fix synthesis inside generic methods

Signed-off-by: Robert Landers <landers.robert@gmail.com>

Author: withinboredom

Zend/zend_inheritance.c

@@ -6651,6 +6651,81 @@ ZEND_API zend_class_entry *zend_get_defaults_monomorph(zend_class_entry *base)
 	ZEND_UNREACHABLE();
 }
 
+/* When `new C::<...>(...)` is compiled inside a generic function/class, the
+ * turbofish args may reference enclosing-scope T parameters by ref. The op_array
+ * side-table stores those refs verbatim — at synth time they must be resolved
+ * against the executing frame's bindings, or the monomorph would carry literal
+ * "Box<T>"-style args and its method arg_info would never resolve to a concrete
+ * type. Walks args[i]; for top-level T-refs, substitutes via the frame's
+ * function-level type_args (FUNCTION_LIKE) or the lexical class's monomorph
+ * descendant's generic_type_args (CLASS_LIKE). Out slots that didn't need
+ * substitution are copied verbatim so callers can pass out[] unconditionally.
+ * Returns false when any ref can't be resolved — caller should fall through to
+ * the existing synth-with-unresolved-args behavior so the diagnostic remains
+ * where it always was. */
+static bool zend_resolve_synth_args_against_frame(
+	const zend_type *args, uint32_t arity, zend_type *out)
+{
+	zend_execute_data *ex = EG(current_execute_data);
+	for (uint32_t i = 0; i < arity; i++) {
+		if (!ZEND_TYPE_HAS_TYPE_PARAMETER(args[i])) {
+			out[i] = args[i];
+			continue;
+		}
+		const zend_type_parameter_ref *ref = ZEND_TYPE_TYPE_PARAMETER(args[i]);
+		const zend_type *resolved = NULL;
+		if (ref->origin == ZEND_GENERIC_ORIGIN_FUNCTION_LIKE) {
+			if (ex && ZEND_USER_CODE(ex->func->type)
+					&& ex->type_args
+					&& ref->index < ex->type_args->count) {
+				resolved = zend_type_arg_entry_type(&ex->type_args->entries[ref->index]);
+			}
+		} else {
+			/* Walk from called scope up to the direct child of the lexical
+			 * class — that's the monomorph carrying the binding (see the
+			 * matching walk in zend_resolve_generic_type_param). */
+			if (ex) {
+				zend_class_entry *lexical = ex->func->common.scope;
+				zend_class_entry *cur = zend_get_called_scope(ex);
+				while (cur && cur->parent != lexical) {
+					cur = cur->parent;
+				}
+				if (cur && cur->generic_type_args
+						&& ref->index < cur->generic_type_args->count) {
+					resolved = zend_type_arg_entry_type(
+						&cur->generic_type_args->entries[ref->index]);
+				}
+			}
+		}
+		if (!resolved || !ZEND_TYPE_IS_SET(*resolved)) {
+			return false;
+		}
+		out[i] = *resolved;
+	}
+	return true;
+}
+
+/* Same as zend_synthesize_monomorph, but resolves TYPE_PARAMETER refs in args
+ * against the executing frame's T-tables first. Use this at runtime `new`
+ * sites where the args originate from a compile-time side-table that may
+ * reference enclosing-scope T's. Static callers (class-build extends/implements
+ * with already-resolved args) keep using zend_synthesize_monomorph directly. */
+ZEND_API zend_class_entry *zend_synthesize_monomorph_resolved(
+	zend_class_entry *base, const zend_type *args, uint32_t arity)
+{
+	if (arity == 0) {
+		return zend_synthesize_monomorph(base, args, arity);
+	}
+	zend_type resolved[ZEND_GENERIC_MAX_PARAMS];
+	if (!zend_resolve_synth_args_against_frame(args, arity, resolved)) {
+		/* Fall through with the unresolved refs — produces the
+		 * pre-existing "Box<T>" monomorph + downstream TypeError that the
+		 * caller's existing error path already handles. */
+		return zend_synthesize_monomorph(base, args, arity);
+	}
+	return zend_synthesize_monomorph(base, resolved, arity);
+}
+
 ZEND_API zend_class_entry *zend_synthesize_monomorph(
 	zend_class_entry *base, const zend_type *args, uint32_t arity)
 {

Zend/zend_inheritance.h

@@ -70,6 +70,15 @@ ZEND_API zend_class_entry *zend_do_link_class(zend_class_entry *ce, zend_string
 ZEND_API zend_class_entry *zend_synthesize_monomorph(
 	zend_class_entry *base, const zend_type *args, uint32_t arity);
 
+/* Same as zend_synthesize_monomorph, but first resolves any TYPE_PARAMETER refs
+ * in args[] against the currently executing frame's bindings (function-level
+ * via EX()->type_args; class-level via the lexical class's monomorph descendant).
+ * Use at runtime `new` sites where the args originate from an op_array side-table
+ * compiled inside a generic scope and may name enclosing-scope T's by ref.
+ * Static-build callers with already-resolved args keep using the base. */
+ZEND_API zend_class_entry *zend_synthesize_monomorph_resolved(
+	zend_class_entry *base, const zend_type *args, uint32_t arity);
+
 /* For a bare generic class `base`, synthesize (or return the cached) monomorph
  * built from the parameters' declared defaults. Returns NULL and throws Error
  * if any parameter has no default. If `base` is itself a monomorph (no

Zend/zend_vm_def.h

@@ -9115,7 +9115,7 @@ ZEND_VM_HANDLER(212, ZEND_VERIFY_GENERIC_ARGUMENTS, TMP|UNUSED, UNUSED)
 		if (!EG(exception) && args_box && ZEND_TYPE_HAS_NAMED_WITH_ARGS(*args_box)) {
 			const zend_type_named_with_args *nwa = ZEND_TYPE_NAMED_WITH_ARGS(*args_box);
 			if (ce->generic_parameters) {
-				zend_class_entry *mono = zend_synthesize_monomorph(ce, nwa->args, nwa->count);
+				zend_class_entry *mono = zend_synthesize_monomorph_resolved(ce, nwa->args, nwa->count);
 				if (mono && mono != ce) {
 					Z_OBJ_P(new_obj)->ce = mono;
 					if (mono->constructor && call->func == ce->constructor) {
@@ -9181,7 +9181,7 @@ ZEND_VM_HANDLER(213, ZEND_INSTALL_GENERIC_ARGS, TMP|UNUSED, UNUSED)
 		if (args_box && ZEND_TYPE_HAS_NAMED_WITH_ARGS(*args_box)) {
 			const zend_type_named_with_args *nwa = ZEND_TYPE_NAMED_WITH_ARGS(*args_box);
 			if (ce->generic_parameters) {
-				zend_class_entry *mono = zend_synthesize_monomorph(ce, nwa->args, nwa->count);
+				zend_class_entry *mono = zend_synthesize_monomorph_resolved(ce, nwa->args, nwa->count);
 				if (mono && mono != ce) {
 					Z_OBJ_P(new_obj)->ce = mono;
 					if (mono->constructor && call->func == ce->constructor) {