From b839c5f1af68f366fbb66651e0b4821d76eb3fcb Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 26 Aug 2024 17:22:04 +0200
Subject: [PATCH] Fix building of callgraph including preloaded symbols
 (GH-15545)

This issue was introduced in GH-15021. When building the call graph, we can now
see preloaded functions. However, building the call graph involves adding the
function to the caller list of the callee, which we don't want to do for
functions not coming from the script.

Fixes GH-15490
---
 NEWS                               |  4 ++++
 Zend/Optimizer/zend_call_graph.c   |  3 ++-
 ext/opcache/tests/jit/gh15490.inc  |  9 +++++++++
 ext/opcache/tests/jit/gh15490.phpt | 20 ++++++++++++++++++++
 4 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 ext/opcache/tests/jit/gh15490.inc
 create mode 100644 ext/opcache/tests/jit/gh15490.phpt

diff --git a/NEWS b/NEWS
index 19a6e7045c7..df968d86ccb 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
     Kamil Tekiela)
 
+- Opcache:
+  . Fixed bug GH-15490 (Building of callgraph modifies preloaded symbols).
+    (ilutov)
+
 - PDO_MYSQL:
   . mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT. (Appla)
 
diff --git a/Zend/Optimizer/zend_call_graph.c b/Zend/Optimizer/zend_call_graph.c
index abd5dac5331..8a2f8ea2a7e 100644
--- a/Zend/Optimizer/zend_call_graph.c
+++ b/Zend/Optimizer/zend_call_graph.c
@@ -79,7 +79,8 @@ ZEND_API void zend_analyze_calls(zend_arena **arena, zend_script *script, uint32
 
 					if (build_flags & ZEND_CALL_TREE) {
 						call_info->next_caller = NULL;
-					} else if (func->type == ZEND_INTERNAL_FUNCTION) {
+					} else if (func->type == ZEND_INTERNAL_FUNCTION
+					 || func->op_array.filename != script->filename) {
 						call_info->next_caller = NULL;
 					} else {
 						zend_func_info *callee_func_info = ZEND_FUNC_INFO(&func->op_array);
diff --git a/ext/opcache/tests/jit/gh15490.inc b/ext/opcache/tests/jit/gh15490.inc
new file mode 100644
index 00000000000..e702a9e2440
--- /dev/null
+++ b/ext/opcache/tests/jit/gh15490.inc
@@ -0,0 +1,9 @@
+<?php
+
+function foo() {
+    bar();
+}
+
+function bar() {
+    echo 'Hello world!';
+}
diff --git a/ext/opcache/tests/jit/gh15490.phpt b/ext/opcache/tests/jit/gh15490.phpt
new file mode 100644
index 00000000000..95dc4aed8ce
--- /dev/null
+++ b/ext/opcache/tests/jit/gh15490.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-15490: use-after-free when traversing call graph
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.preload={PWD}/gh15490.inc
+opcache.jit=1235
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+foo();
+?>
+--EXPECT--
+Hello world!