stack overflow in jit

Description

The following code:

<?php
$a=[]; $b=[];
for($i=0;$i<1000000;$i++){ $a=[$a]; $b=[$b]; }
var_dump($a === $b);

Resulted in this output:

    #359 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #360 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #361 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #362 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #363 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #364 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #365 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #366 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #367 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #368 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #369 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #370 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #371 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #372 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #373 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #374 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #375 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #376 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #377 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #378 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #379 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #380 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #381 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #382 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #383 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #384 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #385 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #386 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #387 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #388 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #389 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #390 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #391 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #392 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #393 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #394 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #395 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #396 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #397 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #398 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #399 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #400 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #401 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #402 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #403 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #404 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #405 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #406 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #407 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #408 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #409 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #410 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #411 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #412 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #413 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471

SUMMARY: AddressSanitizer: stack-overflow /home/php-src/Zend/zend_hash.c:3215 in zend_hash_compare
==50==ABORTING

USE_ZEND_ALLOC=0 ./php-src/sapi/cli/php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04

Tái hiện lỗi bằng lệnh CLI và poc.php được cung cấp, sau đó kiểm tra các đường dẫn so sánh đệ quy trong Zend/zend_hash.c, Zend/zend_operators.c và Zend/zend_operators.h xung quanh các stack frame được báo cáo. Hoàn thành khi trình tái hiện không còn bị hủy do tràn ngăn xếp mà vẫn duy trì hành vi so sánh như mong đợi.