[GIT-PULLS] [php-src] PR #23241: JIT: Repeat FETCH_OBJ_IS in the VM when the property slot is IS_UNDEF

Pull Request: https://github.com/php/php-src/pull/23241
Author: EdmondDantes

Under `opcache.jit=tracing`, `isset($obj->prop[$key])` answers `false` for a key the array holds, when `prop` is a declared property that `unset()` removed and `__isset()`/`&__get()` serve it. `opcache.jit=function` and `opcache.jit=off` are both correct. Reproduces on the stock `php:8.4-cli` and `php:8.5-cli` images; 8.3 is unaffected.

```php
class Store { public array $marks = []; }

class Holder {
    public static Store $store;
    public array $marks = [];

    public function __construct() { unset($this->marks); }
    public function &__get(string $name) { return self::$store->$name; }
    public function __isset(string $name): bool { return isset(self::$store->$name); }
    public function mark(string $key): void { $this->marks[$key] = true; }
    public function has(string $key): bool { return isset($this->marks[$key]); }
}

Holder::$store = new Store();
$holder = new Holder();

for ($n = 0; $n < 10; $n++) {
    $key = "k{$n}";
    $holder->mark($key);
    var_dump($holder->has($key));   // true, true, then false eight times
}
```

`php -d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_hot_func=2 t.php`

## Cause

With `prop_info` known, the trace for `Holder::has()` reads the property slot directly and leaves the `IS_UNDEF` check to the result type guard (`zend_jit_fetch_obj()`, `zend_jit_ir.c:14556`). The guard fails, because the slot of an `unset()` property is `IS_UNDEF` while the trace recorded an array, and the exit lands in `zend_jit_trace_exit()`:

```c
if (op->opcode == ZEND_FETCH_DIM_IS || op->opcode == ZEND_FETCH_OBJ_IS) {
    ZVAL_NULL(EX_VAR_NUM(i));
} else {
    ...
    repeat_last_opline = 1;
}
```

The exit opline is `FETCH_OBJ_IS + 1`, so the VM resumes at `ISSET_ISEMPTY_DIM_OBJ` with NULL in the result and never enters `zend_std_read_property()`. `unset()` on a declared property leaves the slot `IS_UNDEF` with `IS_PROP_UNINIT` clear, which is exactly the state where `zend_std_read_property()` calls `__isset()` and then `__get()` (`zend_object_handlers.c:929`).

`FETCH_DIM_IS` keeps the shortcut: an undefined array index has no magic behind it. `FETCH_OBJ_IS` joins the opcodes that re-run in the VM, which is what `FETCH_OBJ_R` already does for the same slot state.

The shortcut comes from ace18f49192 (#14298), so 8.4 and later are affected.

The trace stays wrong for as long as the exit is taken; once the side exit gets hot, the side trace is recorded from the deoptimized state and bakes the NULL in permanently.

## Testing

`ext/opcache/tests/jit/fetch_obj_is_unset_prop.phpt` fails without the change and passes with it. On this branch, built with `--enable-debug --enable-opcache`: `ext/opcache/tests` has no new failures (`gh18050.phpt` fails before and after), and `Zend/tests` under `opcache.jit=tracing` is 4970 tests with none failed.

I have not opened a tracking issue; say the word and I will file one and rename the test to `gh<N>.phpt`.