[php-src] Issue #20890: Segfault in zval_undefined_cv when JIT compiles property hook

[email protected] (Moonster8282)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/20890
Author: Moonster8282

### Description

The following code:
```php
<?php
class HookJIT {
    private int $readCount = 0;

    public int $computed {
        get {
            $this->readCount++;
            return $this->readCount * 2;
        }
    }
}

function hook_hot_path($obj, $iterations) {
    $sum = 0;
    for ($i = 0; $i < $iterations; $i++) {
        $sum += $obj->computed;
    }
    return $sum;
}

echo "Testing property hook in hot path...\n";
$obj = new HookJIT();
$result = hook_hot_path($obj, 100000);
echo "Result: $result\n";
```

Stack Trace
```
==411==ERROR: AddressSanitizer: SEGV on unknown address 0x00017fff7ffb
The signal is caused by a READ memory access.
#0 0x55740017a63f in zval_undefined_cv /root/php-src/Zend/zend_execute.c:279
#1 0x55740017aaa7 in _get_zval_ptr_cv_BP_VAR_RW /root/php-src/Zend/zend_execute.c:381
#2 0x5574002d4e6f in ZEND_ASSIGN_OP_SPEC_CV_TMPVAR_HANDLER /root/php-src/Zend/zend_vm_execute.h:47849
#3 0x49da7b90 (/dev/zero (deleted)+0x8000b90)  <-- JIT generated code
```

Dockerfile
```
# php85:latest c6028c7a4b87cca123fce7276fa9672251790d50180faf4c7f7bb53b12011078
FROM php:8.5.1-cli
CMD ["/bin/bash"]
```

Resulted in this output:
```
# php -d opcache.enable_cli=1 -d opcache.jit=1251 test.php
Testing property hook in hot path...
Segmentation fault (core dumped)
```

But I expected this output instead:
```
# php -d opcache.enable_cli=1 -d opcache.jit=1251 test.php
Testing property hook in hot path...
Result: 10000100000
```

Root Cause
```
The JIT compiler incorrectly handles property hook access in hot paths when using optimization level 1251. The crash occurs in `zval_undefined_cv()` function, indicating the JIT compiled code is accessing an undefined/invalid CV (compiled variable).
```


### PHP Version

```plain
PHP 8.5.1 (cli) (built: Jan  9 2026 22:31:28) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.1, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.1, Copyright (c), by Zend Technologies
```

### Operating System

Linux c6028c7a4b87 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 GNU/Linux
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.