Round-trip closures declared in constant expressions

[nicolas-grekas]

PHP 8.5 allows anonymous closures in constant expressions: attribute arguments, class constants, property and parameter defaults, property hooks. Frameworks now meet them when reading attributes (e.g. #[Assert\When(static function () { ... })], symfony/symfony#63228) and can no longer cache the resulting metadata, since closures refuse both serialize() and deepclone_to_array().

Const-expr closures are compile-time checked to be static and capture-free, so they are fully described by their declaration site. deepclone_to_array() now encodes them under a new mask marker (LONG 1) as [class, site, attrIndex|null, closureIndex, startLine], where site is "" (the class), "NAME" (constant or enum case), "$name" (property), "name()" (method), "name()#N" (parameter) or "$name::get()" / "$name::set()#N" (property hooks).

• Identification is exact. A const-expr closure shares its opcodes with the op_array embedded in the declaring AST, so the scope class's constant expressions are scanned in declaration order for a pointer match. Promoted properties are addressed through their constructor parameter, the canonical surface. Two same-line literals are told apart reliably, where the polyfill has to refuse.
• Restoring re-evaluates. deepclone_from_array() evaluates the addressed constant expression, picks the Nth closure from a depth-first walk (arrays in order, objects through their array-cast properties) and verifies the declaration line still matches, so payloads that outlived a code change fail loudly (stale payload) instead of resolving to a moved closure.
• No code in the payload. Only names and indices; the resolved code is whatever the loaded class declares. allowed_classes gates both directions: Closure must be allowed before any constant expression is evaluated on the to_array side, and the payload-named class must be allow-listed before it is autoloaded on the from_array side, so unserialization cannot drive autoloading or constructor execution for classes outside the allow-list.

Closures created at runtime (and any closure the scanner cannot match) keep throwing NotInstantiableException. New .phpts cover every site kind (hooks, traits including aliasing, enums, promoted constructor properties, several closures per attribute, factory constants whose runtime product is refused), payload validation, allow-list gating, staleness, and a JSON round trip of the payload. The polyfill test suite also passes against this extension, including the payload-interchange cases.

Companion polyfill implementation: symfony/polyfill#630

[stof]

The CI is failing.