Segfault with getter property and JIT

[vincent4vx]

Description

The following code:

<?php
final class A
{
    public int $bounds {
        get => $this->tag;
    }

    public function __construct(
        public readonly int $tag,
    ) {}
}

function process(): void
{
    for ($i = 0; $i < 100; ++$i) {
        (new A(42))->bounds;
    }
}

for ($i = 0; $i < 10; ++$i) {
    process();
}

Resulted in this output:

segmentation fault

The code should be run with jit configured as opcache.jit=1201 (other jit configuration will also cause segfault but with more complexe code).

The zbacktrace on gdb is :

[0x7ffff7617110] A->$bounds::get() /home/vincent/Documents/dev/php/test-sefault/sprite.php:0 
[0x7ffff7617090] process() /home/vincent/Documents/dev/php/test-sefault/sprite.php:17 
[0x7ffff7617020] (main) /home/vincent/Documents/dev/php/test-sefault/sprite.php:22 

Backtrace is :

(gdb) bt
#0  0x0000000000b40ab7 in zend_lookup_class_ex (name=0x0, key=0x7fff00000010, flags=512) at /opt/php/php-src/Zend/zend_execute_API.c:1169
#1  0x0000000000b41ae1 in zend_fetch_class_by_name (class_name=0x0, key=0x7fff00000010, fetch_type=512)
    at /opt/php/php-src/Zend/zend_execute_API.c:1783
#2  0x0000000000b6b828 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /opt/php/php-src/Zend/zend_vm_execute.h:10914
#3  0x0000000012400955 in ?? ()
#4  0x0000000000000000 in ?? ()

During my attempts to simplify the reproduction :

• zbacktrace is always the same, but not backtrace which change with the code
• A "Warning: access to tag from null" has been displayed, seems that $this was null a the moment

PHP Version

8.4.3

Operating System

Tumbleweed

[nielsdos]

This is a duplicate of #15834
As a workaround you can use function or tracing JIT for the time being.