[php-src] Issue #24390: JIT: SIGFPE on `$x % -1` with a constant -1 divisor when $x is PHP_INT_MIN (opcache.jit=function)
| From: | waroad | Date: | Sat, 17 Oct 2026 22:07:30 +0000 |
| Subject: | [php-src] Issue #24390: JIT: SIGFPE on `$x % -1` with a constant -1 divisor when $x is PHP_INT_MIN (opcache.jit=function) | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253015@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24390
Author: waroad
With the JIT enabled,
PHP_INT_MIN % -1 (literal -1 divisor) kills the
process with SIGFPE instead of returning 0.
```php
<?php
function f($x) { return $x % -1; }
var_dump(f(PHP_INT_MIN));
```
```
php -n -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d
opcache.jit=function input.php
```
On a release build the process exits with signal 8 (exit status 136) and prints nothing. On an ASan
build:
```
AddressSanitizer:DEADLYSIGNAL
==2435==ERROR: AddressSanitizer: FPE on unknown address 0x000049aecd40 (pc 0x000049aecd40 bp
0x7ffc40bb7b80 sp 0x7ffc40bb78f0 T0)
#0 0x49aecd40 (/dev/zero (deleted)+0x8000d40)
SUMMARY: AddressSanitizer: FPE (/dev/zero (deleted)+0x8000d40)
```
Expected int(0): that is what the interpreter prints, and mod_function in
Zend/zend_operators.c special-cases a divisor of -1.
Reproduces on master at 5ccc56b1e43f with both an ASan build and a release build.
Looks like the constant-divisor branch for ZEND_MOD in
zend_jit_long_math_helper (ext/opcache/jit/zend_jit_ir.c) emits a plain
idiv by -1, which traps when the dividend is ZEND_LONG_MIN; the
non-constant branch has a guard for this case.
The trigger came from a generated test, not from a real program. I can send a patch if that helps.
Found with an LLM-based testing tool; I used Claude to reduce it and look for the cause.