hwiwonl/BenchDyne_Lite huggingface dataset:
Repository: mruby/mruby
Fuzzing engine: libfuzzer
Fuzz target: mruby_fuzzer
Sanitizer: memory
Crash type: UNKNOWN READ

Sanitizer report:
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3771451620
INFO: Loaded 1 modules   (17162 inline 8-bit counters): 17162 [0x561f59c50a50, 0x561f59c54d5a), 
INFO: Loaded 1 PC tables (17162 PCs): 17162 [0x561f59c54d60,0x561f59c97e00), 
/out/mruby_fuzzer: Running 1 inputs 1 time(s) each.
Running: /testcase/OSV-2020-739.poc
MemorySanitizer:DEADLYSIGNAL
==7==ERROR: MemorySanitizer: SEGV on unknown address 0x000000002a86 (pc 0x561f599a77ed bp 0x7ffcb7313510 sp 0x7ffcb73134d0 T7)
==7==The signal is caused by a READ memory access.
    #0 0x561f599a77ed in str_decref /src/mruby/src/string.c:241:17
    #1 0x561f599a77ed in mrb_gc_free_str /src/mruby/src/string.c:263:5
    #2 0x561f59acb5a3 in obj_free /src/mruby/src/gc.c:864:5
    #3 0x561f59ac6cc6 in free_heap /src/mruby/src/gc.c:421:9
    #4 0x561f59ac6cc6 in mrb_gc_destroy /src/mruby/src/gc.c:430:3
    #5 0x561f599a67e1 in mrb_close /src/mruby/src/state.c:172:3
    #6 0x561f599a54ae in LLVMFuzzerTestOneInput /src/mruby/oss-fuzz/mruby_fuzzer.c:15:5
    #7 0x561f5989b3f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #8 0x561f59886665 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #9 0x561f5988c0ff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #10 0x561f598b73a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #11 0x7fa22302a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
    #12 0x561f5987e84d in _start (/out/mruby_fuzzer+0xab84d)

DEDUP_TOKEN: str_decref--mrb_gc_free_str--obj_free
MemorySanitizer can not provide additional info.
SUMMARY: MemorySanitizer: SEGV /src/mruby/src/string.c:241:17 in str_decref
==7==ABORTING


Fix patch:
diff --git a/src/string.c b/src/string.c
index b69a39df8..251e00628 100644
--- a/src/string.c
+++ b/src/string.c
@@ -820,6 +820,7 @@ mrb_str_modify_keep_ascii(mrb_state *mrb, struct RString *s)
     if (shared->refcnt == 1 && s->as.heap.ptr == shared->ptr) {
       s->as.heap.aux.capa = shared->capa;
       s->as.heap.ptr[s->as.heap.len] = '\0';
+      RSTR_UNSET_SHARED_FLAG(s);
       mrb_free(mrb, shared);
     }
     else {
Repository: php/php-src
Fuzzing engine: honggfuzz
Fuzz target: php-fuzz-tracing-jit
Sanitizer: address
Crash type: Segv on unknown address

Sanitizer report:
Accepting input from '/testcase/OSV-2022-41.poc'
Usage for fuzzing: honggfuzz -P [flags] -- /out/php-fuzz-tracing-jit
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000494aeb26 bp 0x7fffa05a2210 sp 0x7fffa05a21a0 T0)
==7==The signal is caused by a READ memory access.
==7==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
SCARINESS: 20 (wild-addr-read)
/usr/local/bin/llvm-symbolizer: error: '/dev/zero (deleted)': No such file or directory
    #0 0x494aeb26  (/dev/zero (deleted)+0x8000b26)
    #1 0x55b04be53c12 in zend_execute /src/php-src/Zend/zend_vm_execute.h:59760:2
    #2 0x55b04c1fbddc in fuzzer_do_request_from_buffer /src/php-src/sapi/fuzzer/fuzzer-sapi.c:276:5
    #3 0x55b04c1fa61e in LLVMFuzzerTestOneInput /src/php-src/sapi/fuzzer/fuzzer-tracing-jit.c:46:3
    #4 0x55b04c1fce9f in main (/out/php-fuzz-tracing-jit+0xffce9f)

DEDUP_TOKEN: zend_execute--fuzzer_do_request_from_buffer
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/dev/zero (deleted)+0x8000b26) 
==7==ABORTING


Fix patch:
diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
index 62395640ff..5bf0275944 100644
--- a/ext/opcache/jit/zend_jit_x86.dasc
+++ b/ext/opcache/jit/zend_jit_x86.dasc
@@ -6130,7 +6130,7 @@ static int zend_jit_simple_assign(dasm_State    **Dst,
 				if (tmp_reg == ZREG_R0) {
 					|	IF_NOT_REFCOUNTED ah, >3
 				} else {
-					|	IF_NOT_FLAGS Rd(tmp_reg), IS_TYPE_REFCOUNTED, >3
+					|	IF_NOT_FLAGS Rd(tmp_reg), (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT), >3
 				}
 				|	GET_ZVAL_PTR Ra(tmp_reg), var_addr
 
@@ -6145,7 +6145,7 @@ static int zend_jit_simple_assign(dasm_State    **Dst,
 					if (tmp_reg == ZREG_R0) {
 						|	IF_NOT_REFCOUNTED ah, >2
 					} else {
-						|	IF_NOT_FLAGS Rd(tmp_reg), IS_TYPE_REFCOUNTED, >2
+						|	IF_NOT_FLAGS Rd(tmp_reg), (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT), >2
 					}
 					|	GET_ZVAL_PTR Ra(tmp_reg), var_addr
 					|	GC_ADDREF Ra(tmp_reg)
diff --git a/ext/opcache/tests/jit/assign_dim_009.phpt b/ext/opcache/tests/jit/assign_dim_009.phpt
new file mode 100644
index 0000000000..bea28098a5
--- /dev/null
+++ b/ext/opcache/tests/jit/assign_dim_009.phpt
@@ -0,0 +1,14 @@
+--TEST--
+JIT ASSIGN_DIM: 009
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+$y[] = $r = &$G;
+?>
+DONE
+--EXPECT--
+DONE