Assertion failure in Zend/zend_vm_execute.h:2915 when JIT

[YuanchengJiang]

Description

The following code:

<?php
namespace X;
$iterator =
new \RegexIterator(
new \ArrayIterator(['A.phpt', 'B.phpt', 'C.phpt']),
'/\.phpt$/'
)
;
foreach ($iterator as $foo) {
preg_replace('/\.phpt$/', '', '');
}

Resulted in this output:

Zend/zend_vm_execute.h:2915: int zend_fe_fetch_object_helper_SPEC(zend_execute_data *): Assertion `zval_get_type(&(*(array))) == 8' failed.
Aborted (core dumped)

while non-JIT:

To reproduce:

-d "opcache.jit_hot_func=1" -d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1231"

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

This is a duplicate of your other report #15981
You can tell because:

1. This is about frameless jmp
2. The opline points to the wrong address; looking at the generated assembly confirms this issue
3. Using the same hack as in that issue to reset the opline fixes the issue