c400040, bin_num=16,
    __zend_filename=0x7f3805fcdbc0 "/usr/local/src/php/Zend/zend_opcode.c", __zend_lineno=1051, __zend_orig_filename=0x0, __zend_orig_lineno=0)     
    at /usr/local/src/php/Zend/zend_alloc.c:1312
#7  0x00007f3805548471 in zend_mm_realloc_heap (heap=0x7f376c400040, ptr=0x7f376c472000, size=272, use_copy_size=false, copy_size=240, 
    __zend_filename=0x7f3805fcdbc0 "/usr/local/src/php/Zend/zend_opcode.c", __zend_lineno=1051, __zend_orig_filename=0x0, __zend_orig_lineno=0)     
    at /usr/local/src/php/Zend/zend_alloc.c:1609
#8  0x00007f380554ac5f in _erealloc (ptr=0x7f376c472000, size=240, __zend_filename=0x7f3805fcdbc0 "/usr/local/src/php/Zend/zend_opcode.c",
    __zend_lineno=1051, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/local/src/php/Zend/zend_alloc.c:2634
#9  0x00007f380557d083 in pass_two (op_array=0x7f376c533ca8) at /usr/local/src/php/Zend/zend_opcode.c:1051
#10 0x00007f3805564c5f in zend_compile_func_decl (result=0x0, ast=0x7f376c519f00, toplevel=false) at /usr/local/src/php/Zend/zend_compile.c:7698    
#11 0x00007f380556d3b6 in zend_compile_stmt (ast=0x7f376c519f00) at /usr/local/src/php/Zend/zend_compile.c:10427
#12 0x00007f380556071a in zend_compile_stmt_list (ast=0x7f376c519dd0) at /usr/local/src/php/Zend/zend_compile.c:6405
#13 0x00007f380556d28b in zend_compile_stmt (ast=0x7f376c519dd0) at /usr/local/src/php/Zend/zend_compile.c:10374
#14 0x00007f380555de79 in zend_compile_if (ast=0x7f376c519f60) at /usr/local/src/php/Zend/zend_compile.c:5643
#15 0x00007f380556d368 in zend_compile_stmt (ast=0x7f376c519f60) at /usr/local/src/php/Zend/zend_compile.c:10414
#16 0x00007f380556d04a in zend_compile_top_stmt (ast=0x7f376c519f60) at /usr/local/src/php/Zend/zend_compile.c:10352
#17 0x00007f380556cf57 in zend_compile_top_stmt (ast=0x7f376c4ecb98) at /usr/local/src/php/Zend/zend_compile.c:10338
#18 0x00007f380550b718 in zend_compile (type=2) at Zend/zend_language_scanner.l:618
#19 0x00007f380550b8dc in compile_file (file_handle=0x7f3788df7360, type=8) at Zend/zend_language_scanner.l:653
#20 0x00007f38052ea915 in phar_compile_file (file_handle=0x7f3788df7360, type=8) at /usr/local/src/php/ext/phar/phar.c:3352
#21 0x00007f379a26f93c in opcache_compile_file (file_handle=0x7f3788df7360, type=8, op_array_p=0x7f3788df72f8)
    at /usr/local/src/php/ext/opcache/ZendAccelerator.c:1817
#22 0x00007f379a2713e7 in persistent_compile_file (file_handle=0x7f3788df7360, type=8) at /usr/local/src/php/ext/opcache/ZendAccelerator.c:2147
#23 0x00007f380550bb85 in compile_filename (type=8, filename=0x4048f030) at Zend/zend_language_scanner.l:704
#24 0x00007f38055d31c1 in zend_include_or_eval (inc_filename_zv=0x7f376c4143b0, type=8) at /usr/local/src/php/Zend/zend_execute.c:4946
#25 0x00007f380563842d in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at /usr/local/src/php/Zend/zend_vm_execute.h:39836
#26 0x00007f380565df51 in execute_ex (ex=0x7f376c414020) at /usr/local/src/php/Zend/zend_vm_execute.h:60595
#27 0x00007f380565efc9 in zend_execute (op_array=0x7f376c46d000, return_value=0x0) at /usr/local/src/php/Zend/zend_vm_execute.h:61604
#28 0x00007f38055928f2 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php/Zend/zend.c:1895
#29 0x00007f38054ca91c in php_execute_script (primary_file=0x7f3788df8b00) at /usr/local/src/php/main/main.c:2528
#30 0x00000000019b1f44 in frankenphp_execute_script (file_name=0x0) at frankenphp.c:954
#31 0x00000000019afb47 in _cgo_b21416d01a02_Cfunc_frankenphp_execute_script (v=0xc00061fdd8) at /tmp/go-build/cgo-gcc-prolog:74
#32 0x000000000047f244 in runtime.asmcgocall () at /usr/local/go/src/runtime/asm_amd64.s:918
#33 0x000000c000444700 in ?? ()
#34 0x00007f3788df8c70 in ?? ()
#35 0x00007f380617e5c0 in ?? () from /usr/local/lib/libphp.so
#36 0x000000c0005d4808 in ?? ()
#37 0x00007f3788df8cd8 in ?? ()
#38 0x00000000005539e1 in crosscall2 () at /usr/local/go/src/runtime/cgo/asm_amd64.s:43
#39 0x00000000019af86a in go_frankenphp_on_thread_work (threadIndex=824640142696) at _cgo_export.c:299
#40 0x00000000019b1313 in php_thread (arg=<optimized out>) at frankenphp.c:826
#41 0x00007f3804e64144 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#42 0x00007f3804ee47dc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Here's what all other threads are doing at the time of the crash if it helps:

1    Thread 0x7f3788df96c0 (LWP 128690) runtime.raise () at /usr/local/go/src/runtime/sys_linux_amd64.s:154
  2    Thread 0x7f379affd6c0 (LWP 128679) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  3    Thread 0x7f379a24f6c0 (LWP 128680) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  4    Thread 0x7f376ffff6c0 (LWP 128713) 0x00007f38056c2435 in zend_optimize_temporary_variables (op_array=0x7f37454080f0, ctx=0x7f376fffd0d0)
    at /usr/local/src/php/Zend/Optimizer/optimize_temp_vars_5.c:131
  5    Thread 0x7f377affd6c0 (LWP 128700) lex_scan (zendlval=0x7f377affa370, elem=0x7f377affac80) at Zend/zend_language_scanner.l:3122
  6    Thread 0x7f37bab776c0 (LWP 128672) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  7    Thread 0x7f37ba3366c0 (LWP 128673) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  8    Thread 0x7f379bfff6c0 (LWP 128677) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  9    Thread 0x7f3777ff76c0 (LWP 128706) __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:280
  10   Thread 0x7f378bdff6c0 (LWP 128684) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  11   Thread 0x7f37b8aa36c0 (LWP 128676) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  12   Thread 0x7f378a5fc6c0 (LWP 128687) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  13   Thread 0x7f3776ff56c0 (LWP 128708) 0x00007f38056b1e16 in get_ssa_var_info (ssa=0x7f3745e7c630, ssa_var_num=1)
    at /usr/local/src/php/Zend/Optimizer/zend_inference.h:167
  14   Thread 0x7f3781ffb6c0 (LWP 128695) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  15   Thread 0x7f37797fa6c0 (LWP 128703) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  16   Thread 0x7f37837fe6c0 (LWP 128692) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  17   Thread 0x7f377a7fc6c0 (LWP 128701) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  18   Thread 0x7f3798a4c6c0 (LWP 128683) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  19   Thread 0x7f3789dfb6c0 (LWP 128688) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  20   Thread 0x7f378adfd6c0 (LWP 128686) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  21   Thread 0x7f3780ff96c0 (LWP 128697) 0x00007f38056c86c9 in zend_cfg_build_predecessors (arena=0x7f3780ff70d0, cfg=0x7f37474bf618)
    at /usr/local/src/php/Zend/Optimizer/zend_cfg.c:631
  22   Thread 0x7f380276d8c0 (LWP 128669) runtime/internal/syscall.Syscall6 () at /usr/local/go/src/runtime/internal/syscall/asm_linux_amd64.s:36   
  23   Thread 0x7f377b7fe6c0 (LWP 128699) zend_string_tolower_ex (str=0x7f36c8e52e60, persistent=false)
    at /usr/local/src/php/Zend/zend_operators.c:3093
  24   Thread 0x7f37b9b356c0 (LWP 128674) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  25   Thread 0x7f3799a4e6c0 (LWP 128681) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  26   Thread 0x7f3775ff36c0 (LWP 128710) zend_ssa_next_use (ssa_op=0x7f3745ad4620, var=47, use=66) at Zend/Optimizer/zend_ssa.h:196
  27   Thread 0x7f3782ffd6c0 (LWP 128693) __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:273
  28   Thread 0x7f37757f26c0 (LWP 128711) 0x00007f38056dce53 in zend_ssa_compute_use_def_chains (arena=0x7f37757f00d0, op_array=0x7f37458107d0,     
    ssa=0x7f37458aa470) at /usr/local/src/php/Zend/Optimizer/zend_ssa.c:1075
  29   Thread 0x7f37767f46c0 (LWP 128709) 0x00007f3805547820 in zend_mm_alloc_small (heap=0x7f3745c00040, bin_num=7,
    __zend_filename=0x7f3805fc35b0 "/usr/local/src/php/Zend/zend_string.h", __zend_lineno=174, __zend_orig_filename=0x0, __zend_orig_lineno=0)      
    at /usr/local/src/php/Zend/zend_alloc.c:1300
  30   Thread 0x7f3783fff6c0 (LWP 128691) lex_scan (zendlval=0x7f3783ffc370, elem=0x7f3783ffcc80)
