[php-src] Issue #11659: Segfault in memory allocator during compilation during autoloading

Issue: https://github.com/php/php-src/issues/11659 Author: danog ### Description PHP config: https://paste.daniil.it/config This is happening in a pcntl_forked process (as for the other segfaults I submitted recently). I can DM a full coredump if needed. ref: compressed_coredump-php.78197.1688713825 backtrace: ``` (gdb) backtrace #0 zend_mm_alloc_small (bin_num=11, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1313 #1 zend_mm_alloc_heap (size=<optimized out>, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1384 #2 _zend_mm_alloc (heap=0x7f2ccac00040, size=<optimized out>) at ./Zend/zend_alloc.c:2382 #3 0x000055731201f5c3 in lookup_cv (name=name@entry=0x5573143c8020) at ./Zend/zend_compile.c:503 #4 0x0000557312029e53 in zend_compile_params (fallback_return_type=<optimized out>, return_type_ast=<optimized out>, ast=<optimized out>) at ./Zend/zend_compile.c:6776 #5 zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7403 #6 0x000055731202b495 in zend_compile_expr_inner (ast=0x7f2cbdc2be20, result=0x7ffcb463a380) at ./Zend/zend_compile.c:10333 #7 zend_compile_expr (result=0x7ffcb463a380, ast=0x7f2cbdc2be20) at ./Zend/zend_compile.c:10350 #8 0x00005573120312ec in zend_compile_args (may_have_extra_named_args=<optimized out>, fbc=0x0, ast=<optimized out>) at ./Zend/zend_compile.c:3612 #9 zend_compile_call_common (result=0x7ffcb463a6a0, args_ast=0x7f2cbdc2be70, fbc=0x0, lineno=807) at ./Zend/zend_compile.c:3715 #10 0x000055731202ee44 in zend_compile_ns_call (name_node=0x7ffcb463a440, lineno=807, args_ast=0x7f2cbdc2be70, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:3758 #11 zend_compile_call (type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:4461 #12 zend_compile_var_inner (by_ref=<optimized out>, type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10369 #13 zend_compile_var (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160, type=<optimized out>, by_ref=<optimized out>) at ./Zend/zend_compile.c:10395 #14 0x000055731202c29d in zend_compile_expr_inner (ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10230 #15 zend_compile_expr (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160) at ./Zend/zend_compile.c:10350 #16 0x000055731202d314 in zend_compile_assign (ast=0x7f2cbdc2c178, ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:3220 #17 zend_compile_expr_inner (ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:10233 #18 zend_compile_expr (result=0x7ffcb463a7d0, ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10350 #19 0x0000557312026cc0 in zend_compile_stmt (ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10192 #20 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176 #21 zend_compile_stmt (ast=0x7f2cbdc2bc88) at ./Zend/zend_compile.c:10100 #22 0x0000557312029951 in zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7428 #23 0x0000557312027aec in zend_compile_stmt (ast=0x7f2cbdc2c9c8) at ./Zend/zend_compile.c:10153 #24 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176 #25 zend_compile_stmt (ast=0x7f2cbdc4e590) at ./Zend/zend_compile.c:10100 #26 0x000055731202acd0 in zend_compile_class_decl (result=0x0, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7909 #27 0x000055731202666c in zend_compile_top_stmt (ast=0x7f2cbdc4fb80) at ./Zend/zend_compile.c:10075 #28 0x0000557312026698 in zend_compile_top_stmt (ast=<optimized out>) at ./Zend/zend_compile.c:10064 #29 zend_compile_top_stmt (ast=0x7f2cbdbcac78) at ./Zend/zend_compile.c:10054 #30 0x000055731200813e in zend_compile (type=type@entry=2) at ./Zend/zend_language_scanner.c:620 #31 0x000055731200993a in compile_file (file_handle=0x7ffcb463b500, type=2) at ./Zend/zend_language_scanner.c:655 #32 0x00007f2cc90f26b6 in phar_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/phar/phar.c:3355 #33 0x00007f2cca838df2 in opcache_compile_file (file_handle=0x7ffcb463b500, type=2, op_array_p=0x7ffcb463b400) at ./ext/opcache/ZendAccelerator.c:1820 #34 0x00007f2cca83b941 in persistent_compile_file (type=2, file_handle=0x7ffcb463b500) at ./ext/opcache/ZendAccelerator.c:2164 #35 persistent_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/opcache/ZendAccelerator.c:1978 #36 0x000055731200999d in compile_filename (type=type@entry=2, filename=filename@entry=0x557314329a78) at ./Zend/zend_language_scanner.c:706 #37 0x000055731207a6f6 in zend_include_or_eval (inc_filename_zv=<optimized out>, type=2) at ./Zend/zend_execute.c:4799 #38 0x0000557312089f8e in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at ./Zend/zend_vm_execute.h:38948 #39 0x00005573120b090d in execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:59395 #40 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=<optimized out>) at ./Zend/zend_execute_API.c:947 #41 zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at ./Zend/zend_execute_API.c:749 --Type <RET> for more, q to quit, c to continue without paging-- #42 0x000055731203811d in zend_call_known_function (fn=0x55731840d038, object=<optimized out>, called_scope=<optimized out>, retval_ptr=retval_ptr@entry=0x0, param_count=param_count@entry=1, params=params@entry=0x7ffcb463b890, named_params=0x0) at ./Zend/zend_execute_API.c:1041 #43 0x0000557311f31257 in spl_perform_autoload (class_name=0x7f2cbe110d90, lc_name=0x7f2cbe110d58) at ./ext/spl/php_spl.c:445 #44 0x0000557312036f08 in zend_lookup_class_ex (name=<optimized out>, key=key@entry=0x0, flags=flags@entry=0) at ./Zend/zend_execute_API.c:1207 #45 0x000055731203710d in zend_lookup_class (name=<optimized out>) at ./Zend/zend_execute_API.c:1228 #46 0x0000557312062395 in class_exists_impl (return_value=0x7f2ccac15a30, skip_flags=3, flags=8, execute_data=0x7f2ccac15a40) at ./Zend/zend_builtin_functions.c:992 #47 zif_class_exists (execute_data=0x7f2ccac15a40, return_value=0x7f2ccac15a30) at ./Zend/zend_builtin_functions.c:1006 #48 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637 #49 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056 #50 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=0x7ffcb463ba50) at ./Zend/zend_execute_API.c:947 #51 zend_call_function (fci=fci@entry=0x7ffcb463bb60, fci_cache=fci_cache@entry=0x7ffcb463bb40) at ./Zend/zend_execute_API.c:749 #52 0x0000557311f6d109 in zif_array_map (execute_data=<optimized out>, return_value=0x7f2ccac156c0) at ./ext/standard/array.c:6193 #53 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637 #54 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056 #55 0x00005573120b9701 in zend_execute (op_array=0x7f2ccac7e000, return_value=0x0) at ./Zend/zend_vm_execute.h:60396 #56 0x0000557312046e55 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1827 #57 0x0000557311fe23fa in php_execute_script (primary_file=<optimized out>) at ./main/main.c:2542 #58 0x000055731213050a in do_cli (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:964 #59 0x0000557311e72c5b in main (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:1333 ``` zbacktrace: ``` (gdb) zbacktrace [0x7f2ccac15b30] Composer\Autoload\{closure}("/zoon/zoon/vendor/composer/../../Module/Seo/Orm/MetaObject.php") /zoon/zoon/vendor/composer/ClassLoader.php:576 [0x7f2ccac15aa0] Composer\Autoload\ClassLoader->loadClass("Z\Module\Seo\Orm\MetaObject") /zoon/zoon/vendor/composer/ClassLoader.php:427 [0x7f2ccac15a40] class_exists("Z\Module\Seo\Orm\MetaObject") [internal function] [0x7f2ccac159d0] Zoon\ORM\Mongo\MongoMapper->prepareObjectClassName() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:156 [0x7f2ccac15940] Zoon\ORM\Mongo\MongoMapper->__construct() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:173 [0x7f2ccac158b0] Zoon\ORM\Mongo\MongoMapper->get() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:127 // more stuff ``` ### PHP Version PHP 8.2.7 ### Operating System Ubuntu 20.04, ondrej repos