JIT (tracing): NAN float comparisons incorrectly return true

[sanmai]

Description

PHP JIT (tracing mode) sometimes incorrectly evaluates NAN > $float or NAN < $float as TRUE instead of FALSE, violating IEEE 754 semantics.

The following code:

<?php
class Tracker {
    private float $max = NAN;
    private int $count = 0;

    public function observe(float $value): void {
        ++$this->count;
        if ($this->count === 1) {
            $this->max = $value;
            return;
        }
        if ($value > $this->max) {
            $this->max = $value;
        }
    }

    public function getMax(): float { return $this->max; }
}

// Warm up JIT
for ($i = 0; $i < 100000; $i++) {
    $t = new Tracker();
    $t->observe(1.0);
    $t->observe(2.0);
    $t->observe(3.0);
    $t->getMax();
}

// Test: NAN > M_PI should be FALSE per IEEE 754
$t = new Tracker();
$t->observe(M_PI);
$t->observe(NAN);
var_dump($t->getMax());

When running with:

php -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=64M

Resulted in this output:

float(NAN)

But I expected this output instead:

float(3.141592653589793)

PHP Version

PHP 8.4.16 (cli) (built: Dec 21 2025 05:25:12) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.16, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.16, Copyright (c), by Zend Technologies

Operating System

No response

[ndossche]

Simpler reproducer, that also generates less machine code:

<?php
function observe(float $value, float $max): float {
    if ($value > $max) {
        return $value;
    }
    return $max;
}


$max = 0.0;
for ($i = 0; $i < 100000; $i++) {
    $max = observe(1.0, $max);
    $max = observe(3.0, $max);
}

$max = observe(4.0, $max);
$max = observe(NAN, $max);
var_dump($max);

[ndossche]

The problem is in the IR backend, here:

php-src/ext/opcache/jit/ir/ir_x86.dasc

Lines 10350 to 10352 in 1791578

	if (insn->op == IR_GUARD) {
	op ^= 1; // reverse
	}

We want to generate a IR_GUARD with an IR_LE floating point comparison. The highlighted code inverses the condition such that the right branch direction is taken. This changes IR_LE to IR_GT. But swapping the condition and branch targets is not right in the presence of NAN.

[ndossche]

PoC patch that could fix this: https://gist.github.com/ndossche/ceebe1dc9a4e5acef5d646b4cd66dbf9
Needs more work, i.e. more changes in the emitting code for jcc but also need to think more if this is the best way.

[ndossche]

I submitted dstogov/ir#122