Fix GH-24445: Tracing JIT loses register-allocated CVs i…

ext/opcache/jit/zend_jit_trace.c

@@ -2827,6 +2827,21 @@ static void zend_jit_trace_use_var(int line, int var, int def, int use_chain, ze
 	}
 }
 
+static bool zend_jit_trace_op_in_try(const zend_op_array *op_array, const zend_op *opline)
+{
+	uint32_t op_num = opline - op_array->opcodes;
+
+	for (uint32_t i = 0; i < op_array->last_try_catch; i++) {
+		const zend_try_catch_element *try_catch = &op_array->try_catch_array[i];
+
+		if (op_num >= try_catch->try_op
+		 && op_num < (try_catch->finally_op ? try_catch->finally_op : try_catch->catch_op)) {
+			return true;
+		}
+	}
+	return false;
+}
+
 static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *trace_buffer, zend_ssa *ssa, uint32_t parent_trace, uint32_t exit_num)
 {
 	const zend_op **ssa_opcodes = ((zend_tssa*)ssa)->tssa_opcodes;
@@ -2838,6 +2853,7 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 	int i, j, idx, count, level;
 	zend_jit_reg_var *ra;
 	const zend_op_array **vars_op_array;
+	zend_bitset store_vars;
 	void *checkpoint;
 	zend_jit_trace_stack_frame *frame;
 	zend_jit_trace_stack *stack;
@@ -2850,6 +2866,7 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 	ra = zend_arena_calloc(&CG(arena), ssa->vars_count, sizeof(zend_jit_reg_var));
 	vars_op_array = zend_arena_calloc(&CG(arena), ssa->vars_count, sizeof(zend_op_array*));
 	memset(ZEND_VOIDP(vars_op_array), 0, sizeof(zend_op_array*) * ssa->vars_count);
+	store_vars = zend_arena_calloc(&CG(arena), zend_bitset_len(ssa->vars_count), ZEND_BITSET_ELM_SIZE);
 
 	op_array = trace_buffer->op_array;
 	jit_extension =
@@ -2939,6 +2956,17 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 				support_opline = 0;
 			}
 
+			if (op_array->last_try_catch
+			 && zend_jit_trace_op_in_try(op_array, opline)
+			 && zend_may_throw(opline, ssa_op, op_array, ssa)) {
+				for (i = 0; i < op_array->last_var; i++) {
+					j = STACK_VAR(stack, i);
+					if (j >= 0 && RA_HAS_IVAL(j)) {
+						zend_bitset_incl(store_vars, j);
+					}
+				}
+			}
+
 			if (ssa_op->op1_use >= 0
 			 && RA_HAS_IVAL(ssa_op->op1_use)) {
 				if (!support_opline) {
@@ -3266,6 +3294,13 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 	}
 
 	if (count) {
+		for (i = 0; i < ssa->vars_count; i++) {
+			if (RA_HAS_REG(i) &&
+			    zend_bitset_in(store_vars, i) &&
+			    !(RA_REG_FLAGS(i) & ZREG_LOAD)) {
+				RA_REG_FLAGS(i) |= ZREG_STORE;
+			}
+		}
 		/* SSA resolution */
 		if (trace_buffer->stop == ZEND_JIT_TRACE_STOP_LOOP
 		 || trace_buffer->stop == ZEND_JIT_TRACE_STOP_RECURSIVE_CALL

ext/opcache/tests/jit/gh24445.phpt

@@ -0,0 +1,36 @@
+--TEST--
+GH-24445 (Tracing JIT: a catch reads an int local as undefined after an internal call throws)
+--CREDITS--
+EJ-Research
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+opcache.jit_hot_func=1
+--FILE--
+<?php
+function loop(array $p): void { foreach ($p as $v) {} }
+function id(int $n): int { return $n; }
+function run(array $p, int $d): int {
+    loop($p);
+    $n = count($p);
+    try {
+        intdiv(1, $d);
+    } catch (DivisionByZeroError $e) {
+        var_dump($n);
+        return -1;
+    }
+    return id($n);
+}
+for ($i = 0; $i < 10; $i++) {
+    run([1], 1);
+}
+run([1], 0);
+?>
+--EXPECT--
+int(1)

ext/opcache/tests/jit/gh24798.phpt

@@ -0,0 +1,33 @@
+--TEST--
+GH-24798 (Tracing JIT loses register-allocated CVs when an exception is caught in the same function)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+opcache.jit_hot_func=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+--FILE--
+<?php
+function f($n) {
+    $s = 0.0;
+    for ($i = 0; $i < $n; $i++) {
+        try {
+            $s += 1.0 / ($i - 2);
+        } catch (DivisionByZeroError $e) {
+            echo $e::class, ': ', $e->getMessage(), ' at $i = ', $i, PHP_EOL;
+            $s += 100;
+        }
+    }
+    return $s;
+}
+var_dump(f(5));
+?>
+--EXPECT--
+DivisionByZeroError: Division by zero at $i = 2
+float(100)