Segfault in memory allocator during compilation during autoloading

Description

PHP config: https://paste.daniil.it/config

This is happening in a pcntl_forked process (as for the other segfaults I submitted recently).

I can DM a full coredump if needed.

ref: compressed_coredump-php.78197.1688713825

backtrace:

(gdb) backtrace
#0  zend_mm_alloc_small (bin_num=11, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1313
#1  zend_mm_alloc_heap (size=<optimized out>, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1384
#2  _zend_mm_alloc (heap=0x7f2ccac00040, size=<optimized out>) at ./Zend/zend_alloc.c:2382
#3  0x000055731201f5c3 in lookup_cv (name=name@entry=0x5573143c8020) at ./Zend/zend_compile.c:503
#4  0x0000557312029e53 in zend_compile_params (fallback_return_type=<optimized out>, return_type_ast=<optimized out>, ast=<optimized out>) at ./Zend/zend_compile.c:6776
#5  zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7403
#6  0x000055731202b495 in zend_compile_expr_inner (ast=0x7f2cbdc2be20, result=0x7ffcb463a380) at ./Zend/zend_compile.c:10333
#7  zend_compile_expr (result=0x7ffcb463a380, ast=0x7f2cbdc2be20) at ./Zend/zend_compile.c:10350
#8  0x00005573120312ec in zend_compile_args (may_have_extra_named_args=<optimized out>, fbc=0x0, ast=<optimized out>) at ./Zend/zend_compile.c:3612
#9  zend_compile_call_common (result=0x7ffcb463a6a0, args_ast=0x7f2cbdc2be70, fbc=0x0, lineno=807) at ./Zend/zend_compile.c:3715
#10 0x000055731202ee44 in zend_compile_ns_call (name_node=0x7ffcb463a440, lineno=807, args_ast=0x7f2cbdc2be70, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:3758
#11 zend_compile_call (type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:4461
#12 zend_compile_var_inner (by_ref=<optimized out>, type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10369
#13 zend_compile_var (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160, type=<optimized out>, by_ref=<optimized out>) at ./Zend/zend_compile.c:10395
#14 0x000055731202c29d in zend_compile_expr_inner (ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10230
#15 zend_compile_expr (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160) at ./Zend/zend_compile.c:10350
#16 0x000055731202d314 in zend_compile_assign (ast=0x7f2cbdc2c178, ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:3220
#17 zend_compile_expr_inner (ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:10233
#18 zend_compile_expr (result=0x7ffcb463a7d0, ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10350
#19 0x0000557312026cc0 in zend_compile_stmt (ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10192
#20 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176
#21 zend_compile_stmt (ast=0x7f2cbdc2bc88) at ./Zend/zend_compile.c:10100
#22 0x0000557312029951 in zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7428
#23 0x0000557312027aec in zend_compile_stmt (ast=0x7f2cbdc2c9c8) at ./Zend/zend_compile.c:10153
#24 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176
#25 zend_compile_stmt (ast=0x7f2cbdc4e590) at ./Zend/zend_compile.c:10100
#26 0x000055731202acd0 in zend_compile_class_decl (result=0x0, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7909
#27 0x000055731202666c in zend_compile_top_stmt (ast=0x7f2cbdc4fb80) at ./Zend/zend_compile.c:10075
#28 0x0000557312026698 in zend_compile_top_stmt (ast=<optimized out>) at ./Zend/zend_compile.c:10064
#29 zend_compile_top_stmt (ast=0x7f2cbdbcac78) at ./Zend/zend_compile.c:10054
#30 0x000055731200813e in zend_compile (type=type@entry=2) at ./Zend/zend_language_scanner.c:620
#31 0x000055731200993a in compile_file (file_handle=0x7ffcb463b500, type=2) at ./Zend/zend_language_scanner.c:655
#32 0x00007f2cc90f26b6 in phar_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/phar/phar.c:3355
#33 0x00007f2cca838df2 in opcache_compile_file (file_handle=0x7ffcb463b500, type=2, op_array_p=0x7ffcb463b400) at ./ext/opcache/ZendAccelerator.c:1820
#34 0x00007f2cca83b941 in persistent_compile_file (type=2, file_handle=0x7ffcb463b500) at ./ext/opcache/ZendAccelerator.c:2164
#35 persistent_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/opcache/ZendAccelerator.c:1978
#36 0x000055731200999d in compile_filename (type=type@entry=2, filename=filename@entry=0x557314329a78) at ./Zend/zend_language_scanner.c:706
#37 0x000055731207a6f6 in zend_include_or_eval (inc_filename_zv=<optimized out>, type=2) at ./Zend/zend_execute.c:4799
#38 0x0000557312089f8e in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at ./Zend/zend_vm_execute.h:38948
#39 0x00005573120b090d in execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:59395
#40 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=<optimized out>) at ./Zend/zend_execute_API.c:947
#41 zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at ./Zend/zend_execute_API.c:749
--Type <RET> for more, q to quit, c to continue without paging--
#42 0x000055731203811d in zend_call_known_function (fn=0x55731840d038, object=<optimized out>, called_scope=<optimized out>, retval_ptr=retval_ptr@entry=0x0, param_count=param_count@entry=1,
    params=params@entry=0x7ffcb463b890, named_params=0x0) at ./Zend/zend_execute_API.c:1041
#43 0x0000557311f31257 in spl_perform_autoload (class_name=0x7f2cbe110d90, lc_name=0x7f2cbe110d58) at ./ext/spl/php_spl.c:445
#44 0x0000557312036f08 in zend_lookup_class_ex (name=<optimized out>, key=key@entry=0x0, flags=flags@entry=0) at ./Zend/zend_execute_API.c:1207
#45 0x000055731203710d in zend_lookup_class (name=<optimized out>) at ./Zend/zend_execute_API.c:1228
#46 0x0000557312062395 in class_exists_impl (return_value=0x7f2ccac15a30, skip_flags=3, flags=8, execute_data=0x7f2ccac15a40) at ./Zend/zend_builtin_functions.c:992
#47 zif_class_exists (execute_data=0x7f2ccac15a40, return_value=0x7f2ccac15a30) at ./Zend/zend_builtin_functions.c:1006
#48 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637
#49 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056
#50 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=0x7ffcb463ba50) at ./Zend/zend_execute_API.c:947
#51 zend_call_function (fci=fci@entry=0x7ffcb463bb60, fci_cache=fci_cache@entry=0x7ffcb463bb40) at ./Zend/zend_execute_API.c:749
#52 0x0000557311f6d109 in zif_array_map (execute_data=<optimized out>, return_value=0x7f2ccac156c0) at ./ext/standard/array.c:6193
#53 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637
#54 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056
#55 0x00005573120b9701 in zend_execute (op_array=0x7f2ccac7e000, return_value=0x0) at ./Zend/zend_vm_execute.h:60396
#56 0x0000557312046e55 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1827
#57 0x0000557311fe23fa in php_execute_script (primary_file=<optimized out>) at ./main/main.c:2542
#58 0x000055731213050a in do_cli (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:964
#59 0x0000557311e72c5b in main (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:1333

