JIT: Fixed incorrect named parameter handling

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -4759,6 +4759,10 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 						}
 						goto done;
 					case ZEND_CHECK_UNDEF_ARGS:
+						if (JIT_G(current_frame)
+						 && JIT_G(current_frame)->call) {
+							TRACE_FRAME_SET_UNKNOWN_NUM_ARGS(JIT_G(current_frame)->call);
+						}
 						if (!zend_jit_check_undef_args(&dasm_state, opline)) {
 							goto jit_failure;
 						}

ext/opcache/tests/jit/send_var_ex_002.phpt

@@ -0,0 +1,23 @@
+--TEST--
+JIT SEND_VAR_EX may leak with named args
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+for ($i = 0; $i < 3; $i++ ) {
+	$x = 0;
+	test(a: $x);
+	var_dump($x);
+}	
+
+function test(&$a = null, SomeType &$b = null) {
+    $a++;
+}
+?>
+--EXPECT--
+int(1)
+int(1)
+int(1)