Segmentation fault in the Zend engine (JIT enabled)

[YuanchengJiang]

Description

The following code:

<?php

class C {}

trait T {
    public function equal(C $type): bool {
        return $type instanceof self && $this->value === $type->value;
    }
}

class C1 extends C {
    use T;
    public function __construct(private int $value) {}
}

class C2 extends C {
    use T;
}

$x = new C1(1);
var_dump($x->equal($x));
var_dump($x->equal($x));
$a = new C2("aaa");
var_dump($a->equal($a));
var_dump($a->equal($a));

Resulted in this output:

=================================================================
==1881556==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7fcf2b9bdbdc bp 0x7ffc63df4fd0 sp 0x7ffc63df4f30 T0)
==1881556==The signal is caused by a READ memory access.
==1881556==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x7fcf2b9bdbdc  (/dev/zero (deleted)+0x8000bdc)
    #1 0x5622d9599022 in zend_execute /php-src/Zend/zend_vm_execute.h:63873:2
    #2 0x5622da094e08 in zend_execute_script /php-src/Zend/zend.c:1913:3
    #3 0x5622d8c684c6 in php_execute_script_ex /php-src/main/main.c:2576:13
    #4 0x5622d8c68d68 in php_execute_script /php-src/main/main.c:2616:9
    #5 0x5622da0a2c53 in do_cli /php-src/sapi/cli/php_cli.c:935:5
    #6 0x5622da09e672 in main /php-src/sapi/cli/php_cli.c:1309:18
    #7 0x7fcf7220ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x8000bdc) 
==1881556==ABORTING

To reproduce:

opcache.enable_cli=1
opcache.jit_buffer_size=64M
opcache.jit=tracing
opcache.jit_hot_func=2

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[iluuu1994]

Interestingly, it's the opcache.jit_hot_func=2 that triggers this issue. It doesn't trigger with 1 or the default (127). /cc @dstogov