Segmentation fault in Zend/zend_execute.c:278 in JIT

[YuanchengJiang]

Description

The following code:

<?php
namespace test\ns1;
$xml =<<<EOF
<?xml version='1.0'?>
<!DOCTYPE sxe SYSTEM "notfound.dtd">
<sxe id="elem1">
Plain text.
<elem1 attr1='first'>
Bla bla 1.
<!-- comment -->
<elem2>
Here we have some text data.
<elem3>
And here some more.
<elem4>
Wow once again.
</elem4>
</elem3>
</elem2>
</elem1>
<elem11 attr2='second'>
Bla bla 2.
<elem111>
Foo Bar
</elem111>
</elem11>
</sxe>
EOF;
$sxe = simplexml_load_string($xml, 'SimpleXMLIterator');var_dump($sxe);
for ($sxe->rewind(); $sxe->valid(); $sxe->next()) {
var_dump(trim($sxe->key()));var_dump($sxe);
var_dump(trim($sxe->current()));var_dump($sxe);
}
?>

Resulted in this output (JIT 1211):

AddressSanitizer: SEGV /php-src/Zend/zend_execute.c:278:21 in zval_undefined_cv

But I expected this output instead (non-JIT):

object(SimpleXMLIterator)#1 (3) {
  ["@attributes"]=>
  array(1) {
    ["id"]=>
    string(5) "elem1"
  }
  ["elem1"]=>
  string(14) "
Bla bla 1.


"
  ["elem11"]=>
  string(13) "
Bla bla 2.

"
}
string(5) "elem1"
object(SimpleXMLIterator)#1 (3) {
  ["@attributes"]=>
  array(1) {
    ["id"]=>
    string(5) "elem1"
  }
  ["elem1"]=>
  string(14) "
Bla bla 1.


"
  ["elem11"]=>
  string(13) "
Bla bla 2.

"
}
string(10) "Bla bla 1."
object(SimpleXMLIterator)#1 (3) {
  ["@attributes"]=>
  array(1) {
    ["id"]=>
    string(5) "elem1"
  }
  ["elem1"]=>
  string(14) "
Bla bla 1.


"
  ["elem11"]=>
  string(13) "
Bla bla 2.

"
}
string(6) "elem11"
object(SimpleXMLIterator)#1 (3) {
  ["@attributes"]=>
  array(1) {
    ["id"]=>
    string(5) "elem1"
  }
  ["elem1"]=>
  string(14) "
Bla bla 1.


"
  ["elem11"]=>
  string(13) "
Bla bla 2.

"
}
string(10) "Bla bla 2."
object(SimpleXMLIterator)#1 (3) {
  ["@attributes"]=>
  array(1) {
    ["id"]=>
    string(5) "elem1"
  }
  ["elem1"]=>
  string(14) "
Bla bla 1.


"
  ["elem11"]=>
  string(13) "
Bla bla 2.

"
}

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Also a duplicate of your other report #15981
You're hitting the same issue in different ways basically.