Fix callable invalidation during autoloading#22688
Open
PuH4ck3rX wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Autoloading can execute user code while a callable is being resolved. The dynamic-call helpers and the common callable resolver kept borrowed pointers into the original callable across that boundary. If the autoloader modified or released the callable, the subsequent method lookup could read freed or retyped values.
This change snapshots the relevant class and method strings before class lookup can invoke autoloading. For direct Class::method dynamic calls, the method name is also extracted before entering the autoloader. The same lifetime rule is applied to zend_is_callable_at_frame(), covering both array and string callables used by APIs such as is_callable() and call_user_func().
The regression tests use deterministic callable mutation during autoloading and verify that the callable value captured at the start of resolution is used for the current call.
Checks performed: