Fix use-of-uninitialized-value in zend_get_arg_offset_by_name()

[iluuu1994]

Don't access fbc->op_array.refcount on internal function. Don't attempt to cache ZEND_ACC_USER_ARG_INFO at all, which is only used in zend_get_closure_invoke_method(). This may reuse arg_info from a temporary closure, and hence caching would also be unsafe.

See https://github.com/php/php-src/actions/runs/17751635609/job/50447500518.
Introduced in #19654.

[iluuu1994]

Hmm, actually I guess this also needs a fix for the if (fbc->common.fn_flags & ZEND_ACC_VARIADIC) { branch. I suppose we could just check for ZEND_ACC_USER_ARG_INFO there.

Edit: I don't think this should be necessary. zend_get_closure_invoke_method() will only be called with an empty dummy cache slot from what I can see.

[arnaud-lb]

No you were right, I think you need to check for ZEND_ACC_USER_ARG_INFO in the variadic case as well. The cache slot is from the caller:

function invoke($closure) {
    $closure->__invoke(a: 1);
}
invoke(eval('return function(...$a) { var_dump($a); };'));
invoke(eval('return function(...$b) { var_dump($b); };'));

[iluuu1994]

You're right. There are two calls to zend_handle_named_arg(), once from the VM for the call to Closure::__invoke(), and one from zend_call_function() (where the cache slot is empty). Somehow I missed the first call yesterday, and only considered the second one.

[iluuu1994]

@arnaud-lb Check again please. 🙂

[iluuu1994]

Thanks for catching this. Hopefully it's ok now.

[arnaud-lb]

Looks good to me!