[php-src] Issue #11409: Infinite recursion causes heap corruption with JIT enabled

From: Date: Fri, 09 Jun 2023 08:07:47 +0000
Subject: [php-src] Issue #11409: Infinite recursion causes heap corruption with JIT enabled
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-244635@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/11409 Author: edsrzf ### Description The following code: ```php <?php class Base { protected $parts = ['a' => [], 'b' => []]; public function __construct() {} public function build() { $this->parts['a'] = ['other']; foreach ($this->parts as $parts) { if (!empty($parts)) { foreach ($parts as $part) { new stdClass(); } } } } } class Child extends Base { public function __construct() { parent::__construct(null); } } class Service { public function run() { (new Child())->build(); $this->run(); } } (new Service())->run(); ``` Resulted in this output: ``` [1] 64927 segmentation fault php -d xdebug.mode=off -d opcache.enable_cli=1 -d opcache.jit_buffer_size=128 ``` (Happens most of the time, but not 100% of the time, so try again if it doesn't happen the first time.) While reducing the input, I also sometimes encountered SIGBUS or the message zend_mm_heap corrupted with certain variations. But I expected this output instead: ``` Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 262144 bytes) in file.php on line 28 ``` The above is the output I get if I disable JIT. ### Other Details The above output was when running on MacOS with arm64, but I originally encountered this on Linux/amd64. I've also reproduced the issue with PHP 8.2.1, but haven't tried earlier than that. ### PHP Version PHP 8.2.6 ### Operating System MacOS 13

« previous php.bugs (#244635) next »