Segmentation fault with opcache.jit=tracing enabled on aarch64

[vkurdin]

Description

I've created a repository with code to reproduce the issue. The code might seem odd because I was trying to minimize the scope of the problem. If I put the code to one php file, segfault goes away. I need to copy reproducing script to a new file via shell script helper, otherwise segfault goes away again.

repo: https://github.com/vkurdin/php-segfault-reproducer

$ docker run --rm -it -v `pwd`:/app -w /app php:8.4.0RC4-cli ./run.sh
Segmentation fault

The segfault was originally discovered while benchmarking the code using the phpbench/phpbench framework. The framework generates files in /tmp for each iteration, with multiple revolutions for the benchmarked subject inside.

macOS 15.1 on Macbook Pro M1 16GB:
Darwin mymbp.local 24.1.0 Darwin Kernel Version 24.1.0: Thu Oct 10 21:05:14 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T8103 arm64

OrbStack (alternative for Docker Desktop): Version 1.8.1 (18374)
Linux 21099c09508c 6.11.6-orbstack-00279-g28c6c77332e6 #57 SMP Mon Nov 4 08:11:30 UTC 2024 aarch64 Linux

php:8.4.0RC4 container: https://hub.docker.com/layers/library/php/8.4.0RC4-cli/images/sha256-d29b8d066ea65c94c23784e29920704d29aeb7c01abb23341e48299f5380b88f?context=explore
PHP 8.4.0RC4 (cli) (built: Nov 12 2024 03:30:31) (NTS) Copyright (c) The PHP Group Built by https://github.com/docker-library/php Zend Engine v4.4.0RC4, Copyright (c) Zend Technologies

PHP Version

PHP 8.4.0RC4

Operating System

No response

[MrSuddenJoy]

@vkurdin OK, the moment I saw that you run php 8.4 I knew strange things are unavoidable.

Just unZend php. Thats it.

[iluuu1994]

Thanks for the reproducer! /cc @dstogov

[MrSuddenJoy]

@iluuu1994 why was my comment market as OT? Who done it? And what this has to do with Dmitryj?

[iluuu1994]

I have no idea what your comment is implying. Dmitry is the author of the JIT, and this is a JIT issue.

[dstogov]

Thanks for the report. This is not aarach64 specific bug. I'm able to reproduce it on x86_54 as well. It's probably triggered by "touching" the runner.php. I hope I'll fix this soon.