Skip to content

Segfault with tracing JIT on 2nd call of eval'd closure after preceding loops #21746

@theodorejb

Description

@theodorejb

Description

I keep running into this when attempting to benchmark PHP Handlebars. I reproduced the issue with two different laptops, one running Windows 11 (Intel Core Ultra 7 268V) and the other Ubuntu 24.04 (Intel Core i9-13900HX). I don't know if the processor matters, but those are the two I tested with.

To reproduce, check out https://github.com/devtheorem/php-handlebars/tree/segfault (the segfault branch), run composer install, then run the benchmark with 82 or more iterations:

php -d opcache.enable_cli=1 -d opcache.jit=tracing tests/benchmark.php 82

Output:

Compiled 82 times | 3.92 ms/compile | 22.6 KB code | 1.8 MB peak
Render 0...complete
Render 1...Segmentation fault

On line 88 of the tests/benchmark.php script, there is a warmup loop with 50 iterations to warm up the JIT before measuring compilation time. So it is actually on 132 or more total iterations (50 + 82) when the segmentation fault occurs. If this warmup loop is changed to only have 1 iteration rather than 50, then the script has to be run with a final argument of 131 or higher to trigger the segmentation fault.

But if the warmup loop is removed, or its body replaced with simply strlen("warmup");, then the segfault never occurs, no matter how many iterations the benchmark runs with. So somehow having this preliminary loop with the same function calls as the loop following it causes a segfault later the second time that the $renderer closure is invoked.

Please let me know if anything more is needed to reproduce the issue. On Ubuntu, a "Sorry, the application php8.5 has stopped unexpectedly" popup is shown which has more details and a stacktrace:

Image

PHP Version

PHP 8.5.5 (cli) (built: Apr  7 2026 19:24:35) (NTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.5, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.5, Copyright (c), by Zend Technologies

Operating System

Windows 11, Ubuntu 24.04

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions