[php-src] Issue #20664: segv in ir_gcm.c:67:29

Issue: https://github.com/php/php-src/issues/20664 Author: chongwick ### Description The following code: ```php <?php $v_14747 = '*** Testing dechex() : usage variations ***\n'; $v_14749 = 0; $v_14750 = 1; $v_14751 = 12345; $v_8882 = $v_8882; $v_14759 = TRUE; $v_14765 = 1; $v_14766 = $v_14759 * $v_14765; $v_14755 = 1.8446744073709552e+19; $v_14756 = 123456789000; $v_14757 = True; $v_14758 = False; $v_14754 = 1.8446744073709552e+19; $v_14772 = var_dump($v_14754,); $v_14760 = FALSE; $v_14761 = ''; $v_14762 = ''; $v_14748 = array(0 => $v_14749,1 => $v_14750,2 => $v_14751,3 => $v_8882,4 => $v_14766,5 => $v_14755,6 => $v_14756,7 => $v_14757,8 => $v_14758,9 => $v_14772,10 => $v_14760,11 => $v_14761,12 => $v_14762,); foreach ($v_14748 as $input){ $v_14764 = $input; $v_14767 = "\n-- Iteration $v_14766 --\n"; try{ $v_14771 = dechex($v_14765,); } catch (TypeError $exception){ $v_14768 = $exception->getMessage(); $v_14769 = '\n'; $v_14770 = $v_14768 and $v_14769; } $v_12081 = SampleFilter::class; $v_12082 = class_exists($v_12081,); $v_12083 = !($v_12082); if($v_12083){ $v_12084 = 'sample.filter'; $v_12085 = SampleFilter::class; $v_12086 = stream_filter_register($v_12084,$v_12085,); $v_12087 = 'php://filter/read=sample.filter/resource='; $v_12088 = __FILE__; $v_12089 = $v_12087 . $v_12088; } } $v_14763 = $input; ``` Resulted in this output: ``` float(1.8446744073709552E+19) AddressSanitizer:DEADLYSIGNAL ================================================================= ==1828730==ERROR: AddressSanitizer: SEGV on unknown address 0x6206bec69338 (pc 0x0000028a4ae1 bp 0x7ffcead70970 sp 0x7ffcead70750 T0) ==1828730==The signal is caused by a READ memory access. #0 0x28a4ae1 in ir_gcm_find_lca /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29 #1 0x2878e33 in ir_gcm_schedule_late /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:525:23 #2 0x2873a08 in ir_gcm /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:715:4 #3 0x316c79d in zend_jit_ir_compile /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:2893:2 #4 0x3007f24 in zend_jit_finish /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:16744:10 #5 0x2e40d27 in zend_jit_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7317:12 #6 0x2c018a9 in zend_jit_compile_root_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7532:14 #7 0x2bf3b70 in zend_jit_trace_hot_root /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:8226:10 #8 0x2bb9833 in zend_jit_trace_counter_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:472:7 #9 0x2bb90ca in zend_jit_func_trace_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:508:2 #10 0x5c304db in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:116212:12 #11 0x5c32a6c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:121924:2 #12 0x69c39c9 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1975:3 #13 0x51907aa in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2645:13 #14 0x51918e8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2685:9 #15 0x69d88da in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:951:5 #16 0x69d2cbf in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1362:18 #17 0x153a22d95d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #18 0x153a22d95e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #19 0x607b04 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x607b04) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29 in ir_gcm_find_lca ==1828730==ABORTING ``` ``` USE_ZEND_ALLOC=0 php -d "memory_limit = -1" -d "zend.assertions = 1" -d "display_errors = On" -d "display_startup_errors = On" -d "opcache.memory_consumption=4096M" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.validate_timestamps=0" -d "opcache.jit_buffer_size=128M" -d "opcache.file_update_protection=0" -d "opcache.max_accelerated_files=1000000" -d "opcache.interned_strings_buffer=64" -d "opcache.jit_prof_threshold=0.000000001" -d "opcache.jit_max_root_traces= 100000" -d "opcache.jit_max_side_traces= 100000" -d "opcache.jit_max_exit_counters=100000" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.jit_blacklist_root_trace=255" -d "opcache.jit_blacklist_side_trace=255" -d "opcache.protect_memory=1" script.php ``` ### PHP Version ```plain nightly ``` ### Operating System ubuntu 22.04