Guard JIT blacklist rewrite to tracing JIT metadata

[bwoebi]

Motivation

• A helper used by HookData::overrideArguments() attempted to rewrite JIT/tracing opcache metadata without verifying the layout, which can reinterpret non-tracing JIT data as tracing metadata and cause out-of-bounds reads/writes or crash the PHP worker.
• The PHP 8.0 reserved-slot heuristic also inspected the wrong pointer, which could select an incorrect resource id and further enable unsafe reinterpretation.
• The change aims to safely gate the tracing-JIT-specific rewriting so only valid tracing-JIT metadata is modified.

Description

• Fixed the PHP 8.0 reserved-slot heuristic in zai_get_zend_func_rid() to inspect op_array->reserved[i] instead of op_array->reserved, preventing incorrect resource-id selection.
• Added a defensive zai_is_mapped() check before dereferencing the jit_extension pointer to avoid reading unmapped or invalid memory.
• Only perform trace-layout rewrites when the metadata func_info.flags indicates hot-trace JIT by testing ZEND_FUNC_JIT_ON_HOT_TRACE, and added a compatibility fallback definition for that flag when headers don't provide it.

Testing

• Ran git diff --check which reported no conflicts or whitespace errors and succeeded.
• Verified repository status with git status --short and committed the change successfully.
• No automated unit tests were added or run as part of this minimal, targeted native-safety hardening change.

---

Codex Task

[datadog-datadog-prod-us1]

 

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 9 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | pecl tests: [8.5]     

🔧 Fix in code (Fix with Cursor).

1 failed test: Test dynamic config multiconfig priority merging.

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.2]     

🔧 Fix in code (Fix with Cursor).

Error during installation of live debugger span probe. Exception: Oops! at dd_trace_span_link_with_exception.php:17.

DataDog/apm-reliability/dd-trace-php | min install tests     

🔄 Retry job. This looks flaky and may succeed on retry.

Failed to create pod sandbox due to network setup issues: unable to allocate IP via local cilium agent.

View all 9 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.70% (-0.05%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 07401b3 | Docs | Datadog PR Page | Give us feedback!}