JIT packed type guard crash

[YuanchengJiang]

Description

The following code:

<?php
$a = array(
array(1,2,3),
-PHP_INT_MAX-1,
);
$var_cnt = count($a);
function my_dump($var) {
}
foreach($a as $a) {
for ($i = 0; $i < $var_cnt; $i++) {
my_dump($a[$i]);
}
}

Resulted in this output:

=================================================================
==2945471==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000496f3928 bp 0x7ffe12994080 sp 0x7ffe12993f30 T0)
==2945471==The signal is caused by a READ memory access.
==2945471==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x496f3928  (/dev/zero (deleted)+0x8000928)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x8000928) 
==2945471==ABORTING

To reproduce:

-d "opcache.jit_hot_func=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

No response

[nielsdos]

Slightly simplified:

<?php
$a = array(
    array(1,2,3),
    0,
);
function my_dump($var) {
}
foreach($a as $b) {
    for ($i = 0; $i < 1; $i++) {
        my_dump($b[$i]);
    }
}

Apparently, it %rax is 0, causing a NULL page deref when the type check for IS_LONG happens:

TRACE-1$/run/media/niels/MoreData/php-src-multitasking/x.php$9:
    49464b20:	subq $0x30, %rsp
    49464b24:	movabsq $EG(jit_trace_num), %rax
    49464b2e:	movl $1, (%rax)
    49464b34:	movq 0x60(%r14), %rax ; %rax = Z_PTR_P(`$b`), however $b is IS_LONG with value of 0, so %rax==0
    49464b38:	testl $4, 8(%rax) ; guard for zend_jit_packed_guard
    49464b3f:	jne .L4
    49464b41:	jmp jit$$trace_exit_0

The problem is that a IS_ARRAY type check is missing when emitting the packed guard.
If you were to change the 0 in $a to another value, you can see a dereference on that address+8.