stack overflow in jit

Description

The following code:

<?php
$a=[]; $b=[];
for($i=0;$i<1000000;$i++){ $a=[$a]; $b=[$b]; }
var_dump($a === $b);

Resulted in this output:

    #359 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #360 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #361 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #362 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #363 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #364 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #365 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #366 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #367 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #368 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #369 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #370 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #371 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #372 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #373 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #374 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #375 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #376 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #377 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #378 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #379 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #380 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #381 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #382 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #383 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #384 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #385 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #386 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #387 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #388 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #389 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #390 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #391 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #392 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #393 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #394 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #395 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #396 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #397 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #398 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #399 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #400 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #401 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #402 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #403 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #404 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #405 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #406 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #407 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #408 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471
    #409 0x55b2f4f448f1 in zend_hash_compare_impl /home/php-src/Zend/zend_hash.c:3204
    #410 0x55b2f4f448f1 in zend_hash_compare /home/php-src/Zend/zend_hash.c:3234
    #411 0x55b2f5037f64 in zend_is_identical /home/php-src/Zend/zend_operators.c:2495
    #412 0x55b2f5038254 in fast_is_not_identical_function /home/php-src/Zend/zend_operators.h:963
    #413 0x55b2f5038254 in hash_zval_identical_function /home/php-src/Zend/zend_operators.c:2471

SUMMARY: AddressSanitizer: stack-overflow /home/php-src/Zend/zend_hash.c:3215 in zend_hash_compare
==50==ABORTING

USE_ZEND_ALLOC=0 ./php-src/sapi/cli/php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04

使用提供的 CLI 命令和 poc.php 重现该故障，然后检查 Zend/zend_hash.c、Zend/zend_operators.c 和 Zend/zend_operators.h 中报告的堆栈帧附近的递归比较路径。完成的标准是：重现程序不再因栈溢出而中止，同时保留预期的比较行为。