[devnexen]

Should also fix GH-24798

[ndossche]

I can only review this in the evening, but can you please explain the analysis and reasoning in the PR so I don't have to fully reconstruct it?

[devnexen]

I can only review this in the evening, but can you please explain the analysis and reasoning in the PR so I don't have to fully reconstruct it?

Sure. When a call in the trace throws, the JIT code leaves through jit_stub_exception_handler to the VM's HANDLE_EXCEPTION, and the catch runs in the interpreter, reading CVs from the frame. Unlike a side exit, that path has no snapshot, so register-only CVs are never written back: the catch sees UNDEF ($n in GH-24445) or a stale value ($s in GH-24798). Hence 1054 being fine.

The fix sets ZREG_STORE on CVs of op_arrays with try/catch in zend_jit_trace_allocate_registers(), so defs also reach the frame. ZREG_LOAD ranges are skipped as their slot is already in sync, and functions without try/catch are unaffected.