zbacktrace:

(gdb) zbacktrace
[0x7f2ccac15b30] Composer\Autoload\{closure}("/zoon/zoon/vendor/composer/../../Module/Seo/Orm/MetaObject.php") /zoon/zoon/vendor/composer/ClassLoader.php:576
[0x7f2ccac15aa0] Composer\Autoload\ClassLoader->loadClass("Z\Module\Seo\Orm\MetaObject") /zoon/zoon/vendor/composer/ClassLoader.php:427
[0x7f2ccac15a40] class_exists("Z\Module\Seo\Orm\MetaObject") [internal function]
[0x7f2ccac159d0] Zoon\ORM\Mongo\MongoMapper->prepareObjectClassName() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:156
[0x7f2ccac15940] Zoon\ORM\Mongo\MongoMapper->__construct() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:173
[0x7f2ccac158b0] Zoon\ORM\Mongo\MongoMapper->get() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:127
// more stuff

PHP Version

PHP 8.2.7

Operating System

Ubuntu 20.04, ondrej repos

Start with the supplied PHP 8.2.7 Ubuntu 20.04 configuration and backtrace. Inspect Zend/zend_alloc.c and Zend/zend_compile.c around the allocator and compilation frames, then follow the autoload path through ext/phar/phar.c, ext/opcache/ZendAccelerator.c, and ext/spl/php_spl.c. Done requires identifying a reproducible trigger and eliminating the segfault.