Long match statement can segfault compiler during recursive SSA renaming

Description

This issue was originally opened in the FrankenPHP repo, but I'm posting a minimal reproducer here as well since I'm not sure how to best debug this.

Basically, specific weird match statements will lead to hanging+crash in the alpine docker image (bookworm doesn't have this issue). The original file where this first was observed is this enum, but I created a minimal reproducer here:

https://github.com/AlliBalliBaba/franke-alpine-zts-crash

Hanging + crashing will only happen if the non-debug version of PHP is installed. As soon as I'm using a debug version like this, the crash will not happen anymore (essentially --with-debug when building PHP will prevent the crash).

Similarly, disabling opcache will also prevent the crash.

PHP Version

PHP 8.4.10 (cli) (built: Jul  3 2025 23:01:28) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.10, Copyright (c), by Zend Technologies

FrankenPHP v1.7.0 PHP 8.4.10 Caddy v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=

Operating System

Alpine 3.22.0

@AlliBalliBaba

@AlliBalliBaba can you test on your machine and confirm the behavior that I found:

Reducing the size of the match:

If I comment out self::Reunion => [LanguageAlpha2::French] and everything after it in the matching, it doesn't break
If I just comment everything after that, but not the self::Reunion => [LanguageAlpha2::French] entry, it crashes

Removing the results

If I uncomment everything but have each of the match arms return [] rather than whatever was there previously, it doesn't break

@DanielEScherzer

Interesting, @DanielEScherzer for me start commenting pairs from self::Russian_Federation => [LanguageAlpha2::Russian], and below make it working fine. uncomment self::Russian_Federation => [LanguageAlpha2::Russian], make it crash.

But this is docker, shouldn't everyone being on the same set up?
Maybe its different versions of the docker image - I didn't have it locally so I just pulled the latest

Running php index.php inside container is working fine

I haven't looked at it yet (as I have to head to work), but symptom-wise this has some similarity to #16727
If this is also a race condition, then it explains why a debug build doesn't trigger it (race window not matching up due to slow execution), and it also explains why making the code shorters doesn't trigger it (race window too small)

@DanielEScherzer

@DanielEScherzer Yeah the crash does not happen if you shorten or modify the match statement too much. It also doesn't happen with php-cli or with opcache disabled.

It happens consistently if the match statement looks a certain way, so feels less like a race condition as in #16727. Could sill be a race condition somewhere in opcache though.

@AlliBalliBaba

@AlliBalliBaba I tried your Dockerfile and replaced the image name in the start script with the one I just built. However, this always gives me a 404 back when I visit anything in the browser.

Oh yeah, you're right i forgot to add WORKDIR /app to the end of the Dockerfile, should be fixed. Or you can also run it directly with --workdir /app:

docker run --rm -it \
  --name debug_frankenphp_container \
  -e SERVER_NAME=:80 \
  -v ".:/app" \
  -p 8282:80 \
  --workdir /app \
  frankenphp-with-debug

==280256==ERROR: AddressSanitizer: stack-overflow on address 0x7b14d732ef08 (pc 0x7f152ec7e6f9 bp 0x7b14d732f750 sp 0x7b14d732ef10 T17)
    #0 0x7f152ec7e6f9 in __asan_memcpy (/usr/lib/llvm20/lib/clang/20/lib/linux/libclang_rt.asan-x86_64.so+0xe66f9) (BuildId: 23b36bf8516d4dd10f2fcfa62ca1c80c71aa1ff9)
    #1 0x7f152d3ec415 in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:833:3
    #2 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #3 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #4 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #5 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7

<etc>

This is a stack overflow. The reason this reproduces on Alpine but not on Debian is because Alpine/musl-based-systems have a very small thread stack by default; much smaller than on glibc systems.
zend_ssa_rename should likely be made iterative; we've done some stuff like that previously.

EDIT: very work-in-progress patch (that demonstrates it solves this issue): https://gist.github.com/nielsdos/16a6e9698cc04394c8cce17750f85440

Fix phpGH-19065: Long match statement can segfault compiler during re…

I have the exact same issue but on running ubuntu:24.04 in Docker.

Laravel Sail Dockerfile for php8.4

https://github.com/laravel/sail/blob/1.x/runtimes/8.4/Dockerfile

That's possible, it's not Alpine-exclusive, but you're just more likely to hit it on Alpine.

Fix GH-19065: Long match statement can segfault compiler during recur…

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4'

🚑️ Switch from Alpine image to Debian

Navigation Menu

Repository navigation

Long match statement can segfault compiler during recursive SSA renaming #19065

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Long match statement can segfault compiler during recursive SSA renaming #19065

Description

Description

PHP Version

Operating System

Activity

DanielEScherzer commented on Jul 8, 2025

khaledalam commented on Jul 8, 2025

DanielEScherzer commented on Jul 8, 2025

khaledalam commented on Jul 8, 2025

ndossche commented on Jul 8, 2025

AlliBalliBaba commented on Jul 8, 2025

ndossche commented on Jul 8, 2025

AlliBalliBaba commented on Jul 8, 2025

ndossche commented on Jul 8, 2025

JeremyM1985 commented on Jul 27, 2025

ndossche commented on Jul 27, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions