[php-src] Issue #24337: JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property
| From: | waroad | Date: | Thu, 15 Oct 2026 01:58:45 +0000 |
| Subject: | [php-src] Issue #24337: JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-252999@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24337
Author: waroad
> With the tracing JIT,
$this->pu-- on a property holding a
> non-numeric string crashes the process (SIGSEGV in a release build) instead of raising the
> "Decrement on non-numeric string" deprecation.
```php
<?php
class Q {
public $pu = 0;
function run() { for ($i = 0; $i < 10; $i++) { $this->pu--; } }
}
class S extends Q {
public $pu = 'u';
function run() { parent::run(); }
}
$objs = [new Q, new S];
for ($k = 0; $k < 4; $k++) {
foreach ($objs as $o) { $o->run(); }
}
echo "done\n";
```
```
php -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d
opcache.jit=tracing -d opcache.jit_hot_loop=2 -d opcache.jit_hot_func=2 -d opcache.jit_hot_return=2
-d opcache.jit_hot_side_exit=1 -d display_errors=0 reduced.php
```
> On a UBSan build:
```
Zend/zend_execute_API.c:716:20: runtime error: member access within misaligned address
0x00000000000a for type 'const struct zend_op', which requires 8 byte alignment
#0 in zend_get_executed_lineno Zend/zend_execute_API.c:716
#1 in get_filename_lineno Zend/zend.c:1670
#2 in zend_error Zend/zend.c:1711
#3 in decrement_function Zend/zend_operators.c:2907
#4 0x48783f94 (/dev/zero (deleted)+0x8000f94)
```
> A release build exits with signal 11 (rc 139) and prints nothing.
> I expected it to print done, as it does with
> opcache.jit=0 or opcache off, where the deprecation is emitted for
> the string property and the value is left unchanged.
> Found at commit c65321c70f7de5f4a4f810f1d23112374d92d1a7; it still reproduces at eec8328398ca
> (latest upstream, same UBSan report).
> Looks like zend_jit_incdec_obj in ext/opcache/jit/zend_jit_ir.c
> calls decrement_function for a non-int property without storing
> EX(opline) first, so zend_error
> reads a stale opline in zend_get_executed_lineno.
Found with an LLM-based testing tool. As CONTRIBUTING.md asks, the paragraphs in > quotes were
written with Claude; I ran every command myself.