From 91b3b58f7128f50cdd91266261a7562c04fe6ef6 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Fri, 25 Nov 2022 14:02:45 +0100
Subject: [PATCH 1/3] Do not resolve constants on non-linked class during
 preloading (#9975)

Fixes GH-9968
---
 ext/opcache/ZendAccelerator.c  |  2 +-
 ext/opcache/tests/gh9968-1.inc |  3 +++
 ext/opcache/tests/gh9968-2.inc | 15 +++++++++++++++
 ext/opcache/tests/gh9968.phpt  | 27 +++++++++++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 ext/opcache/tests/gh9968-1.inc
 create mode 100644 ext/opcache/tests/gh9968-2.inc
 create mode 100644 ext/opcache/tests/gh9968.phpt

diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index ed38d9a0e58..e5d7f650045 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -3975,7 +3975,7 @@ static void preload_link(void)
 			if (ce->type == ZEND_INTERNAL_CLASS) {
 				break;
 			}
-			if (!(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
+			if ((ce->ce_flags & ZEND_ACC_LINKED) && !(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
 				if (!(ce->ce_flags & ZEND_ACC_TRAIT)) { /* don't update traits */
 					CG(in_compilation) = 1; /* prevent autoloading */
 					if (preload_try_resolve_constants(ce)) {
diff --git a/ext/opcache/tests/gh9968-1.inc b/ext/opcache/tests/gh9968-1.inc
new file mode 100644
index 00000000000..468178c7848
--- /dev/null
+++ b/ext/opcache/tests/gh9968-1.inc
@@ -0,0 +1,3 @@
+<?php
+
+opcache_compile_file('ext/opcache/tests/gh9968-2.inc');
diff --git a/ext/opcache/tests/gh9968-2.inc b/ext/opcache/tests/gh9968-2.inc
new file mode 100644
index 00000000000..a280f2717f2
--- /dev/null
+++ b/ext/opcache/tests/gh9968-2.inc
@@ -0,0 +1,15 @@
+<?php
+
+class Root1_Constant_Definer
+{
+    const CONSTANT = 'value';
+}
+
+class Root1_Constant_Empty
+{
+}
+
+class Root1_Constant_Referencer extends Root2_Empty_Empty
+{
+    protected $propertyReferencingAnExternalConstant = Root1_Constant_Definer::CONSTANT;
+}
diff --git a/ext/opcache/tests/gh9968.phpt b/ext/opcache/tests/gh9968.phpt
new file mode 100644
index 00000000000..4beb39d1334
--- /dev/null
+++ b/ext/opcache/tests/gh9968.phpt
@@ -0,0 +1,27 @@
+--TEST--
+GH-9968: Preload crash on non-linked class
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.preload={PWD}/gh9968-1.inc
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+
+new Root1_Constant_Referencer();
+
+?>
+==DONE==
+--EXPECTF--
+Warning: Can't preload unlinked class Root1_Constant_Referencer: Unknown parent Root2_Empty_Empty in %s on line %d
+
+Fatal error: Uncaught Error: Class "Root1_Constant_Referencer" not found in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

From 4987e65a70402e889d5eefa59631140e0c7abdfe Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Fri, 25 Nov 2022 14:07:30 +0100
Subject: [PATCH 2/3] [ci skip] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 09bdcbe47d6..8fcebc3e650 100644
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in
     PHP8.1). (Nathan Freeman)
 
+- Opcache:
+  . Fixed bug GH-9968 (Segmentation Fault during OPCache Preload).
+    (Arnaud, michdingpayc)
+
 - OpenSSL:
   . Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec).
     (Jakub Zelenka)

From 772bb62526158badf9042e9585e8a28676b76a67 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Fri, 25 Nov 2022 14:37:43 +0100
Subject: [PATCH 3/3] [ci skip] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 6e0301566dd..a24d85fbf1a 100644
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in
     PHP8.1). (Nathan Freeman)
 
+- Opcache:
+  . Fixed bug GH-9968 (Segmentation Fault during OPCache Preload).
+    (Arnaud, michdingpayc)
+
 - OpenSSL:
   . Fixed bug GH-9997 (OpenSSL engine clean up segfault). (Jakub Zelenka)
   . Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec).