stack overflow in JIT

Description

The following code:

<?php
class N { public $n; }
$o=null;
for($i=0;$i<1000000;$i++){ $x=new N; $x->n=$o; $o=$x; }
$o=null;

Resulted in this output:

_store_del /home/php-src/Zend/zend_objects_API.c:193
    #344 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #345 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #346 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #347 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #348 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #349 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #350 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #351 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #352 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #353 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #354 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #355 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #356 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #357 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #358 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #359 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #360 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #361 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #362 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #363 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #364 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #365 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #366 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #367 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #368 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #369 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #370 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #371 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #372 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94

SUMMARY: AddressSanitizer: stack-overflow /home/php-src/Zend/zend_objects.c:77 in zend_object_std_dtor
==34==ABORTING

USE_ZEND_ALLOC=0 .php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04

Inizia riproducendo lo stack overflow con il programma PHP e il comando JIT forniti. Leggi Zend/zend_objects.c intorno alla riga 77 e Zend/zend_objects_API.c intorno alla riga 193, dove il sanitizer trace si ripete. Il lavoro è completato quando il reproducer non termina più con uno stack overflow e il comportamento di distruzione degli oggetti è coperto da un test di regressione.