[php-src] Issue #20918: UBSan: member access within null pointer in zend_builtin_functions.c via recursive static initialization (JIT enabled)

[email protected] (YuanchengJiang)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/20918
Author: YuanchengJiang

### Description

The following code:

```php
<?php
function foo($i) {
static $a = $i <= PHP_FLOAT_MAX ? foo($i + 1) : "Done $i";
}
foo(0);
```

Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_builtin_functions.c:1963:9: runtime error: member access within null pointer of type 'const zend_op' (aka 'const struct _zend_op')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_builtin_functions.c:1963:9 in 
```

To reproduce:
```
./php-src/sapi/cli/php  -d "opcache.enable_cli=1" -d "opcache.jit=1254" ./test.php
```

Commit:
```
c518a6ba8bf7a3eb6551424c7ca90dfa06b01b15
```

Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```

Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```

*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*

### PHP Version

```plain
nightly
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.