stack overflow in JIT

首先，使用提供的 PHP 程序和 JIT 命令重现 stack overflow。阅读 Zend/zend_objects.c 第 77 行附近和 Zend/zend_objects_API.c 第 193 行附近的内容，sanitizer trace 会在那里重复。完成标准是 reproducer 不再因 stack overflow 而中止，并且对象销毁行为由回归测试覆盖。

Description

The following code:

<?php
class N { public $n; }
$o=null;
for($i=0;$i<1000000;$i++){ $x=new N; $x->n=$o; $o=$x; }
$o=null;

Resulted in this output:

_store_del /home/php-src/Zend/zend_objects_API.c:193
    #344 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #345 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #346 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #347 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #348 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #349 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #350 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #351 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #352 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #353 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #354 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #355 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #356 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #357 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #358 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #359 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #360 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #361 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #362 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #363 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #364 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #365 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #366 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #367 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #368 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #369 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94
    #370 0x55ed1181c2b8 in zend_objects_store_del /home/php-src/Zend/zend_objects_API.c:193
    #371 0x55ed1181d414 in zend_object_dtor_property /home/php-src/Zend/zend_objects.c:64
    #372 0x55ed1181d414 in zend_object_std_dtor /home/php-src/Zend/zend_objects.c:94

SUMMARY: AddressSanitizer: stack-overflow /home/php-src/Zend/zend_objects.c:77 in zend_object_std_dtor
==34==ABORTING

USE_ZEND_ALLOC=0 .php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" poc.php

PHP Version

8.6.0

Operating System

ubuntu 22.04