Skip to content

JIT packed type guard crash #17577

Description

@YuanchengJiang

Description

The following code:

<?php
$a = array(
array(1,2,3),
-PHP_INT_MAX-1,
);
$var_cnt = count($a);
function my_dump($var) {
}
foreach($a as $a) {
for ($i = 0; $i < $var_cnt; $i++) {
my_dump($a[$i]);
}
}

Resulted in this output:

=================================================================
==2945471==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000496f3928 bp 0x7ffe12994080 sp 0x7ffe12993f30 T0)
==2945471==The signal is caused by a READ memory access.
==2945471==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x496f3928  (/dev/zero (deleted)+0x8000928)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x8000928) 
==2945471==ABORTING

To reproduce:

-d "opcache.jit_hot_func=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions