We have seen crashes in calls to zend_jit_status() purely in Apache mod_php environments. The only place where I could possibly see something could crash is the dereference of dasm_ptr in:

• JIT is enabled and active
• Apache with mod_php handling requests
• callling apache2ctl graceful will trigger a MSHUTDOWN -> MINIT in the same process
• JIT goes through accel_post_startup() again and for "reasons" does not call zend_jit_startup().
  This leaves dasm_ptr, dasm_buf, dasm_end and dasm_size with dangling values.

Those reasons could be:

• INI file changes on disk while Apache is running (flipping opcache.jit from tracing to disable/off)
• an extension registering user opcode handlers after accel_post_startup() was run

How to reproduce:

• run docker image php:apache
• enable JIT and start using apache2-foreground
• add a index.php file serving var_dump(opcache_get_status())
• you see that ['jit']['buffer_size'] is a non-0 integer and JIT enabled
• disable JIT in INI file and exec apache2ctl graceful
• send another request to that server:

  ["jit"]=>
  array(7) {
    ["enabled"]=>
    bool(false)
    ["on"]=>
    bool(false)
    ["kind"]=>
    int(0)
    ["opt_level"]=>
    int(0)
    ["opt_flags"]=>
    int(0)
    ["buffer_size"]=>
    int(67108848)
    ["buffer_free"]=>
    int(281473177354224)
  }

Now JIT is disabled, but still has a size and buffer_free is "huge" suggesting uninitialised memory.