Fix Exception::getTrace() #[SensitiveParameter] args redaction (#21339)

[PurHur]

Summary

• Exception trace capture no longer passes DEBUG_BACKTRACE_IGNORE_ARGS; frames include call arguments with sensitive slots replaced by SensitiveParameterValue (php-src-strict, re-Regression: #[\SensitiveParameter] — Exception traces expose args (must omit like Zend) (Zend/zend_builtin_functions.c) #15036).
• Updated compliance guard sensitive_parameter_exception_trace.phpt for arity + redaction + non-sensitive arg visibility.

Test plan

Issue repro (VM, PROFILE=8.4):

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && PHP_COMPILER_PROFILE=8.4 php bin/vm.php -r '\''
function f(#[\SensitiveParameter] string $password, string $ok) { throw new Exception("boom"); }
try { f("secret", "visible"); } catch (Throwable $e) {
  $a = $e->getTrace()[0]["args"] ?? [];
  echo "argc=", count($a), "\n";
  echo "a0=", isset($a[0]) && is_object($a[0]) ? get_class($a[0]) : "missing", "\n";
  echo "a1=", isset($a[1]) ? var_export($a[1], true) : "missing", "\n";
}
'\'''

Output after fix:

argc=2
a0=SensitiveParameterValue
a1='visible'

PHPUnit:

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter sensitive_parameter_exception_trace'

OK (2 tests — VM + JIT).

Closes #21339

Made with Cursor