Spinning 100% CPU in zend_hash_find_bucket

Description

The following code:

(Installed Nextcloud 33 + Postgres and added an IMAP account to Nextcloud Mail)

php-zts occ mail:account:sync 24

Resulted in this output:
It reliably hangs. Maybe a memory corruption? I would love it to just crash, but the symptom is that it starts to spin forever in zend_hash_find_bucket (the line idx = Z_NEXT(p->val); keeps idx being zero). I know this is hot code, but for safety against hanging, there could maybe be some assertion that ensures that idx changes at least once in a while? 100% CPU spins like this could get expensive at scale.

#0  0x000055b3c8dbda37 in zend_hash_find ()
#1  0x000055b3c871b929 in pcre_get_compiled_regex_cache_ex ()
#2  0x000055b3c871f4cd in ?? ()
#3  0x000055b3c871f2e0 in ?? ()
#4  0x000055b3c871f8e9 in ?? ()
#5  0x000055b3c8d3700d in ?? ()
#6  0x000055b3c8cdfbb9 in execute_ex ()
#7  0x000055b3c8cdff75 in zend_execute ()
#8  0x000055b3c8e25b72 in zend_execute_script ()
#9  0x000055b3c8bf0f28 in php_execute_script_ex ()
#10 0x000055b3c8e2a021 in ?? ()
#11 0x000055b3c8e28056 in ?? ()
#12 0x00007f8487e8a8d0 in libc_start_main_stage2 (main=0x55b3c8e26690, argc=4, argv=0x7ffffc22e278) at src/env/__libc_start_main.c:95
#13 0x000055b3c8518b56 in _start ()

If I force return in GDB (set $rax=0; return - saying there is no matching hash), it dies on a null pointer dereference later on.

But I expected this output instead:

47MB of memory used

(this is normal successful execution)

Sorry for no minimized reproducer yet. Is there something I could do without minimizing the test case? I am trying to get a better backtrace, but I believe building with ASAN would work best.

Known working version (Alpine system PHP):

$ php85 -v
PHP 8.5.6 (cli) (built: May  7 2026 16:54:58) (NTS)
Copyright (c) The PHP Group
Built by Alpine Linux aports
Zend Engine v4.5.6, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies

Known broken version: (added https://pkg.henderkes.com/api/packages/85/alpine/main/php-zts to /etc/apk/repositories and installed php-zts)

PHP Version

PHP 8.5.6 (cli) (built: May  8 2026 14:59:54) (ZTS zig 0.16.0 x86_64)
Copyright (c) The PHP Group
Built by Static PHP <https://static-php.dev> #StandWithUkraine
Zend Engine v4.5.6, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies

Operating System

Alpine 3.23.4

Reproduisez le blocage avec php-zts occ mail:account:sync 24 et comparez-le avec le NTS Alpine PHP build connu pour fonctionner. Commencez par les frames zend_hash_find/zend_hash_find_bucket et pcre_get_compiled_regex_cache_ex, puis essayez un ASAN build afin d'améliorer le backtrace. Le travail est considéré comme terminé lorsqu'une cause reproductible ou un cas de test minimal pour la boucle infinie a été identifié et que le résultat a été documenté.