[php-src] Issue #8030: Segfault with JIT and large match/switch statements

From: Date: Thu, 03 Feb 2022 17:35:24 +0000
Subject: [php-src] Issue #8030: Segfault with JIT and large match/switch statements
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-239459@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/8030 Author: therealgaxbo ### Description Running this code with the JIT enabled results in a segfault (sometimes I have to run it 2-3 times before it happens): https://gist.github.com/therealgaxbo/5e7b111c994bf932e3e7870ac258babe ``` $ php -v PHP 8.0.15 (cli) (built: Jan 18 2022 12:16:19) ( NTS gcc x86_64 ) Copyright (c) The PHP Group Zend Engine v4.0.15, Copyright (c) Zend Technologies with Zend OPcache v8.0.15, Copyright (c), by Zend Technologies $ php -n -dzend_extension=/usr/lib64/php/modules/opcache.so -dopcache.enable_cli=1 -dopcache.jit_buffer_size=64M match.php Segmentation fault (core dumped) ``` The same result happens with 8.1.2. This is as minimal as I've managed to make the repro. It seems extremely sensitive to the precise order that the two different match arms are accessed. A similar segfault happens with an equivalent switch statement, although the exact number of arms may need increasing. ### PHP Version PHP 8.0.15, PHP 8.1.2 ### Operating System Fedora 35

« previous php.bugs (#239459) next »