JIT segmentation fault in PHP 8.1

Description

PHP 8.1.0 + 8.1.1 produces segfault, randomly. Downgrading to 8.0 solves the issue.

--core dump---

BFD: Warning: coredump-php-fpm.30267 is truncated: expected core file size >= 5413076992, found: 35983360.
[New LWP 30267]
[New LWP 1887]
[New LWP 1886]
[New LWP 1888]
Cannot access memory at address 0x7f277dbb3128
Cannot access memory at address 0x7f277dbb3120
Failed to read a valid object file image from memory.
Core was generated by `php-fpm: pool xxxxxx '.

Program terminated with signal 11, Segmentation fault.
#0 0x000055bbf04c0f25 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/debug/php-8.1.1/Zend/zend_vm_execute.h:10137
10137 ce = CACHED_PTR(opline->op2.num);
(gdb) bt
Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x7ffdc940e3a8:
(gdb) bt
#0 0x000055bbf04c0f25 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/debug/php-8.1.1/Zend/zend_vm_execute.h:10137
Cannot access memory at address 0x7ffdc940e3a8
(gdb) frame 0
#0 0x000055bbf04c0f25 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/debug/php-8.1.1/Zend/zend_vm_execute.h:10137
10137 ce = CACHED_PTR(opline->op2.num);
(gdb) info frame
Stack level 0, frame at 0x7ffdc940e3b0:
rip = 0x55bbf04c0f25 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (/usr/src/debug/php-8.1.1/Zend/zend_vm_execute.h:10137); saved rip Cannot access memory at address 0x7ffdc940e3a8

this is the only available info in the core dump.

PHP Version

PHP 8.1.0 + 8.1.1

Operating System

CentOS 7

从 Zend/zend_vm_execute.h:10137 的 core-dump trace 开始，具体检查 ZEND_NEW_SPEC_CONST_UNUSED_HANDLER，并将 PHP 8.1.0 和 8.1.1 的 JIT 行为与 PHP 8.0 进行比较。报告除了间歇性的 php-fpm 崩溃之外没有提供 reproducer，因此要视为完成，必须隔离出一个可复现的故障，并据此验证修复。