I have spent days trying to pinpoint this better. It's triggered if an "is_array()" is used against a variable, if that variable was assigned from a  function parameter that is an object property holding an array, and if in the assignment an explicit coercion to an array was performed:

  $thevar = (array) $functionparm->property; // property IS an array
  is_array( $thevar );   // will crash OPcache later in the code path.

It will NOT fail for:
a) is_array( $functionparm->property )  … or
b) is_array( (array) $functionparm->property ) … or
c) if the (array) coercion is omitted: $thevar = $functionparm->property

It will NOT crash AT THE TIME of the "is_array()", but it will crash later, if the code is allowed to proceed from there.


For reference, here the actual code snippet with various var_dumps added to see what works, and what does not:


static $mypass = 0;
	function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0 ) {
var_dump( self::$mypass, $item->classes );
var_dump( is_array( $item->classes ) );
var_dump( is_array( (array) $item->classes ) );
$myvar1 = $item->classes;
$myvar2 = (array) $item->classes;
var_dump( is_array( $myvar1 ) );		
if ( 0 == self::$mypass++ ) {			// It doesn't matter, if the "is_array" only executes once.
	var_dump( is_array( $myvar2 ) );	// This will trigger the crash LATER in the code.
//	die( 'x');							// It will NOT crash, if the code stops here.
}

PS: the size of the array is small, only a handful of short strings:

array (size=6)
  0 => string '' (length=0)
  1 => string 'menu-item' (length=9)
  2 => string 'menu-item-type-taxonomy' (length=23)
  3 => string 'menu-item-object-category' (length=25)
  4 => string 'align-bottom-left' (length=17)
  5 => string 'menu-flyout' (length=11)

Could you please provide the full source code of the relevant file? (To nikic@php.net if not public.) This sounds like an optimization bug.

Not sure if I had made that clear enough: the crash occurs in a plug-in of the WordPress CMS. So, it's not just a simple single PHP file.
Here the link to the plug in (there is the download link):
https://wordpress.org/plugins/megamenu/#installation
The particular code section is in "walker.class.php".

Also I have created an "out of the box" WordPress debug site, with that plug-in loaded, to which I can supply FTP access if that would be helpful at all.

Converting

#230.T15 [bool] = TYPE_CHECK (array) #47.CV7($classes) [array of [any, ref]]

to

FREE #47.CV7($classes) [array of [any, ref]]