Fixed bug #78986

Don't assume that handlers live in the arena, they may also be in
SHM.

Author: nikic

NEWS

@@ -14,6 +14,8 @@ PHP                                                                        NEWS
   . Fixed bug #78950 (Preloading trait method with static variables). (Nikita)
   . Fixed bug #78903 (Conflict in RTD key for closures results in crash).
     (Nikita)
+  . Fixed bug #78986 (Opcache segfaults when inheriting ctor from immutable
+    into mutable class). (Nikita)
 
 - Spl:
   . Fixed bug #78976 (SplFileObject::fputcsv returns -1 on failure). (cmb)

ext/opcache/tests/bug78986.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #78986: Opcache segfaults when inheriting ctor from immutable into mutable class
+--FILE--
+<?php
+
+define('TEST_TEST', 1);
+
+class TestClass2 {
+    function __construct() {}
+}
+
+class TestClass extends TestClass2 {
+    var $test = [
+        TEST_TEST => 'test'  
+    ];
+}
+
+var_dump(new TestClass());
+
+?>
+--EXPECT--
+object(TestClass)#1 (1) {
+  ["test"]=>
+  array(1) {
+    [1]=>
+    string(4) "test"
+  }
+}

ext/opcache/zend_accelerator_util_funcs.c

@@ -246,7 +246,7 @@ static void zend_hash_clone_prop_info(HashTable *ht)
 
 #define zend_update_inherited_handler(handler) \
 { \
-	if (ce->handler != NULL) { \
+	if (ce->handler != NULL && IN_ARENA(ce->handler)) { \
 		ce->handler = ARENA_REALLOC(ce->handler); \
 	} \
 }