Long match statement can segfault compiler during recursive SSA renaming

[AlliBalliBaba]

Description

This issue was originally opened in the FrankenPHP repo, but I'm posting a minimal reproducer here as well since I'm not sure how to best debug this.

Basically, specific weird match statements will lead to hanging+crash in the alpine docker image (bookworm doesn't have this issue). The original file where this first was observed is this enum, but I created a minimal reproducer here:

https://github.com/AlliBalliBaba/franke-alpine-zts-crash

Hanging + crashing will only happen if the non-debug version of PHP is installed. As soon as I'm using a debug version like this, the crash will not happen anymore (essentially --with-debug when building PHP will prevent the crash).

Similarly, disabling opcache will also prevent the crash.

PHP Version

PHP 8.4.10 (cli) (built: Jul  3 2025 23:01:28) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.10, Copyright (c), by Zend Technologies

FrankenPHP v1.7.0 PHP 8.4.10 Caddy v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=

Operating System

Alpine 3.22.0

[DanielEScherzer]

@AlliBalliBaba can you test on your machine and confirm the behavior that I found:

Reducing the size of the match:

• If I comment out self::Reunion => [LanguageAlpha2::French] and everything after it in the matching, it doesn't break
• If I just comment everything after that, but not the self::Reunion => [LanguageAlpha2::French] entry, it crashes

Removing the results

• If I uncomment everything but have each of the match arms return [] rather than whatever was there previously, it doesn't break

[khaledalam]

Interesting, @DanielEScherzer for me start commenting pairs from self::Russian_Federation => [LanguageAlpha2::Russian], and below make it working fine. uncomment self::Russian_Federation => [LanguageAlpha2::Russian], make it crash.

[DanielEScherzer]

But this is docker, shouldn't everyone being on the same set up?
Maybe its different versions of the docker image - I didn't have it locally so I just pulled the latest

[khaledalam]

Running php index.php inside container is working fine

[nielsdos]

I haven't looked at it yet (as I have to head to work), but symptom-wise this has some similarity to #16727
If this is also a race condition, then it explains why a debug build doesn't trigger it (race window not matching up due to slow execution), and it also explains why making the code shorters doesn't trigger it (race window too small)

[AlliBalliBaba]

@DanielEScherzer Yeah the crash does not happen if you shorten or modify the match statement too much. It also doesn't happen with php-cli or with opcache disabled.

It happens consistently if the match statement looks a certain way, so feels less like a race condition as in #16727. Could sill be a race condition somewhere in opcache though.

[nielsdos]

@AlliBalliBaba I tried your Dockerfile and replaced the image name in the start script with the one I just built. However, this always gives me a 404 back when I visit anything in the browser.

[AlliBalliBaba]

Oh yeah, you're right i forgot to add WORKDIR /app to the end of the Dockerfile, should be fixed. Or you can also run it directly with --workdir /app:

docker run --rm -it \
  --name debug_frankenphp_container \
  -e SERVER_NAME=:80 \
  -v ".:/app" \
  -p 8282:80 \
  --workdir /app \
  frankenphp-with-debug

[nielsdos]

==280256==ERROR: AddressSanitizer: stack-overflow on address 0x7b14d732ef08 (pc 0x7f152ec7e6f9 bp 0x7b14d732f750 sp 0x7b14d732ef10 T17)
    #0 0x7f152ec7e6f9 in __asan_memcpy (/usr/lib/llvm20/lib/clang/20/lib/linux/libclang_rt.asan-x86_64.so+0xe66f9) (BuildId: 23b36bf8516d4dd10f2fcfa62ca1c80c71aa1ff9)
    #1 0x7f152d3ec415 in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:833:3
    #2 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #3 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #4 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7
    #5 0x7f152d3eeaef in zend_ssa_rename /usr/local/src/php/Zend/Optimizer/zend_ssa.c:923:7

<etc>

This is a stack overflow. The reason this reproduces on Alpine but not on Debian is because Alpine/musl-based-systems have a very small thread stack by default; much smaller than on glibc systems.
zend_ssa_rename should likely be made iterative; we've done some stuff like that previously.

EDIT: very work-in-progress patch (that demonstrates it solves this issue): https://gist.github.com/nielsdos/16a6e9698cc04394c8cce17750f85440