[php-src] Issue #21746: Segfault with tracing JIT on 2nd call of eval'd closure after preceding loops

[email protected] (theodorejb)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/21746
Author: theodorejb

### Description

I keep running into this when attempting to benchmark PHP Handlebars. I reproduced the issue with two different laptops, one running Windows 11 (Intel Core Ultra 7 268V) and the other Ubuntu 24.04 (Intel Core i9-13900HX). I don't know if the processor matters, but those are the two I tested with.

To reproduce, check out https://github.com/devtheorem/php-handlebars/tree/segfault (the segfault branch), run `composer install`, then run the benchmark with 82 or more iterations:

```sh
php -d opcache.enable_cli=1 -d opcache.jit=tracing tests/benchmark.php 82
```

Output:
> Compiled 82 times  |  3.92 ms/compile  |    22.6 KB code    |  1.8 MB peak
> Render 0...complete
> Render 1...Segmentation fault

On line 88 of the `tests/benchmark.php` script, there is a warmup loop with 50 iterations to warm up the JIT before measuring compilation time. So it is actually on 132 or more total iterations (50 + 82) when the segmentation fault occurs. If this warmup loop is changed to only have 1 iteration rather than 50, then the script has to be run with a final argument of `131` or higher to trigger the segmentation fault.

But if the warmup loop is removed, or its body replaced with simply `strlen("warmup");`, then the segfault never occurs, no matter how many iterations the benchmark runs with. So somehow having this preliminary loop with the same function calls as the loop following it causes a segfault later the second time that the `$renderer` closure is invoked.

Please let me know if anything more is needed to reproduce the issue. On Ubuntu, a "Sorry, the application php8.5 has stopped unexpectedly" popup is shown which has more details and a stacktrace:

<img width="2140" height="946" alt="Image" src="https://github.com/user-attachments/assets/cd13ee42-522d-402c-83c4-362e2fe39233" />

### PHP Version

```plain
PHP 8.5.5 (cli) (built: Apr  7 2026 19:24:35) (NTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.5, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.5, Copyright (c), by Zend Technologies
```

### Operating System

Windows 11, Ubuntu 24.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.