pdo_sqlite segmentation fault

issue の再現コードから始めて ext/pdo_sqlite/sqlite_statement.c:54 を調査し、その後、collation callback がカーソルを閉じる間に ext/pdo/pdo_stmt.c:456 を通る呼び出しを追跡します。完了の条件は、提供されたスクリプトが AddressSanitizer 下で segfault しなくなり、その動作が適切な回帰テストでカバーされることです。

Description

The following code:

<?php
$db = Pdo\Sqlite::connect('sqlite::memory:');
$db->exec("CREATE TABLE t(x TEXT)");
$db->exec("INSERT INTO t VALUES ('b'),('a'),('c'),('d'),('e')");

$stmt = null;
$db->createCollation('evil', function ($a, $b) use (&$stmt) {
    $stmt->closeCursor();        
    return $a <=> $b;
});

$stmt = $db->prepare("SELECT x FROM t ORDER BY x COLLATE evil");
$stmt->execute();            

Resulted in this output:

Deprecated: Method PDO::sqliteCreateCollation() is deprecated since 8.5, use Pdo\Sqlite::createCollation() instead in /audit/repro/battery7/e7_06_collation_closecursor.php on line 8
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0xffffe64c9040 sp 0xffffe64c9020 T0)
==7==Hint: pc points to the zero page.
==7==The signal is caused by a READ memory access.
==7==Hint: address points to the zero page.
    #0 0x0  (<unknown module>)
LLVMSymbolizer: error reading file: No such file or directory
    #1 0xffffade2578c  (linux-vdso.so.1+0x78c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>) 
==7==ABORTING

gdb backtrace:

#0  0x0000000000000000 in ?? ()
#1  0x... in ?? () from /lib/.../libsqlite3.so.0
#2  0x... in ?? () from /lib/.../libsqlite3.so.0
#3  sqlite3VdbeExec () from libsqlite3.so.0
#4  sqlite3_step () from libsqlite3.so.0
#5  pdo_sqlite_stmt_execute (stmt=...) at ext/pdo_sqlite/sqlite_statement.c:54
#6  zim_PDOStatement_execute (...) at ext/pdo/pdo_stmt.c:456
...

PHP Version

8.6.0-dev

Operating System

Ubuntu 22.04