Segmentation fault Zend/zend_types.h:1382

[YuanchengJiang]

Description

The following code:

<?php
namespace foo\x;
const x = 2;
class x {
const x = 1;
}
var_dump(namespace\x,x::x,namespace\x::x);
max($fusion,$fusion);

Resulted in this output (JIT 1001):

/php-src/Zend/zend_types.h:1382:9: runtime error: member access within null pointer of type 'zend_refcounted' (aka 'struct _zend_refcounted')

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Another duplicate of #15981

[iluuu1994]

@YuanchengJiang Maybe we should stop fuzzing with opcache.jit=1001 atm. I'm skeptical about whether somebody uses custom JIT settings in production, since these settings are quite cryptic from a users perspective. I'll try to have another look at this issue soon.

[YuanchengJiang]

@iluuu1994 Sure. I guess it is more practical to fuzz with some common JIT options like tracing (1254) and function (1205).