Description:
------------
Upgrading from PHP 7.3.12 to PHP 7.4.1 and 7.4.2 resulted in a particular script segfaulting. The segfault seems to change on each run. Mostly its a segfault, sometimes it's an illegal operation. What I've been able to track down is that it occurs on the script exit, when either exit(), die() or the script reaches the end of its logic.

This is the only script we have that's segfaulting (that I know of). It has some attributes that make it somewhat unique: 1) it uses pcntl functions to fork processes from a master loop, and those loop items also fork themselves, 2) it uses semaphores and shared memory to coordinate the children, 3) it calls pcntl_wait() at exit.

The GDB output doesn't seem useful as it just references the JIT:

#0  0x00007f08b5f749b0 in ?? ()
#1  0x00007f08b89bea57 in pcre2_jit_match_8 () from /usr/lib/libpcre2-8.so.0
#2  0x00007f08b89c2d5c in pcre2_match_8 () from /usr/lib/libpcre2-8.so.0
#3  0x000055e26d9c2c9f in php_pcre_replace_impl ()
#4  0x000055e26d9c3250 in php_pcre_replace ()
#5  0x000055e26d9c3665 in ?? ()
#6  0x000055e26dc44bac in execute_ex ()
#7  0x000055e26dc49d21 in zend_execute ()
#8  0x000055e26dbc30b7 in zend_execute_scripts ()
#9  0x000055e26db63231 in php_execute_script ()
#10 0x000055e26dc4be0c in ?? ()
#11 0x000055e26d97b3e7 in ?? ()
#12 0x00007f08b872a153 in __libc_start_main () from /usr/lib/libc.so.6
#13 0x000055e26d97bb0e in _start ()


#0  0x00007f08b5f749b0 in ?? ()
#1  0x00007f08b89bea57 in pcre2_jit_match_8 () from /usr/lib/libpcre2-8.so.0
#2  0x00007f08b89c2d5c in pcre2_match_8 () from /usr/lib/libpcre2-8.so.0
#3  0x000055e26d9c2c9f in php_pcre_replace_impl ()
#4  0x000055e26d9c3250 in php_pcre_replace ()
#5  0x000055e26d9c3665 in ?? ()
#6  0x000055e26dc44bac in execute_ex ()
#7  0x000055e26dbb478a in zend_call_function ()
#8  0x000055e26dbf459f in zend_objects_destroy_object ()
#9  0x000055e26dbf9156 in zend_objects_store_call_destructors ()
#10 0x000055e26dbb342d in ?? ()
#11 0x000055e26dbc2e3e in zend_call_destructors ()
#12 0x000055e26db61ef6 in php_request_shutdown ()
#13 0x000055e26dc4b173 in ?? ()
#14 0x000055e26d97b3e7 in ?? ()
#15 0x00007f08b872a153 in __libc_start_main () from /usr/lib/libc.so.6
#16 0x000055e26d97bb0e in _start ()


#0  0x00007f08b5f749b0 in ?? ()
#1  0x00007f08b89bea57 in pcre2_jit_match_8 () from /usr/lib/libpcre2-8.so.0
#2  0x00007f08b89c2d5c in pcre2_match_8 () from /usr/lib/libpcre2-8.so.0
#3  0x000055e26d9c2c9f in php_pcre_replace_impl ()
#4  0x000055e26d9c3250 in php_pcre_replace ()
#5  0x000055e26d9c3665 in ?? ()
#6  0x000055e26dc44bac in execute_ex ()
#7  0x000055e26dc49d21 in zend_execute ()
#8  0x000055e26dbc30b7 in zend_execute_scripts ()
#9  0x000055e26db63231 in php_execute_script ()
#10 0x000055e26dc4be0c in ?? ()
#11 0x000055e26d97b3e7 in ?? ()
#12 0x00007f08b872a153 in __libc_start_main () from /usr/lib/libc.so.6
#13 0x000055e26d97bb0e in _start ()

I started using strace to track down what was happening, and that's how I followed it back to the end of execution.

1581438826.999227 access("/ve_run/flags", W_OK) = 0
1581438826.999671 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x56076ffc26df} ---
1581438827.028036 +++ killed by SIGSEGV (core dumped) +++
Segmentation fault

581451801.841257 --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
1581451801.865146 +++ killed by SIGSEGV (core dumped) +++
Segmentation fault