[devnexen]

Should also fix GH-24798

[ndossche]

I can only review this in the evening, but can you please explain the analysis and reasoning in the PR so I don't have to fully reconstruct it?

[devnexen]

I can only review this in the evening, but can you please explain the analysis and reasoning in the PR so I don't have to fully reconstruct it?

Sure. When a call in the trace throws, the JIT code leaves through jit_stub_exception_handler to the VM's HANDLE_EXCEPTION, and the catch runs in the interpreter, reading CVs from the frame. Unlike a side exit, that path has no snapshot, so register-only CVs are never written back: the catch sees UNDEF ($n in GH-24445) or a stale value ($s in GH-24798). Hence 1054 being fine.

The fix sets ZREG_STORE on CVs of op_arrays with try/catch in zend_jit_trace_allocate_registers(), so defs also reach the frame. ZREG_LOAD ranges are skipped as their slot is already in sync, and functions without try/catch are unaffected.

[ndossche]

I think this fix is the "nuclear option", it will work but it penalizes a lot of vars independent if the trace actually is contained within exception handling.
You can narrow the condition so that only ops that fall between try_op and finally/catch op are getting ZREG_STORE. Look at zend_dispatch_try_catch_finally_helper for inspiration.
Although I wonder if that's also not a bit too broad of a fix..

Also this PR should target 8.4 not master