Description:
------------
While preparing for a migration of our applications from PHP 7.0 to PHP 7.2, we noticed segmentation faults in our php-fpm processes. The test script below is a simplified example of what we are currently running in different debian based servers. I'm able to consistently reproduce it on a debian stretch vm too.

alex@atoq-builder:~/src/php-7.2.2$ uname -a
Linux atoq-builder 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) x86_64 GNU/Linux

alex@atoq-builder:~/src/php-7.2.2$ sapi/cli/php -v
PHP 7.2.2 (cli) (built: Feb 16 2018 15:01:07) ( NTS DEBUG )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies

alex@atoq-builder:~/src/php-7.2.2$ sapi/cli/php -i | grep conf
Configure Command =>  './configure'  '--disable-all' '--enable-opcache' '--enable-debug'


Test script:
---------------
<?php
// This is required for the segfault
md5('foo');

class Extended_Class {};
$response = array(
	'a' => 'b'
);
new Extended_Class( array(
	'foo' => $response,
	'foo2' => 'bar2'
) );

new Extended_Class( array(
	'foo' => $response,
	'foo3' => $response,
) );

Expected result:
----------------
No segfault

Actual result:
--------------
with a PHP cli debug build
alex@atoq-builder:~/src/php-7.2.2$ sapi/cli/php -dextension_dir=./modules/ -dzend_extension=opcache.so -dopcache.enable_cli=true segfault.php
php: /home/alex/src/php-7.2.2/ext/opcache/Optimizer/dce.c:588: dce_live_ranges: Assertion `op_array->opcodes[def].result_type & ((1<<1)|(1<<2))' failed.
Aborted

It also fails on standard PHP-FPM and PHP cli (with opcache.enable_cli=true) builds.