php-fpm8.1: segfault at ... ip ... sp ... error 4 in opcache.so

Description

Yesterday I upgraded PHP from 8.1.2 to 8.1.3 (all packages from dotdeb.org)
Today I got a segfault in phpmyadmin 5.1.1 when trying to get a list of tables. The error was persistent and only disappeared after restarting php-fpm. Looks like the JIT cache is getting corrupted somewhere?

syslog:
Feb 24 13:04:12 host kernel: [519460.672067] php-fpm8.1[44280]: segfault at 7f10a325bdc6 ip 00007f10aea1b957 sp 00007ffcf773a010 error 4 in opcache.so[7f10ae968000+b5000]
Feb 24 13:04:12 host kernel: [519460.672409] Code: 09 e9 3c fd ff ff 0f 1f 44 00 00 48 8b 05 79 e4 01 00 49 8b 56 18 48 63 00 48 8b 84 c2 c0 00 00 00 48 85 c0 0f 84 c9 01 00 00 40 06 01 0f 84 bf 01 00 00 48 8b b0 a8 00 00 00 48 83 7a 08 00

uname -a

Linux host 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64 GNU/Linux

php-fpm8.1 -v

PHP 8.1.3 (fpm-fcgi) (built: Feb 23 2022 16:07:16)
Copyright (c) The PHP Group
Zend Engine v4.1.3, Copyright (c) Zend Technologies
with Zend OPcache v8.1.3, Copyright (c), by Zend Technologies

gdb /usr/sbin/php-fpm8.1 /tmp/core-php-fpm8.1-11-33-33-44284-1645697061
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
https://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/php-fpm8.1...
Reading symbols from /usr/lib/debug/.build-id/9b/5e45f50e79db3a2d6acf92a15783df24331a52.debug...

warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing
[New LWP 44284]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f10aea1b957 in zend_jit_trace_execute (ex=ex@entry=0x7f10aee181b0, op=op@entry=0x4386b4a0, trace_buffer=trace_buffer@entry=0x7ffcf773a160, start=,
is_megamorphic=is_megamorphic@entry=0) at ./ext/opcache/jit/zend_jit_vm_helpers.c:866

warning: Source file is more recent than executable.
866 || UNEXPECTED(!(jit_extension->func_info.flags & ZEND_FUNC_JIT_ON_HOT_TRACE))) {
(gdb) bt
#0 0x00007f10aea1b957 in zend_jit_trace_execute (ex=ex@entry=0x7f10aee181b0, op=op@entry=0x4386b4a0, trace_buffer=trace_buffer@entry=0x7ffcf773a160, start=,
is_megamorphic=is_megamorphic@entry=0) at ./ext/opcache/jit/zend_jit_vm_helpers.c:866
#1 0x00007f10aea170c6 in zend_jit_trace_hot_root (execute_data=0x7f10aee181b0, opline=0x4386b4a0) at ./ext/opcache/jit/zend_jit_trace.c:7434
#2 0x00000000438f4647 in ?? ()
#3 0x00007f1000000000 in ?? ()
#4 0x000000004386f1e0 in ?? ()
#5 0x0000000000000000 in ?? ()

Directive Local Value Master Value
opcache.blacklist_filename no value no value
opcache.consistency_checks 0 0
opcache.dups_fix Off Off
opcache.enable On On
opcache.enable_cli Off Off
opcache.enable_file_override Off Off
opcache.error_log /var/log/php/php8.1-errors.log /var/log/php/php8.1-errors.log
opcache.file_cache no value no value
opcache.file_cache_consistency_checks On On
opcache.file_cache_only Off Off
opcache.file_update_protection 2 2
opcache.force_restart_timeout 180 180
opcache.huge_code_pages On On
opcache.interned_strings_buffer 5 5
opcache.jit 1255 1255
opcache.jit_bisect_limit 0 0
opcache.jit_blacklist_root_trace 16 16
opcache.jit_blacklist_side_trace 8 8
opcache.jit_buffer_size 2M 2M
opcache.jit_debug 256 256
opcache.jit_hot_func 127 127
opcache.jit_hot_loop 64 64
opcache.jit_hot_return 8 8
opcache.jit_hot_side_exit 8 8
opcache.jit_max_exit_counters 8192 8192
opcache.jit_max_loop_unrolls 8 8
opcache.jit_max_polymorphic_calls 2 2
opcache.jit_max_recursive_calls 2 2
opcache.jit_max_recursive_returns 2 2
opcache.jit_max_root_traces 1024 1024
opcache.jit_max_side_traces 128 128
opcache.jit_prof_threshold 0.005 0.005
opcache.lockfile_path /tmp /tmp
opcache.log_verbosity_level 2 2
opcache.max_accelerated_files 1023 1023
opcache.max_file_size 0 0
opcache.max_wasted_percentage 5 5
opcache.memory_consumption 32 32
opcache.opt_debug_level 0 0
opcache.optimization_level 0x7FFEBFFF 0x7FFEBFFF
opcache.preferred_memory_model no value no value
opcache.preload no value no value
opcache.preload_user www-data www-data
opcache.protect_memory Off Off
opcache.record_warnings Off Off
opcache.restrict_api no value no value
opcache.revalidate_freq 2 2
opcache.revalidate_path Off Off
opcache.save_comments Off Off
opcache.use_cwd On On
opcache.validate_permission Off Off
opcache.validate_root Off Off
opcache.validate_timestamps Off Off

PHP Version

PHP 8.1.3

Operating System

Debain 11

Commencez par le core dump signalé et les points d’entrée d’OPcache JIT ext/opcache/jit/zend_jit_vm_helpers.c:866 et ext/opcache/jit/zend_jit_trace.c:7434. Comparez le comportement et la configuration de PHP 8.1.3 présentés ici, puis reproduisez la requête de php-fpm listant les tables avec JIT activé. Le travail est terminé lorsque la cause du crash est identifiée et qu’un correctif vérifié ou une couverture de régression est ajouté.