Description:
------------
I have a web server running PHP under FPM with PHP version 7.1.4-1+deb.sury.org~yakkety+1_amd64. Here is the full info if you're interested: http://dev71.lousy.site/info.php

I get a segfault in the same place when I enable opcache (default settings, nothing fancy). I'm running WordPress with Jetpack, and here's the line that causes the error:
https://github.com/Automattic/jetpack/blob/master/json-endpoints.php#L141

I don't know why, but if I remove that line completely, execution happens right until;
https://github.com/Automattic/jetpack/blob/master/json-endpoints.php#L612

where it segfaults again.

I have been trying to figure out a small script that would illustrate the problem, but I can't - I know what lines in the PHP code are the last to get executed, but I don't know why and I can't reproduce the same thing in an isolated file.

I have been able to get a stack trace with debug symbols, here it is:

Reading symbols from /usr/sbin/php-fpm7.1...Reading symbols from /usr/lib/debug/.build-id/6d/1b8d73ab820b0d911a4252da9febf10aa54f2d.debug...done.
done.
[New LWP 4945]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www                                                            '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000564573545c0f in zend_hash_find_bucket (key=0x7fef4eab4f68, ht=0x7fef4d03fa00) at ./Zend/zend_hash.c:481
481	./Zend/zend_hash.c: No such file or directory.
(gdb) bt
#0  0x0000564573545c0f in zend_hash_find_bucket (key=0x7fef4eab4f68, ht=0x7fef4d03fa00) at ./Zend/zend_hash.c:481
#1  _zend_hash_add_or_update_i (flag=1, pData=0x7fef504bdd40, key=0x7fef4eab4f68, ht=0x7fef4d03fa00) at ./Zend/zend_hash.c:556
#2  _zend_hash_update (ht=0x7fef4d03fa00, key=0x7fef4eab4f68, pData=0x7fef504bdd40) at ./Zend/zend_hash.c:627
#3  0x0000564573581efc in ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER () at ./Zend/zend_vm_execute.h:5886
#4  0x000056457358273b in execute_ex (ex=<optimized out>) at ./Zend/zend_vm_execute.h:429
#5  0x00005645735dd888 in zend_execute (op_array=op_array@entry=0x7fef5b279000, return_value=return_value@entry=0x7fef504d8cf0) at ./Zend/zend_vm_execute.h:474
#6  0x0000564573538b53 in zend_execute_scripts (type=1528907680, type@entry=8, retval=0x7fef504d8cf0, retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1476
#7  0x00005645734d4ca0 in php_execute_script (primary_file=0x7fffce0ad610) at ./main/main.c:2537
#8  0x00005645733b1efa in main (argc=<optimized out>, argv=<optimized out>) at ./sapi/fpm/fpm/fpm_main.c:1966


Here's what it says about frame 0:

(gdb) frame 0
#0  0x0000564573545c0f in zend_hash_find_bucket (key=0x7fef4eab4f68, ht=0x7fef4d03fa00) at ./Zend/zend_hash.c:481
481	in ./Zend/zend_hash.c

Please let me know what more I can provide.

P,S. this looks kinda similar to https://bugs.php.net/bug.php?id=70428, but the stack trace is different, so I thought I'd create a new bug anyway. Sorry if it's a duplicate.

Test script:
---------------
None, but if you have a WordPress site installed, you can:
1. Install Jetpack.
2. Activate Jetpack by connecting to WordPress.com
3. Go to https://wordpress.com/settings/discussion/your.site.url.com

This is enough to trigger a request that fails with a segfault.