Fix GH-17626: JIT corrupts opline handler when blacklisting root trace

When a trace exits through a ZEND_JIT_EXIT_INVALIDATE guard while
ZEND_JIT_TRACE_NUM has already reached opcache.jit_max_root_traces,
zend_jit_trace_exit() blacklists the root trace and restores the
original VM handler. It wrote that handler to the exit opline (the
INIT_* opline whose callee guard failed) instead of the root trace's
start opline. The opcodes live in SHM, so every worker keeps executing
the foreign handler until restart.

For a root trace that starts at the entry of a function with typed
parameters the copied handler is ZEND_RECV, which then runs on an
INIT_FCALL / INIT_STATIC_METHOD_CALL opline and raises
"Too few arguments to function X(), N passed ... and exactly N expected"
from a frame that has all its arguments. Other root oplines lead to
crashes instead.

Introduced by 350af54 (GH-14475).

Closes GH-23571.

Author: RV7PR

NEWS

@@ -9,6 +9,9 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property
     hook with minimal tracing JIT). (ndossche)
+  . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
+    root trace at the opcache.jit_max_root_traces limit, causing spurious
+    "Too few arguments" errors and crashes). (RV7PR)
 
 - SOAP:
   . Fixed use of uninitialized func in do_request() on OOM bailout.

ext/opcache/jit/zend_jit_trace.c

@@ -8788,7 +8788,7 @@ int ZEND_FASTCALL zend_jit_trace_exit(uint32_t exit_num, zend_jit_registers_buf
 				SHM_UNPROTECT();
 				zend_jit_unprotect();
 
-				((zend_op*)opline)->handler =
+				((zend_op*)(t->opline))->handler =
 					ZEND_OP_TRACE_INFO(t->opline, jit_extension->offset)->orig_handler;
 
 				ZEND_OP_TRACE_INFO(t->opline, jit_extension->offset)->trace_flags &= ~ZEND_JIT_TRACE_JITED;

ext/opcache/tests/jit/gh17626.inc

@@ -0,0 +1,2 @@
+<?php
+function gh17626_callee(string $s) { return strtoupper($s); }

ext/opcache/tests/jit/gh17626.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GH-17626: Opline handler corrupted when a root trace is blacklisted at the max_root_traces limit (fails with --repeat 2)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.revalidate_freq=0
+opcache.jit=tracing
+opcache.jit_buffer_size=16M
+opcache.jit_hot_func=2
+opcache.jit_hot_loop=255
+opcache.jit_hot_return=255
+opcache.jit_hot_side_exit=255
+opcache.jit_max_root_traces=2
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+namespace GH17626;
+
+// In --repeat 2 the callee is recompiled after the first run, so the function
+// guard in the trace compiled for caller() fails with ZEND_JIT_EXIT_INVALIDATE.
+
+require __DIR__ . '/gh17626.inc';
+
+function caller(string $s) {
+    return gh17626_callee($s) . $s;
+}
+
+caller('a');
+caller('a');
+caller('a');
+echo caller('a'), "\n";
+echo caller('b'), "\n";
+
+touch(__DIR__ . '/gh17626.inc');
+opcache_invalidate(__DIR__ . '/gh17626.inc', true);
+?>
+--EXPECT--
+Aa
+Bb

ext/opcache/tests/jit/gh17626_002.inc

@@ -0,0 +1,2 @@
+<?php
+class GH17626GrandParent {}

ext/opcache/tests/jit/gh17626_002.phpt

@@ -0,0 +1,47 @@
+--TEST--
+GH-17626: Opline handler corrupted when a root trace is blacklisted at the max_root_traces limit
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_buffer_size=16M
+opcache.jit_hot_func=2
+opcache.jit_hot_loop=255
+opcache.jit_hot_return=255
+opcache.jit_hot_side_exit=255
+opcache.jit_max_root_traces=2
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+require __DIR__ . '/gh17626_002.inc';
+
+class ParentA extends GH17626GrandParent { public static function m() { return 'A'; } }
+class ParentB extends GH17626GrandParent { public static function m() { return 'B'; } }
+
+trait T {
+    public function run(string $s) {
+        return parent::m() . $s;
+    }
+}
+
+class A extends ParentA { use T; }
+class B extends ParentB { use T; }
+
+$a = new A;
+$b = new B;
+
+$a->run('x');
+$a->run('x');
+$a->run('x');
+echo $a->run('x'), "\n";
+echo $b->run('y'), "\n";
+echo $b->run('y'), "\n";
+echo $a->run('x'), "\n";
+?>
+--EXPECT--
+Ax
+By
+By
+Ax