[lazerg]

zend_get_known_class() follows ce->parent for parent:: without checking ZEND_ACC_LINKED, so for a class whose parent lives in another file it reads parent_name as a class entry. The check after it rarely saves us: the persisted string has refcount 2, so type reads as ZEND_USER_CLASS, and once the interned strings buffer is full the string is copied into the script's own shm, where the word at info.user.filename can be this script's filename. Then zend_hash_find() runs on garbage. The fix checks the flag first, like the optimizer already does. The test uses opcache.interned_strings_buffer=0 to get the same layout and segfaults without the fix.

Fixes #25253

[iliaal]

LGTM

[LamentXU123]

Understandable edge cases ig. Before I click the merge button I want to hear from Nora.

[ndossche]

Yeah normally in these places for the JIT/Optimizer we check for the linked flag, but apparently this was forgotten here