Ignore scope when compiling closure in non-tracing jit

Author: arnaud-lb

ext/opcache/jit/zend_jit.c

@@ -1286,6 +1286,8 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 	bool ce_is_instanceof;
 	bool on_this;
 
+	ZEND_ASSERT(!(op_array->fn_flags & ZEND_ACC_CLOSURE) || !(op_array->scope));
+
 	if (JIT_G(bisect_limit)) {
 		jit_bisect_pos++;
 		if (jit_bisect_pos >= JIT_G(bisect_limit)) {
@@ -2834,6 +2836,17 @@ static int zend_real_jit_func(zend_op_array *op_array, zend_script *script, cons
 	/* Build SSA */
 	memset(&ssa, 0, sizeof(zend_ssa));
 
+	if (op_array->fn_flags & ZEND_ACC_CLOSURE) {
+		if (JIT_G(trigger) == ZEND_JIT_ON_FIRST_EXEC ||
+			JIT_G(trigger) == ZEND_JIT_ON_PROF_REQUEST ||
+			JIT_G(trigger) == ZEND_JIT_ON_HOT_COUNTERS) {
+			zend_jit_op_array_extension_common *jit_extension = (zend_jit_op_array_extension_common*)ZEND_FUNC_INFO(op_array);
+			op_array = (zend_op_array*) jit_extension->op_array;
+		} else {
+			ZEND_ASSERT(!op_array->scope);
+		}
+	}
+
 	if (zend_jit_op_array_analyze1(op_array, script, &ssa) != SUCCESS) {
 		goto jit_failure;
 	}
@@ -3051,6 +3064,7 @@ static int zend_jit_setup_hot_counters(zend_op_array *op_array)
 	}
 	memset(&jit_extension->func_info, 0, sizeof(zend_func_info));
 	jit_extension->func_info.flags = ZEND_FUNC_JIT_ON_HOT_COUNTERS;
+	jit_extension->op_array = op_array;
 	jit_extension->counter = &zend_jit_hot_counters[zend_jit_op_array_hash(op_array) & (ZEND_HOT_COUNTERS_COUNT - 1)];
 	for (i = 0; i < op_array->last; i++) {
 		jit_extension->orig_handlers[i] = op_array->opcodes[i].handler;
@@ -3095,6 +3109,7 @@ int zend_jit_op_array(zend_op_array *op_array, zend_script *script)
 		}
 		memset(&jit_extension->func_info, 0, sizeof(zend_func_info));
 		jit_extension->func_info.flags = ZEND_FUNC_JIT_ON_FIRST_EXEC;
+		jit_extension->op_array = op_array;
 		jit_extension->orig_handler = (void*)opline->handler;
 		ZEND_SET_FUNC_INFO(op_array, (void*)jit_extension);
 		opline->handler = (const void*)zend_jit_runtime_jit_handler;
@@ -3124,6 +3139,7 @@ int zend_jit_op_array(zend_op_array *op_array, zend_script *script)
 			}
 			memset(&jit_extension->func_info, 0, sizeof(zend_func_info));
 			jit_extension->func_info.flags = ZEND_FUNC_JIT_ON_PROF_REQUEST;
+			jit_extension->op_array = op_array;
 			jit_extension->orig_handler = (void*)opline->handler;
 			ZEND_SET_FUNC_INFO(op_array, (void*)jit_extension);
 			opline->handler = (const void*)zend_jit_profile_jit_handler;

ext/opcache/jit/zend_jit_internal.h

@@ -121,8 +121,15 @@ static zend_always_inline bool zend_jit_same_addr(zend_jit_addr addr1, zend_jit_
 	return 0;
 }
 
+typedef struct _zend_jit_op_array_extension_common {
+	zend_func_info func_info;
+	const zend_op_array *op_array;
+} zend_jit_op_array_extension_common;
+
 typedef struct _zend_jit_op_array_extension {
+	/* zend_jit_op_array_extension_common */
 	zend_func_info func_info;
+	const zend_op_array *op_array;
 	const void *orig_handler;
 } zend_jit_op_array_extension;
 
@@ -159,7 +166,9 @@ static zend_always_inline zend_long zend_jit_hash(const void *ptr)
 void ZEND_FASTCALL zend_jit_hot_func(zend_execute_data *execute_data, const zend_op *opline);
 
 typedef struct _zend_jit_op_array_hot_extension {
+	/* zend_jit_op_array_extension_common */
 	zend_func_info func_info;
+	const zend_op_array *op_array;
 	int16_t    *counter;
 	const void *orig_handlers[1];
 } zend_jit_op_array_hot_extension;
@@ -333,6 +342,7 @@ typedef union _zend_op_trace_info {
 } zend_op_trace_info;
 
 typedef struct _zend_jit_op_array_trace_extension {
+	/* zend_jit_op_array_extension_common */
 	zend_func_info func_info;
 	const zend_op_array *op_array;
 	size_t offset; /* offset from "zend_op" to corresponding "op_info" */

ext/opcache/tests/gh16186.phpt

@@ -0,0 +1,38 @@
+--TEST--
+GH-16186 (Non-tracing JIT uses Closure scope)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=64M
+opcache.jit=0234
+opcache.file_update_protection=0
+opcache.revalidate_freq=0
+opcache.protect_memory=1
+--FILE--
+<?php
+
+class A {
+    private $x;
+    public function getIncrementor() {
+        return function() { $this->x++; };
+    }
+}
+$a = new A();
+$f = $a->getIncrementor();
+$c = new stdClass();
+$f();
+$f2 = Closure::bind($f, $c);
+$f2();
+$f2();
+
+var_dump($c);
+
+?>
+--EXPECTF--
+Warning: Undefined property: stdClass::$x in %s on line %d
+object(stdClass)#%d (1) {
+  ["x"]=>
+  int(2)
+}