ext/opcache: Fix tracing JIT range narrowing against a non-integer operand

zend_jit_trace_update_condition_ranges() tested OP1_INFO() twice instead of
OP1_INFO() and OP2_INFO(), so comparing an integer with a float or
numeric-string literal narrowed the integer's range as if both operands were
integers. zend_may_overflow() then ruled out overflow of a following $x + 1,
the overflow check was omitted, and the trace returned a wrapped integer
instead of a float, or failed an assertion while compiling. Require both
operands to be integers, as the rest of the function assumes.

Author: iliaal

NEWS

@@ -85,6 +85,9 @@ PHP                                                                        NEWS
     zend_jit_assign_dim_op()). (waroad)
   . Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is
     passed to a run-time-resolved function). (waroad)
+  . Fixed tracing JIT returning a wrapped integer instead of a float on
+    integer overflow after an integer was compared with a float or
+    numeric-string literal. (Ilia Alshanetsky)
 
 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.

ext/opcache/jit/zend_jit_trace.c

@@ -3688,7 +3688,7 @@ static void zend_jit_trace_update_condition_ranges(const zend_op *opline, const
 	zend_long op1_min, op1_max, op2_min, op2_max;
 
 	if ((OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG
-	 || (OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG) {
+	 || (OP2_INFO() & MAY_BE_ANY) != MAY_BE_LONG) {
 		return;
 	}
 

ext/opcache/tests/jit/cmp_010.phpt

@@ -0,0 +1,57 @@
+--TEST--
+JIT CMP: 010 Integer range must not be narrowed by a comparison with a non-integer operand
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_hot_func=1
+opcache.jit_hot_loop=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only");
+?>
+--FILE--
+<?php
+function lt_float(int $x) {
+    if ($x < 1.0e19) {
+        return $x + 1;
+    }
+    return 0;
+}
+function lt_string(int $x) {
+    if ($x < "1e19") {
+        return $x + 1;
+    }
+    return 0;
+}
+function le_float(int $x) {
+    if ($x <= -1.0e19) {
+        return 0;
+    }
+    return $x - 1;
+}
+foreach ([1, 2, 3, PHP_INT_MAX] as $v) {
+    $r = lt_float($v);
+}
+echo "int < float: ";
+var_dump($r);
+foreach ([1, 2, 3, PHP_INT_MAX] as $v) {
+    $r = lt_string($v);
+}
+echo "int < numeric string: ";
+var_dump($r);
+foreach ([1, 2, 3, PHP_INT_MIN] as $v) {
+    $r = le_float($v);
+}
+echo "int <= float (false): ";
+var_dump($r);
+?>
+--EXPECT--
+int < float: float(9.223372036854776E+18)
+int < numeric string: float(9.223372036854776E+18)
+int <= float (false): float(-9.223372036854776E+18)