[php-src] Issue #21006: JIT has wrong expectations for ZEND_FETCH_OBJ_FUNC_ARG when the prop is hooked

[email protected] (arnaud-lb)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/21006
Author: arnaud-lb

### Description

The following code:

```php
namespace Test;

class C
{
    public $prop {
        get => 'sha256';
    }

    public function sign()
    {
        return hash_hmac(
            algo: $this->prop,
            data: '',
            key: '',
        );
    }
}

$obj = new C();
for ($i = 0; $i < 2; $i++) {
    $obj->sign('test');
}
```

When executed with
```
php -n -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_hot_loop=1 test.php
```

Results in
```
Program received signal SIGSEGV, Segmentation fault.
0x0000000000d3ea39 in zend_handle_named_arg (call_ptr=0x7ffff3e18168, arg_name=0xac002e000, arg_num_ptr=0x7fffffffaf84, cache_slot=0x8000f3e0779f) at Zend/zend_execute.c:5515
5515		zend_function *fbc = call->func;
(gdb) bt
#0  0x0000000000d3ea39 in zend_handle_named_arg (call_ptr=0x7ffff3e18168, arg_name=0xac002e000, arg_num_ptr=0x7fffffffaf84, cache_slot=0x8000f3e0779f) at Zend/zend_execute.c:5515
#1  0x0000000000d7cbb9 in ZEND_SEND_FUNC_ARG_SPEC_VAR_CONST_HANDLER () at Zend/zend_vm_execute.h:26393
#2  0x000000000ac00b3f in TRACE-1$test.php$22 () at unknown:1
#3  0x0000000000dbfec9 in zend_execute (op_array=0x0, return_value=0x7ffff3e761c0) at Zend/zend_vm_execute.h:121866
```

The cause seems to be that `ZEND_FETCH_OBJ_FUNC_ARG` may push a new call frame (when the hook is marked as SIMPLE_GET), but `zend_jit_trace_handler()` doesn't expect that, so the JIT trace continues execution with the wrong call frame.

In the reproducer, we call `ZEND_FETCH_OBJ_FUNC_ARG` for `$this->prop` from `TRACE-1$test.php$22`, which pushes a stack frame for a call to `Test\C::$prop::get`, and returns. The trace calls `ZEND_SEND_FUNC_ARG` for `algo: $this->prop`, and crashes when accessing `EX(call)->func` because `EX(call)` is null.

The crash was discovered by @TimWolla.

### PHP Version

```plain
PHP 8.5
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.