Fix segfault in JIT

[realFlowControl]

This PR saves the opline, as otherwise it can be a dangling pointer

[dstogov]

Hi, can you demonstrate the problem with a test case?

[morrisonlevi]

No easy reproducer at this time. The issue is happening with Datadog's allocation profiler. We're working on verifying the issue manually with the customer which hit the issue.

The rough idea at this time: if this path is taken, and allocations start happening then the profiler may gather a sample. Then we read a bad opline when walking the stack and collecting file and line information.

[dstogov]

@arnaud-lb doesn't this look similar to the problem you are fixing in #18297
@realFlowControl @morrisonlevi can you check the fix from that PR.

[arnaud-lb]

@dstogov I think this is a different issue.

This looks similar the classic issue where emitting an error from the allocator crashes because EX(opline) is not initialized (we crash when fetching the file/line for the error message). The usual fix is to save opline in op handlers that may allocate.

In this case the op handler is zend_jit_func_counter_helper() or zend_jit_loop_counter_helper(), which call zend_jit_hot_func(), so saving opline there seems fine.

For zend_jit_trace_counter_helper() we save in zend_jit_trace_hot_root() (here).

[dstogov]

OK. You convinced me. Approved.

[arnaud-lb]

Thank you @realFlowControl!