Tracing JIT: a bool read from three object properties is stale right after read()/write()/unread() warm their own traces (opcache.jit=1254)

Description

Reduced from testing the read/write/unread/eof sequence of a string-buffer class (no external code; the class below only keeps a few private fields and does the same bookkeeping, nothing phasync-specific is left).

The following code:

<?php

final class StringBuffer
{
    private \SplDoublyLinkedList $queue;
    private string $buffer = '';
    private int $length = 0;
    private int $offset = 0;
    private int $totalRead = 0;
    private int $totalWritten = 0;
    private bool $ended = false;

    public function __construct()
    {
        $this->queue = new \SplDoublyLinkedList();
    }

    public function isEmpty(): bool
    {
        return $this->offset === $this->length && $this->queue->isEmpty();
    }

    public function write(string $chunk): void
    {
        if ($this->ended) {
            throw new \RuntimeException('Buffer has been ended');
        }
        $this->totalWritten += \strlen($chunk);
        $this->queue->push($chunk);
    }

    public function read(int $maxLength): string
    {
        if ($maxLength < 0) {
            throw new \OutOfBoundsException("Can't read negative lengths");
        }
        $this->fill($maxLength);
        $chunk = \substr($this->buffer, $this->offset, $maxLength);
        $length = \strlen($chunk);
        $this->offset += $length;
        $this->totalRead += $length;

        return $chunk;
    }

    public function end(): void
    {
        if ($this->ended) {
            throw new \LogicException('StringBuffer already ended');
        }
        $this->ended = true;
    }

    public function eof(): bool
    {
        return $this->ended && $this->offset === $this->length && $this->queue->isEmpty();
    }

    public function unread(string $chunk): void
    {
        if ($this->ended && $this->offset === $this->length && $this->queue->isEmpty()) {
            throw new \LogicException("Can't unread to an ended and empty StringBuffer");
        }
        $chunkLength = \strlen($chunk);
        $this->totalRead -= $chunkLength;
        if ($this->length === $this->offset) {
            $this->queue->unshift($chunk);
        } else {
            $this->buffer = $chunk . \substr($this->buffer, $this->offset);
            $this->length += $chunkLength - $this->offset;
            $this->offset = 0;
        }
    }

    protected function fill(int $requiredLength): bool
    {
        if ($this->offset > 4096) {
            $this->buffer = \substr($this->buffer, $this->offset);
            $this->length -= $this->offset;
            $this->offset = 0;
        }
        while ($this->length < $this->offset + $requiredLength && !$this->queue->isEmpty()) {
            $chunk       = $this->queue->shift();
            $chunkLength = \strlen($chunk);

            if ($this->length === $this->offset) {
                $this->buffer = $chunk;
                $this->length = $chunkLength;
                $this->offset = 0;
            } else {
                $this->buffer .= $chunk;
                $this->length += $chunkLength;
            }
        }

        return $this->length >= $this->offset + $requiredLength;
    }
}

$sb = new StringBuffer();
$sb->write('A');
assert($sb->read(1) === 'A');
assert($sb->isEmpty() === true);
$sb->write('B');
$sb->unread('X');
assert($sb->read(2) === 'XB');
$sb->end();
assert($sb->eof() === true);

$sb = new StringBuffer();
$count = 0;
for ($i = 0; $i < 1000; ++$i) { $sb->write('x'); }
$sb->end();
while (!$sb->eof()) { if ('' !== $sb->read(1)) { ++$count; } }
assert($count === 1000);

$sb = new StringBuffer();
$totalReceived = 0;
$chunk = str_repeat('x', 1024);
for ($i = 0; $i < 100; ++$i) { $sb->write($chunk); }
$sb->end();
while (!$sb->eof()) { $totalReceived += strlen($sb->read(8192)); }
assert($totalReceived === 102400);

$sb = new StringBuffer();
assert($sb->eof() === false);
$sb->write('Hello');
assert($sb->read(10000) === 'Hello');
assert($sb->read(100) === '');
assert($sb->write('ab') === null);
assert($sb->read(1) === 'a');
assert($sb->read(2) === 'b');
$sb->write('abc');
assert($sb->eof() === false);
$sb->write('def');
$sb->end();
$sb->unread('b');
assert($sb->read(5) === 'babcd');
var_dump($sb->eof()); // bug: prints true, must be false (2 bytes unread: "ef")
assert($sb->read(10000) === 'ef');
var_dump($sb->eof()); // bug: prints false, must be true

run with:

php -d zend.assertions=1 -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=64M repro.php

Resulted in this output (same every run):

bool(true)
bool(false)

But I expected this output instead:

bool(false)
bool(true)

Details

• opcache.jit=1254 (the default tracing JIT), 1255 and 1154 all give the wrong output above.
• opcache.jit=1054 (tracing without register allocation), opcache.jit=1005, opcache.jit=function and opcache.jit=disable all give the right output.
• No warning or notice is printed either way; eof() simply returns the wrong boolean.
• eof() is a plain && over three already-set object properties ($this->ended, $this->offset === $this->length, $this->queue->isEmpty()); nothing about the two failing calls themselves is unusual.
• The two failing eof() calls are each their own call site, executed once; by the time they run, read(), write(), fill() and unread() have already gone through two earlier loops (1000 and 100 iterations) that make the tracing JIT record several hot traces for those methods. Deleting either loop, or any of the four call groups above, makes the whole script print the right output, so this is specific to the exact trace shapes those loops leave behind, not to any one call in isolation.
• The object itself is never shared between the loops and the final sequence ($sb = new StringBuffer() starts a new one each time), so this isn't about one instance's property values surviving incorrectly; the suspicion is that one of the already-compiled traces for read()/write()/fill()/unread() keeps a value (destined for $this->offset, $this->length or $this->buffer) only in a register on some exit path, and the next, cold call into that same compiled trace (from the new object, in the final sequence) resumes with that register's value never having been stored to the property it belongs to.

PHP Version

PHP 8.5.12 (cli) (built: Oct 21 2026 08:06:50) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

Operating System

Ubuntu 24.04.2 LTS (Noble Numbat), x86_64