    at /usr/local/src/php/Zend/zend_language_scanner.c:2312
  31   Thread 0x7f36d3fff6c0 (LWP 128720) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  32   Thread 0x7f3774ff16c0 (LWP 128712) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  33   Thread 0x7f37bb3786c0 (LWP 128671) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  34   Thread 0x7f379b7fe6c0 (LWP 128678) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  35   Thread 0x7f3778ff96c0 (LWP 128704) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  36   Thread 0x7f376effd6c0 (LWP 128715) lex_scan (zendlval=0x7f376effa370, elem=0x7f376effac80) at Zend/zend_language_scanner.l:2417
  37   Thread 0x7f376dffb6c0 (LWP 128717) 0x00007f3805547815 in zend_mm_alloc_small (heap=0x7f3744c00040, bin_num=26, __zend_filename=0x0,
    __zend_lineno=0, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/local/src/php/Zend/zend_alloc.c:1300
  38   Thread 0x7f379924d6c0 (LWP 128682) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  39   Thread 0x7f37b92b46c0 (LWP 128675) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  40   Thread 0x7f376cff96c0 (LWP 128719) 0x00007f3805511b8a in lex_scan (zendlval=0x7f376cff6370, elem=0x7f376cff6c80)
    at /usr/local/src/php/Zend/zend_language_scanner.c:2584
  41   Thread 0x7f376f7fe6c0 (LWP 128714) 0x00007f38055baed5 in zif_function_exists (execute_data=0x7f3745214440, return_value=0x7f3745214430)      
    at /usr/local/src/php/Zend/zend_builtin_functions.c:1057
  42   Thread 0x7f378b5fe6c0 (LWP 128685) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  43   Thread 0x7f37895fa6c0 (LWP 128689) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  44   Thread 0x7f37827fc6c0 (LWP 128694) 0x00007f3805688df4 in zend_ast_is_list (ast=0x7f3747abffc8) at /usr/local/src/php/Zend/zend_ast.h:324     
  45   Thread 0x7f377bfff6c0 (LWP 128698) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  46   Thread 0x7f37bbb796c0 (LWP 128670) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  47   Thread 0x7f36d37fe6c0 (LWP 128721) runtime.futex () at /usr/local/go/src/runtime/sys_linux_amd64.s:558
  48   Thread 0x7f37777f66c0 (LWP 128707) 0x00007f380558903d in _mm_set_epi8 (__q00=-102 '\232', __q01=-102 '\232', __q02=-102 '\232',
    __q03=-102 '\232', __q04=-102 '\232', __q05=-102 '\232', __q06=-102 '\232', __q07=-102 '\232', __q08=-102 '\232', __q09=-102 '\232',
    __q10=-102 '\232', __q11=-102 '\232', __q12=-102 '\232', __q13=-102 '\232', __q14=-102 '\232', __q15=-102 '\232')
    at /usr/lib/gcc/x86_64-linux-gnu/12/include/emmintrin.h:621
  49   Thread 0x7f376d7fa6c0 (LWP 128718) zend_mm_alloc_heap (heap=0x7f3780200040, size=96,
    __zend_filename=0x7f3805fc35b0 "/usr/local/src/php/Zend/zend_string.h", __zend_lineno=174, __zend_orig_filename=0x0, __zend_orig_lineno=0)      
    at /usr/local/src/php/Zend/zend_alloc.c:1392
  50   Thread 0x7f3779ffb6c0 (LWP 128702) 0x00007f3805715798 in dce_optimize_op_array (op_array=0x7f3746a0df50, optimizer_ctx=0x7f3779ff8a80,       
    ssa=0x7f3746abd488, reorder_dtor_effects=false) at /usr/local/src/php/Zend/Optimizer/dce.c:595
  51   Thread 0x7f37817fa6c0 (LWP 128696) 0x00007f3805547880 in zend_mm_alloc_small (heap=0x7f3747600040, bin_num=9,
    __zend_filename=0x7f3805fce7d0 "/usr/local/src/php/Zend/zend_string.h", __zend_lineno=174, __zend_orig_filename=0x0, __zend_orig_lineno=0)      
    at /usr/local/src/php/Zend/zend_alloc.c:1310
  52   Thread 0x7f37787f86c0 (LWP 128705) futex_wait (private=0, expected=2, futex_word=0x7f37901c7700) at ../sysdeps/nptl/futex-internal.h:146     
  53   Thread 0x7f376e7fc6c0 (LWP 128716) 0x00007f3804ed390a in __GI___close (fd=46) at ../sysdeps/unix/sysv/linux/close.c:27

