[php-src] Issue #12427: ASAN heap-buffer-overflow with tracing JIT

Issue: https://github.com/php/php-src/issues/12427 Author: danog ### Description Running the phpunit testsuite of psalm commit 7428e49b115a2a837aa29cf0fafd0ca902fe2457 yields a heap-buffer-overflow ASAN assertion with this PHP config (ASAN debug build, USE_ZEND_ALLOC=0): ``` memory_limit = -1 zend.assertions = 1 display_errors = On display_startup_errors = On extension=uv extension=gmp extension=iconv [opcache] zend_extension=opcache opcache.memory_consumption=4096M opcache.enable=1 opcache.enable_cli=1 opcache.jit=tracing opcache.validate_timestamps=0 opcache.jit_buffer_size=1G opcache.file_update_protection=0 opcache.max_accelerated_files=1000000 opcache.interned_strings_buffer=64 ;opcache.jit_debug=28672 ;opcache.jit_debug=16384 opcache.jit_prof_threshold=0.000000001 opcache.jit_max_root_traces= 30000000 opcache.jit_max_side_traces= 30000000 opcache.jit_max_exit_counters=30000000 opcache.jit_hot_loop=1 opcache.jit_hot_func=1 opcache.jit_hot_return=1 opcache.jit_hot_side_exit=1 opcache.jit_blacklist_root_trace=255 opcache.jit_blacklist_side_trace=255 opcache.protect_memory=1 ``` Command: ``` php patch.php vendor/bin/phpunit --debug ``` Result: https://paste.daniil.it/tracing_detailed patch.php from https://github.com/php/php-src/pull/12425/files: ```php <?php register_shutdown_function(function () { $status = opcache_get_status(false); var_dump($status); $ok = true; if ($status["memory_usage"]["free_memory"] < 10*1024*1024) { echo "Not enough free opcache memory!".PHP_EOL; $ok = false; } if ($status["interned_strings_usage"]["free_memory"] < 1*1024*1024) { echo "Not enough free interned strings memory!".PHP_EOL; $ok = false; } if ($status["jit"]["buffer_free"] < 10*1024*1024) { echo "Not enough free JIT memory!".PHP_EOL; $ok = false; } if (!$status["jit"]["on"]) { echo "JIT is not enabled!".PHP_EOL; $ok = false; } unset($status); gc_collect_cycles(); if (!$ok) die(130); }); $argc--; array_shift($argv); $_SERVER['argc']--; array_shift($_SERVER['argv']); require $argv[0]; ``` ### PHP Version 3a41dc8b2e24b4ccff8148ef768a3025bb818215 ### Operating System _No response_