Tracing JIT drops loop-PHI CV register from SNAPSHOT after intermediate op1_def

Description

Tracing JIT returns wrong values from hot loops!

<?php
function f(array $meta, int $n): int {
    $s = 0; $i = 0; $sink = 0;
    while ($i < $n) {
        $copy = $s;                    // QM_ASSIGN, op1_def on $s under RC inference
        $sink += $copy;                // keep ASSIGN past DCE
        $m = (int) $meta[$s];          // FETCH_DIM_R use of $s, ZREG_LAST_USE
        if (($m & 0xFF) === 1) {       // IS_IDENTICAL guard, side-exit's SNAPSHOT misses $s
            $i++;
            $s = ($m >> 32) & 0xFFFFFF;
            continue;
        }
        return $s;
    }
    return $s;
}
$meta = [0 => 1 | (1 << 32), 1 => 2 | (2 << 32)];
for ($w = 0; $w < 2000; $w++) f($meta, 3);
var_dump(f($meta, 3));

Results in:

$ php -d opcache.enable_cli=1 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing repro.php
int(0)

Expected:

$ php -d opcache.enable_cli=1 -d opcache.jit_buffer_size=64M -d opcache.jit=function repro.php
int(1)

PHP Version

PHP 8.4 and above

首先使用 tracing JIT 和 function JIT 设置运行提供的 repro.php，然后比较所得值，并检查中间操作和 side exit 附近循环的 snapshot 行为。完成的标准是 tracing JIT 返回 int(1)，与 function JIT 的结果一致，同时不导致提供的 hot-loop 用例出现回归。