The crash was reproduced by compiling PHP with debug symbols in the frankenphp-bookworm-zts Docker image with a clean Laravel and Laravel Octane installation, the crash happens sporadically on startup of the application (probably some kind of race condition).

PHP Version

8.3.15

Operating System

Debian bookworm ZTS Docker

[nielsdos]

That shouldn't be a problem. Also the trace shows heap corruption.
Can you please give more steps on how to run the reproducer? I have no experience with FrankenPHP, note that it's also possible that the issue is in there...

[AlliBalliBaba]

I'll try to create a consistent reproducer

[AlliBalliBaba]

Here's a Dockerfile with Laravel/FrankenPHP that should reproduce the crash. Laravel uses a cli script with pcntl to control the frankenPHP process (might also be related).
All I know is if I replace opcache.enable=1 with opcache.enable=0, the crash won't happen. It's also possible though that disabling opcache will slow the process down enough to avoid the race condition.

Steps to reproduce:

• Put the following into a Dockerfile (I'll call it laravel.Dockerfile)
• Build the dockerfile docker build -t lara-fr-php -f laravel.Dockerfile .
• Run the dockerfile (exposing the port isn't strictly necessary for the crash) docker run -it -p 8888:80 lara-fr-php
• Start and stop the docker a few times to eventually get the crash (core dump)

FROM dunglas/frankenphp

# install git
RUN apt-get update && apt-get install -y --no-install-recommends git

# install composer and pcntl
RUN install-php-extensions @composer pcntl

# install empty laravel + octane application
WORKDIR /app
RUN rm -r ./* && \
    git clone https://github.com/laravel/laravel.git . && \
	composer install && \
    cp .env.example .env && \
    php artisan key:generate && \
    composer require laravel/octane && \
    php artisan octane:install --server=frankenphp

# enable opcache
RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini && \
    echo "zend_extension=opcache.so" >> $PHP_INI_DIR/php.ini && \
    echo "opcache.enable=1" >> $PHP_INI_DIR/php.ini

ENV APP_ENV=production \
    SESSION_DRIVER=array

# start the server
ENTRYPOINT ["php", "artisan", "octane:frankenphp", "--port=80", "--host=localhost", "--admin-port=2019"]

---

For PHP with debug symbols, you can also add this somewhere in the Dockerfile (haven't tried these exact instructions):

ENV PHPIZE_DEPS="\
	autoconf \
	dpkg-dev \
	file \
	g++ \
	gcc \
	libc-dev \
	make \
	pkg-config \
	re2c"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# hadolint ignore=DL3009
RUN apt-get update && \
	apt-get -y --no-install-recommends install \
	$PHPIZE_DEPS \
	libargon2-dev \
	bison \
	# Dev tools \
	git \
	clang \
	cmake \
	llvm \
	gdb \
	valgrind \
	zsh \
	libtool-bin && \
	echo 'set auto-load safe-path /' > /root/.gdbinit && \
	echo '* soft core unlimited' >> /etc/security/limits.conf \
	&& \
	apt-get clean 
WORKDIR /usr/local/src/php
RUN git clone --branch=PHP-8.3 https://github.com/php/php-src.git . && \
	# --enable-embed is only necessary to generate libphp.so, we don't use this SAPI directly
	./buildconf --force && \
	./configure \
		--enable-embed \
		--enable-zts \
		--disable-zend-signals \
		--enable-zend-max-execution-timers \
		--enable-debug && \
	make -j"$(nproc)" && \
	make install && \
	ldconfig && \
	cp php.ini-development /usr/local/lib/php.ini && \
	echo "zend_extension=opcache.so" >> /usr/local/lib/php.ini && \
	echo "opcache.enable=1" >> /usr/local/lib/php.ini && \
	php --version

[nielsdos]

Thanks a lot! I can reproduce the signal 139, I'll check what's going on and whether the bug is in PHP or somewhere else.

[nielsdos]

I can reliably get it to crash with the setting opcache.protect_memory=1. I.e. write failures into SHM. I wonder whether this happens because the memory mappings are per process and multiple threads may race to compile at the same time. This could cause the following:

T1                                           T2
...                                          ...
SHM_UNPROTECT
                                             SHM_PROTECT
WRITE <<< problem
                                             SHM_UNPROTECT

   INFO  ==182594==ERROR: AddressSanitizer: SEGV on unknown address 0x000041af8ff0 (pc 0x7ca3eb67154a bp 0x7ca3ea9fe010 sp 0x7ca3ea9fde70 T14).  

   INFO  ==182594==The signal is caused by a WRITE memory access.  
   INFO  AddressSanitizer:DEADLYSIGNAL.  
   INFO  AddressSanitizer:DEADLYSIGNAL.  
   INFO  #0 0x7ca3eb67154a in persistent_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:2175.  
   INFO  #1 0x7ca43eb65143 in compile_filename Zend/zend_language_scanner.l:704.  
   INFO  #2 0x7ca43ed3fe5b in zend_include_or_eval /usr/local/src/php/Zend/zend_execute.c:4946.  
   INFO  #3 0x7ca43ed70586 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:4985.  
   INFO  #4 0x7ca43eeb8c94 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57625.  
   INFO  #5 0x7ca43eec8f46 in zend_execute /usr/local/src/php/Zend/zend_vm_execute.h:61604.  
   INFO  #6 0x7ca43eca34de in zend_execute_scripts /usr/local/src/php/Zend/zend.c:1895.  
   INFO  #7 0x7ca43eac8538 in php_execute_script /usr/local/src/php/main/main.c:2528.  
   INFO  #8 0x18d0f00 (/usr/local/bin/frankenphp+0x18d0f00).  
   INFO  AddressSanitizer can not provide additional info.  
   INFO  SUMMARY: AddressSanitizer: SEGV /usr/local/src/php/ext/opcache/ZendAccelerator.c:2175 in persistent_compile_file.  
   INFO  Thread T14 (php-1) created by T12 (php-main) here:  
   INFO  #0 0x7ca440049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
   INFO  #1 0x18d029a (/usr/local/bin/frankenphp+0x18d029a).  
   INFO  Thread T12 (php-main) created by T0 here:  
   INFO  #0 0x7ca440049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
   INFO  #1 0x18d0d07 (/usr/local/bin/frankenphp+0x18d0d07).  
   INFO  ==182594==ABORTING.  

