Fix GH-22115: Tracing JIT drops loop-PHI CV register from SNAPSHOT

[wilaak]

Fixes GH-22115.

Extends the existing loop-PHI pre-pass to clear ZREG_LAST_USE on every SSA version of any loop-carried CV, not just phi->sources[1]. Intermediate versions from opcodes with op1_def under RC inference (SEND_VAR, QM_ASSIGN, CAST, etc.) were keeping the flag and tripping cleanup_stack mid-loop.

Hmm why so many no-op macros lurking here? Looks like leftovers from the new 8.4 IR stuff that was added. Not touching that.

Is a quick fix, NOT AN EXPERT. Needs expertise

[ndossche]

This isn't right, the root cause isn't related to loops or phi nodes.

In the repro, the $s's version defined by QM_ASSIGN has these uses in the op_array SSA:

• FETCH_DIM_R (op 8)
• BW_AND that writes to $s (op 15, a no-val use)
• RETURN $s (op 17)

zend_ssa_is_last_use() only checks the immediate next use. That use is a no-val use, so it reports op 8 as the last use and misses the RETURN. ZREG_LAST_USE gets set, zend_jit_trace_cleanup_stack() clears $s from the stack map, and the side exit on the === 1 guard reads the stale CV from the call frame rather than reg.

I think this fixes the root cause:

diff --git a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c
index a958a2453c4..cef21f96ea7 100644
--- a/ext/opcache/jit/zend_jit.c
+++ b/ext/opcache/jit/zend_jit.c
@@ -158,13 +158,16 @@ static bool zend_ssa_is_last_use(const zend_op_array *op_array, const zend_ssa *
 		}
 	}
 
+	/* A no-val use redefines the variable, so a later real use of the same SSA var is reachable on other paths. */
 	next_use = zend_ssa_next_use(ssa->ops, var, use);
-	if (next_use < 0) {
-		return 1;
-	} else if (zend_ssa_is_no_val_use(op_array->opcodes + next_use, ssa->ops + next_use, var)) {
-		return 1;
+	while (next_use >= 0) {
+		if (!zend_ssa_is_no_val_use(op_array->opcodes + next_use, ssa->ops + next_use, var)) {
+			return 0;
+		}
+		next_use = zend_ssa_next_use(ssa->ops, var, next_use);
 	}
-	return 0;
+	return 1;
 }
 
 static int zend_jit_is_constant_cmp_long_long(const zend_op  *opline,

Please double check this.