[php-src] Issue #24390: JIT: SIGFPE on `$x % -1` with a constant -1 divisor when $x is PHP_INT_MIN (opcache.jit=function)

From: Date: Sat, 17 Oct 2026 22:07:30 +0000
Subject: [php-src] Issue #24390: JIT: SIGFPE on `$x % -1` with a constant -1 divisor when $x is PHP_INT_MIN (opcache.jit=function)
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-253015@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/24390 Author: waroad With the JIT enabled, PHP_INT_MIN % -1 (literal -1 divisor) kills the process with SIGFPE instead of returning 0. ```php <?php function f($x) { return $x % -1; } var_dump(f(PHP_INT_MIN)); ``` ``` php -n -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d opcache.jit=function input.php ``` On a release build the process exits with signal 8 (exit status 136) and prints nothing. On an ASan build: ``` AddressSanitizer:DEADLYSIGNAL ==2435==ERROR: AddressSanitizer: FPE on unknown address 0x000049aecd40 (pc 0x000049aecd40 bp 0x7ffc40bb7b80 sp 0x7ffc40bb78f0 T0) #0 0x49aecd40 (/dev/zero (deleted)+0x8000d40) SUMMARY: AddressSanitizer: FPE (/dev/zero (deleted)+0x8000d40) ``` Expected int(0): that is what the interpreter prints, and mod_function in Zend/zend_operators.c special-cases a divisor of -1. Reproduces on master at 5ccc56b1e43f with both an ASan build and a release build. Looks like the constant-divisor branch for ZEND_MOD in zend_jit_long_math_helper (ext/opcache/jit/zend_jit_ir.c) emits a plain idiv by -1, which traps when the dividend is ZEND_LONG_MIN; the non-constant branch has a guard for this case. The trigger came from a generated test, not from a real program. I can send a patch if that helps. Found with an LLM-based testing tool; I used Claude to reduce it and look for the cause.

« previous php.bugs (#253015) next »