Anyway, that's likely not the root cause. I was able to get this UAF without opcache.protect_memory:

  INFO  ==182766==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100041f2c8 at pc 0x7eb0bbcd7638 bp 0x7eb0615fbd50 sp 0x7eb0615fbd48.  

   INFO  READ of size 8 at 0x61100041f2c8 thread T24 (php-b).  
   INFO  #0 0x7eb0bbcd7637 in zend_string_hash_val /usr/local/src/php/Zend/zend_string.h:139.  
   INFO  #1 0x7eb0bbcdec39 in _zend_hash_add_or_update_i /usr/local/src/php/Zend/zend_hash.c:821.  
   INFO  #2 0x7eb0bbcdfed5 in zend_hash_add /usr/local/src/php/Zend/zend_hash.c:989.  
   INFO  #3 0x7eb0bbbf37cc in zend_hash_add_ptr Zend/zend_hash.h:653.  
   INFO  #4 0x7eb0bbc37134 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8229.  
   INFO  #5 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
   INFO  #6 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
   INFO  #7 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #8 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
   INFO  #9 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
   INFO  #10 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #11 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
   INFO  #12 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
   INFO  #13 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #14 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
   INFO  #15 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #16 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #17 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
   INFO  #18 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
   INFO  #19 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #20 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #21 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
   INFO  #22 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
   INFO  #23 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #24 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #25 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
   INFO  #26 0x7eb0bbc4a496 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10414.  
   INFO  #27 0x7eb0bbc49f92 in zend_compile_top_stmt /usr/local/src/php/Zend/zend_compile.c:10352.  
   INFO  #28 0x7eb0bbc49bc3 in zend_compile_top_stmt /usr/local/src/php/Zend/zend_compile.c:10338.  
   INFO  #29 0x7eb0bbb642e1 in zend_compile Zend/zend_language_scanner.l:618.  
   INFO  #30 0x7eb0bbb64887 in compile_file Zend/zend_language_scanner.l:653.  
   INFO  #31 0x7eb0bb6910fd in phar_compile_file /usr/local/src/php/ext/phar/phar.c:3352.  
   INFO  #32 0x7eb06866cc44 in opcache_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:1817.  
   INFO  #33 0x7eb0686710fe in persistent_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:2147.  
   INFO  #34 0x7eb0bbb65143 in compile_filename Zend/zend_language_scanner.l:704.  
   INFO  #35 0x7eb0bbd3fe5b in zend_include_or_eval /usr/local/src/php/Zend/zend_execute.c:4946.  
   INFO  #36 0x7eb0bbe5a2f4 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:39836.  
   INFO  #37 0x7eb0bbec4ca4 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:60595.  
   INFO  #38 0x7eb0bbc5ecf8 in zend_call_function /usr/local/src/php/Zend/zend_execute_API.c:957.  
   INFO  #39 0x7eb0bbc60064 in zend_call_known_function /usr/local/src/php/Zend/zend_execute_API.c:1051.  
   INFO  #40 0x7eb0bb7c3ff4 in spl_perform_autoload /usr/local/src/php/ext/spl/php_spl.c:448.  
   INFO  #41 0x7eb0bbc61775 in zend_lookup_class_ex /usr/local/src/php/Zend/zend_execute_API.c:1221.  
   INFO  #42 0x7eb0bbc63678 in zend_fetch_class_by_name /usr/local/src/php/Zend/zend_execute_API.c:1740.  
   INFO  #43 0x7eb0bbd79254 in ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:6946.  
   INFO  #44 0x7eb0bbeb98e1 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57813.  
   INFO  #45 0x7eb0bbec8f46 in zend_execute /usr/local/src/php/Zend/zend_vm_execute.h:61604.  
   INFO  #46 0x7eb0bbca34de in zend_execute_scripts /usr/local/src/php/Zend/zend.c:1895.  
   INFO  #47 0x7eb0bbac8538 in php_execute_script /usr/local/src/php/main/main.c:2528.  
   INFO  #48 0x18d0f00 (/usr/local/bin/frankenphp+0x18d0f00).  
   INFO  #49 0x18cecc6 (/usr/local/bin/frankenphp+0x18cecc6).  
   INFO  #50 0x47d623 (/usr/local/bin/frankenphp+0x47d623).  
   INFO  0x61100041f2c8 is located 8 bytes inside of 208-byte region [0x61100041f2c0,0x61100041f390).  

