Fix GH-16572: Incorrect result with reflection in low-trigger JIT

[nielsdos]

When a recursive call happens with invalid arguments, the maximum valid arguments are computed and stored in num_args, but the RECV entry block we jump to is call_num_args instead. This can skip argument validation checks. Fix this by using num_args instead.

[dstogov]

The fix looks right.
I have no idea why this bug was introduced during switching to IR.

Probably call_num_args also should be replaced to num_args on line 10178

-					if (!trace && op_array == &func->op_array && call_num_args >= op_array->required_num_args) {
+					if (!trace && op_array == &func->op_array && num_args >= op_array->required_num_args) {

[dstogov]

It's better to initialize it to avoid warnings.

[nielsdos]

The fix looks right. I have no idea why this bug was introduced during switching to IR.

It seems JIT in 8.3 and below just don't do the call->jmp optimization.

Probably call_num_args also should be replaced to num_args on line 10178

-					if (!trace && op_array == &func->op_array && call_num_args >= op_array->required_num_args) {
+					if (!trace && op_array == &func->op_array && num_args >= op_array->required_num_args) {

Unless I misunderstand the code, I don't think this is right.
My understand is that: call_num_args is the number of passed arguments, while num_args is the number of arguments that are definitely valid and don't need argument validation. We can do the call->jmp optimization even if not all arguments are valid.

Consider the following code sample, modified from the test in the PR:

<?php
function dumpType(int $x, ReflectionType $rt) {
    dumpType(1, null);
}
function test1(): int { }
dumpType(0, (new ReflectionFunction('test1'))->getReturnType());

I added an int parameter. This is valid, so num_args is 1 and call_num_args is 2. If I make your suggested change, then the recursive call will actually be a call instead of a jmp into the entry. When I keep the code like it is now, it results in this assembly:

JIT$dumpType:
	cmpl $1, 0x2c(%r14) ; argument count check
	jl .L8
	cmpb $4, 0x58(%r14) ; type check for first argument to be IS_LONG
	jne .L6
.ENTRY_1:
	cmpl $2, 0x2c(%r14) ; argument count check
	jl .L7
; ... etc

.L1:
; (...) a lot of code
	leaq EG(current_execute_data)(%rip), %rax
	movq %r15, (%rax)
	movq %r15, %r14
	leaq -0x77288ef(%rip), %r15
	jmp .ENTRY_1 ; call->jmp optimization, we can skip first argument check but not second one

This seems right to me unless I miss something.

[dstogov]

This seems right to me unless I miss something.

You are right. Please merge this as is.