Fix JIT call chain check without call opcode

The do_fcall opcode may have been optimized away if an opcode like
exit is present in the arguments. In that case the opcode scan
would go past the end of the op array.

Author: nikic

ext/opcache/jit/zend_jit.c

@@ -435,7 +435,8 @@ static int zend_jit_needs_call_chain(zend_call_info *call_info, uint32_t b, cons
 	} else {
 		const zend_op *end = call_info->caller_call_opline;
 
-		if (end - op_array->opcodes >= ssa->cfg.blocks[b].start + ssa->cfg.blocks[b].len) {
+		/* end may be null if an opcode like EXIT is part of the argument list. */
+		if (!end || end - op_array->opcodes >= ssa->cfg.blocks[b].start + ssa->cfg.blocks[b].len) {
 			/* INIT_FCALL and DO_FCALL in different BasicBlocks */
 			return 1;
 		}

ext/opcache/tests/jit/call_chain_exit.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Exit in argument list
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+var_dump(exit);
+?>
+--EXPECT--