   INFO  freed by thread T24 (php-b) here:  
   INFO  #0 0x7eb0bd0b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52.  
   INFO  #1 0x7eb0bbbee429 in _efree_custom /usr/local/src/php/Zend/zend_alloc.c:2500.  
   INFO  #2 0x7eb0bbbee779 in _efree /usr/local/src/php/Zend/zend_alloc.c:2620.  
   INFO  #3 0x7eb06865af7c in zend_string_release /usr/local/src/php/Zend/zend_string.h:346.  
   INFO  #4 0x7eb0686604f0 in accel_new_interned_string_for_php /usr/local/src/php/ext/opcache/ZendAccelerator.c:569.  
   INFO  #5 0x7eb0bbbf9142 in zval_make_interned_string /usr/local/src/php/Zend/zend_compile.c:535.  
   INFO  #6 0x7eb0bbbf9296 in zend_insert_literal /usr/local/src/php/Zend/zend_compile.c:547.  
   INFO  #7 0x7eb0bbbf9730 in zend_add_literal /usr/local/src/php/Zend/zend_compile.c:568.  
   INFO  #8 0x7eb0bbc36f62 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8223.  
   INFO  #9 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
   INFO  #10 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
   INFO  #11 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #12 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
   INFO  #13 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
   INFO  #14 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #15 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
   INFO  #16 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
   INFO  #17 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #18 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
   INFO  #19 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #20 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #21 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
   INFO  #22 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
   INFO  #23 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #24 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #25 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
   INFO  #26 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
   INFO  #27 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #28 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #29 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
   INFO  previously allocated by thread T24 (php-b) here:  
   INFO  #0 0x7eb0bd0b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69.  
   INFO  #1 0x7eb0bbbf1372 in __zend_malloc /usr/local/src/php/Zend/zend_alloc.c:3128.  
   INFO  #2 0x7eb0bbbee2ac in _malloc_custom /usr/local/src/php/Zend/zend_alloc.c:2491.  
   INFO  #3 0x7eb0bbbee66c in _emalloc /usr/local/src/php/Zend/zend_alloc.c:2610.  
   INFO  #4 0x7eb0bbc72ea0 in zend_string_alloc /usr/local/src/php/Zend/zend_string.h:174.  
   INFO  #5 0x7eb0bbc8dbeb in zend_string_tolower_ex /usr/local/src/php/Zend/zend_operators.c:3058.  
   INFO  #6 0x7eb0bbbf498b in zend_string_tolower Zend/zend_operators.h:470.  
   INFO  #7 0x7eb0bbc35dfc in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8109.  
   INFO  #8 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
   INFO  #9 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
   INFO  #10 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #11 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
   INFO  #12 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
   INFO  #13 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #14 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
   INFO  #15 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
   INFO  #16 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
   INFO  #17 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
   INFO  #18 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #19 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #20 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
   INFO  #21 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
   INFO  #22 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #23 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #24 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
   INFO  #25 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
   INFO  #26 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
   INFO  #27 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
   INFO  #28 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
   INFO  #29 0x7eb0bbc4a496 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10414.  
   INFO  Thread T24 (php-b) created by T11 (php-main) here:  
   INFO  #0 0x7eb0bd049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
   INFO  #1 0x18d029a (/usr/local/bin/frankenphp+0x18d029a).  
   INFO  Thread T11 (php-main) created by T0 here:  
   INFO  #0 0x7eb0bd049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
   INFO  #1 0x18d0d07 (/usr/local/bin/frankenphp+0x18d0d07).  
   INFO  SUMMARY: AddressSanitizer: heap-use-after-free /usr/local/src/php/Zend/zend_string.h:139 in zend_string_hash_val.  
   INFO  Shadow bytes around the buggy address:  
   INFO  0x0c228007be00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd.  
   INFO  0x0c228007be10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd.  
   INFO  0x0c228007be20: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa.  
   INFO  0x0c228007be30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00.  
   INFO  0x0c228007be40: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa.  
   INFO  =>0x0c228007be50: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd.  
   INFO  0x0c228007be60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd.  
   INFO  0x0c228007be70: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa.  
   INFO  0x0c228007be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00.  
   INFO  0x0c228007be90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa.  
   INFO  0x0c228007bea0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd.  
   INFO  Shadow byte legend (one shadow byte represents 8 application bytes):  
   INFO  Addressable: 00.  
   INFO  Partially addressable: 01 02 03 04 05 06 07 .  
   INFO  Heap left redzone: fa.  
   INFO  Freed heap region: fd.  
   INFO  Stack left redzone: f1.  
   INFO  Stack mid redzone: f2.  
   INFO  Stack right redzone: f3.  
   INFO  Stack after return: f5.  
   INFO  Stack use after scope: f8.  
   INFO  Global redzone: f9.  
   INFO  Global init order: f6.  
   INFO  Poisoned by user: f7.  
   INFO  Container overflow: fc.  
   INFO  Array cookie: ac.  
   INFO  Intra object redzone: bb.  
   INFO  ASan internal: fe.  
   INFO  Left alloca redzone: ca.  
   INFO  Right alloca redzone: cb.  
   INFO  ==182766==ABORTING.  

