JIT: segfault with opcache.jit=1201 when a hooked property is passed to a run-time-resolved function #24398

With the function JIT at level 1 (opcache.jit=1201), passing a property with a get hook as an argument to a function that is only known at run time (declared inside an if, or a global function called unqualified from a namespace) crashes on the second call.

<?php
class Hook { public $p { get => 5; } }
if (true) { function take($x) { return $x; } }
function f($o) { return take($o->p); }
$h = new Hook;
f($h);
f($h);

php -n -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d opcache.jit=1201 red.php

On a UBSan build:

Zend/zend_vm_execute.h:30099:7: runtime error: applying non-zero offset 18446744073709551615 to null pointer
    #0 0x55637faec8c4 in ZEND_SEND_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER Zend/zend_vm_execute.h:30099

I expected no output, which is what opcache.jit=disable gives for the same script.

It reproduces at 17b6575 (the latest upstream I checked): the UBSan build reports the error above, the release build segfaults (exit 139, signal 11). It only happens at JIT optimization level 1: 1201, 1211, 1101 and 1251 crash; 1202, 1205, 1254 and tracing do not.

Looks like zend_jit() in ext/opcache/jit/zend_jit.c: for the level-1 path only ZEND_FETCH_OBJ_R checks whether the VM handler entered a simple hook frame, while ZEND_FETCH_OBJ_FUNC_ARG goes through the plain zend_jit_handler path and the JIT code continues with the next opline (SEND_FUNC_ARG). This looks like the level-1 counterpart of GH-21006 / GH-22857.

I can send a patch if that helps.

Found with an LLM-based testing tool; I used Claude to reduce it and look for the cause.