Fix GH-24471: Tracing JIT reads stale float temporary on side exit

Don't bind a CV to its VM slot when its IR ref was emitted by an earlier
opline (e.g. MUL by 1.0 folded to op1, or a CSE'd expression). The ref
may be shared with another live var, whose snapshot entry would then be
wrongly marked type_only.

Fixes GH-24471

Author: jorgsowa

ext/opcache/jit/zend_jit.c

@@ -1495,6 +1495,7 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 		for (i = ssa->cfg.blocks[b].start; i <= end; i++) {
 			zend_ssa_op *ssa_op = ssa->ops ? &ssa->ops[i] : NULL;
 			opline = op_array->opcodes + i;
+			ctx.op_start_ref = ctx.ctx.insns_count;
 			if (zend_jit_inc_call_level(opline->opcode)) {
 				call_level++;
 			}

ext/opcache/jit/zend_jit_ir.c

@@ -294,6 +294,7 @@ typedef struct _zend_jit_ctx {
 	ir_ref              *bb_edges;
 	zend_jit_trace_info *trace;
 	zend_jit_reg_var    *ra;
+	ir_ref               op_start_ref;
 	int                  delay_var;
 	ir_refs             *delay_refs;
 	ir_ref               eg_exception_addr;
@@ -1352,6 +1353,8 @@ static bool zend_jit_spilling_may_cause_conflict(zend_jit_ctx *jit, int var, ir_
 		 && jit->ra[jit->ssa->ops[jit->ssa->vars[var].definition].op2_use].ref == val) {
 			/* Avoid spill conflict between of ASSIGN.op1_def and ASSIGN.op1_use */
 			return 1;
+		} else if (val < jit->op_start_ref) {
+			return 1;
 		}
 		return 0;
 	}
@@ -2809,6 +2812,7 @@ static void zend_jit_init_ctx(zend_jit_ctx *jit, uint32_t flags)
 	jit->bb_edges = NULL;
 	jit->trace = NULL;
 	jit->ra = NULL;
+	jit->op_start_ref = IR_UNUSED;
 	jit->delay_var = -1;
 	jit->delay_refs = NULL;
 	jit->eg_exception_addr = 0;

ext/opcache/jit/zend_jit_trace.c

@@ -4385,6 +4385,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 			bool gen_handler = false;
 
 			opline = p->opline;
+			jit->op_start_ref = jit->ctx.insns_count;
 			if (op1_type & (IS_TRACE_REFERENCE|IS_TRACE_INDIRECT)) {
 				op1_type = IS_UNKNOWN;
 			}

ext/opcache/tests/jit/gh24471.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-24471 (Tracing JIT: float temporary marked type_only in side trace exit, VM reads stale value)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+function f($x, $y) {
+    $d = ($x + 0.5) * ($y === [1] ? 2.0 : 1.0);
+    return $d;
+}
+$ys = array_fill(0, 100, [0]);
+$ys[] = [1];
+foreach ($ys as $i => $y) {
+    $r = f($i, $y);
+}
+var_dump($r);
+?>
+--EXPECT--
+float(201)

ext/opcache/tests/jit/gh24471_2.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-24471 (Tracing JIT: CSE'd float temporary marked type_only in side exit)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+function f($x, $y) {
+    $r = ($x + 0.5) + ($d = $x + 0.5) * ($y === [1] ? 2.0 : 3.0);
+    return $r + $d;
+}
+$ys = array_fill(0, 100, [0]);
+$ys[] = [1];
+foreach ($ys as $i => $y) {
+    $r = f($i, $y);
+}
+var_dump($r);
+?>
+--EXPECT--
+float(402)