[nielsdos]

It took a stupidly long time to debug and figure out, but I think I got it now.
@AlliBalliBaba can you please test the following patch in your environment? https://gist.github.com/nielsdos/9608932fe79ae76024135224498dccec It seems to work for me at least
Dockerfile I used based on yours: https://gist.github.com/nielsdos/9acc7400f67ffd71a8e1f143021f259a but I changed the entrypoint to bash so I could enter the container and edit files. This Dockerfile also downloads the patch I linked and does a debug build of PHP.

The explanation is as follows:

1. We allocate a lower cased name for an anonymous class here:

   php-src/Zend/zend_compile.c

   Line 8109 in f97353f

   lcname = zend_string_tolower(name);

2. This gets looked up as an interned string here:

   php-src/Zend/zend_compile.c

   Line 8112 in f97353f

   lcname = zend_new_interned_string(lcname);

   
   Assuming that there are uppercase symbols in the string and therefore lcname != name and that lcname is not yet in the interned string table, the pointer value of lcname won't change.
3. Here we add the string into the interned string table

   php-src/Zend/zend_compile.c

   Line 8223 in f97353f

   LITERAL_STR(opline->op1, lcname);

   However, in the meantime another thread could've added the string into the interned string table. This means that the following code will run, indirectly called via the LITERAL_STR macro, freeing lcname:

   php-src/ext/opcache/ZendAccelerator.c

   Lines 572 to 575 in 62e53e6

   	if (ret) {
   	zend_string_release(str);
   	return ret;
   	}

4. In the reproducer we then access the freed lcname string here:

   php-src/Zend/zend_compile.c

   Line 8229 in f97353f

   if (!zend_hash_add_ptr(CG(class_table), lcname, ce)) {

This is solved in my patch by retrieving the interned string pointer and putting it in lcname.