fix: Improve gh22857.phpt: use deterministic assertion for FETCH_OBJ_FUNC_ARG JIT bug

The previous version relied on file_get_contents() throwing when the
unguarded JIT read landed on whatever garbage sat in an adjacent property
slot. That failure is data-dependent, which is why the old test needed a
200-iteration loop to become reliable.

The getter now records a side effect (a static flag). After the property
is read through FETCH_OBJ_FUNC_ARG we assert the flag is set, i.e. that the
getter actually ran. This makes the failure deterministic, so the loop
drops to a few calls. Both the self-priming variant and the sibling-slot
variant (compact_literals sharing the cache slot, decided at compile time)
are preserved, and the trigger that emits FETCH_OBJ_FUNC_ARG (unqualified
namespaced-fallback call under @) is unchanged.

GH-22857

Author: coderzhao

ext/opcache/tests/jit/gh22857.phpt

@@ -20,15 +20,26 @@ final class DefaultHandler implements HandlerInterface {
     public function noop(): void {}
 }
 
-/* Repro of the original issue: virtual property hook read via
- * FETCH_OBJ_FUNC_ARG under function JIT, where the getter frame is pushed
- * by the SIMPLE_GET fast path in the shared FETCH_OBJ_R handler but the
- * JIT-compiled FUNC_ARG opcode has no hook-enter guard. */
+/* Original issue: virtual property hook read via FETCH_OBJ_FUNC_ARG under
+ * function JIT. The getter frame is pushed by the SIMPLE_GET fast path in the
+ * shared FETCH_OBJ_R handler, but the JIT-compiled FUNC_ARG opcode had no
+ * hook-enter guard, so the argument slot was read before the getter ran.
+ *
+ * The assertion is deterministic: the getter sets a static flag as a side
+ * effect, so we check whether the getter actually ran when the property is
+ * passed through FETCH_OBJ_FUNC_ARG. This avoids the previous data-dependent
+ * failure mode (relying on file_get_contents() fataling on whatever garbage
+ * the unguarded JIT read happened to land on), which made the regression
+ * test flaky. */
 class Container {
+    private static bool $getterRan = false;
+
     public protected(set) HandlerInterface $handler;
 
     public string $path {
-        get => self::build($this->kind, $this->id);
+        get => (self::$getterRan = true)
+            ? self::build($this->kind, $this->id)
+            : self::build($this->kind, $this->id);
     }
 
     protected mixed $prev = null;
@@ -45,12 +56,13 @@ class Container {
     }
 
     public function step(): void {
-        /* Unqualified namespaced-fallback call so op1 of SEND is a
-         * FETCH_OBJ_FUNC_ARG (INIT_NS_FCALL_BY_NAME). @ silences the
-         * expected file-not-found warning. */
-        $r = @file_get_contents($this->path);
-        if ($r !== false) {
-            throw new \RuntimeException('unexpected non-false return');
+        /* Unqualified namespaced-fallback call (INIT_NS_FCALL_BY_NAME) keeps
+         * the FETCH_OBJ_FUNC_ARG opcode instead of letting the optimizer
+         * rewrite it to FETCH_OBJ_R. @ preserves the opcode shape that
+         * triggers the bug. */
+        @file_get_contents($this->path);
+        if (!self::$getterRan) {
+            throw new \RuntimeException('getter did not run via FUNC_ARG');
         }
     }
 }
@@ -60,17 +72,23 @@ $c->step();
 $c->step();
 $c->step();
 
-/* Sibling-slot variant: a preceding plain FETCH_OBJ_R can prime the
+/* Sibling-slot variant: a preceding plain FETCH_OBJ_R primes the
  * SIMPLE_GET bit on the property cache slot; compact_literals shares the
  * slot between FETCH_OBJ_R and FETCH_OBJ_FUNC_ARG for the same property,
- * so a following FETCH_OBJ_FUNC_ARG will consume that bit and hit the
- * SIMPLE_GET fast path. Without the hook-enter guard it reads garbage
- * from an adjacent property slot. */
+ * so the following FETCH_OBJ_FUNC_ARG consumes that bit and hits the
+ * SIMPLE_GET fast path. Without the hook-enter guard it passes whatever
+ * sits in an adjacent property slot instead of running the getter. The
+ * flag is reset after the priming FETCH_OBJ_R so the assertion reflects
+ * only whether the getter ran during the FETCH_OBJ_FUNC_ARG read. */
 class Container2 {
+    private static bool $getterRan = false;
+
     public protected(set) HandlerInterface $handler;
 
     public string $path {
-        get => self::build($this->kind, $this->id);
+        get => (self::$getterRan = true)
+            ? self::build($this->kind, $this->id)
+            : self::build($this->kind, $this->id);
     }
 
     protected mixed $prev = null;
@@ -87,14 +105,11 @@ class Container2 {
     }
 
     public function step(): void {
-        /* FETCH_OBJ_R primes SIMPLE_GET on the shared slot. The hook
-         * result is stored into a property (ownership transfer) instead
-         * of a local, so this test stays independent of how the JIT
-         * releases temporaries of hooked property reads. */
-        $this->prev = $this->path;
-        $r = @file_get_contents($this->path); // FETCH_OBJ_FUNC_ARG consumes the primed bit
-        if ($r !== false || !\is_string($this->prev)) {
-            throw new \RuntimeException('unexpected values');
+        $this->prev = $this->path;   // FETCH_OBJ_R primes SIMPLE_GET on shared slot
+        self::$getterRan = false;     // reset; flag now reflects only the FUNC_ARG read below
+        @file_get_contents($this->path); // FETCH_OBJ_FUNC_ARG consumes the primed bit
+        if (!self::$getterRan) {
+            throw new \RuntimeException('sibling-slot variant: getter did not run via FUNC_ARG');
         }
     }
 }