JIT compiled exit clobbers registers before saving

[arnaud-lb]

Description

The following code:

<?php

final class It implements Iterator {
 public readonly array $values;
 public int $position = 0;
 public function __construct(array $values) {
 $this->values = $values;
 }

 public function rewind(): void {}

 public function valid(): bool {
 return $this->position === 0;
 }

 public function current(): mixed {
 if (!isset($this->values[$this->position])) {
 throw new Exception();
 }

 return $this->values[$this->position];
 }

 public function key(): mixed {
 return $this->position;
 }

 public function next(): void {
 $this->position++;
 }
}

function iter(It $it) {
 foreach ($it as $value) {
 var_dump($value);
 if (!$value instanceof stdClass) {
 continue;
 }
 }
}

echo "# First run\n";
for ($i = 0; $i < 5; $i++) {
 getenv('F')(new It([getenv('F')])); // non-immutable, packed array
}

// Next side-exit should deoptimize
var_dump(ini_set('opcache.jit_max_side_traces', '0'));
var_dump(ini_set('opcache.jit_blacklist_side_trace', '0'));

echo "# Second run\n";
for ($i = 0; $i < 5; $i++) {
 getenv('F')(new It([getenv('F'), 'map' => true])); // non-immutable, map, triggers exit
}

?>

When executed with

F=iter php -n -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_hot_func=1 -d opcache.jit_hot_side_exit=1 test.php

Resulted in this output:

# First run
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(3) "128"
string(1) "8"
# Second run
string(4) "iter"

Fatal error: Uncaught Exception in test.php:18
Stack trace:
#0 test.php(34): It->current()
#1 test.php(53): iter(Object(It))
#2 {main}
 thrown in test.php on line 18

But I expected this output instead:

# First run
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(3) "128"
string(1) "8"
# Second run
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"
string(4) "iter"

Cause:

During the second run phase, the compiled trace for It::current() exits because $this->values is not a packed array anymore. The side exit is blacklisted, but the generated code clobbers registers before saving them:

 ESCAPE-6-4:
 cmpb $0, 0x69(%r12)
 je .L1
 ; try_addref(T1)
 movq 0x60(%r12), %rax
 addl $1, (%rax)
.L1:
 ; save T2 (%rax), but it was clobbered above
 movq %rax, 0x70(%r12)
 movl $4, 0x78(%r12)
 leaq -0xb01677d(%rip), %r13
 addq $0x38, %rsp
 jmpq *(%r13)

This causes isset($this->values[$this->position]) to evaluate to false.

PHP Version

PHP 8.4

Operating System

No response