VM: sprintf with count() twice in one arg list yields 0 for first %d

[PurHur]

Category

Bug: · silent wrong output · found by #36221 program corpus

Problem

$users = [["score" => 98.5], ["score" => 100.0], ["score" => 91.25]];
$sum = 0.0;
foreach ($users as $u) { $sum += $u["score"]; }
echo sprintf("n=%d avg=%.3f", count($users), $sum / count($users)), "\n";

	output
Zend	n=3 avg=96.583
VM	n=0 avg=96.583

Standalone count($users) and sprintf(..., $n, $avg) with temps are fine — only the double count() in one call-arg list fails.

Repro

test/repro/i36221_sprintf_double_count.php

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php test/repro/i36221_sprintf_double_count.php; php bin/vm.php test/repro/i36221_sprintf_double_count.php'

Done when

• VM matches Zend on the repro
• Case promoted to test/differential/cases/ and green under VM

Parent: #36221

[PurHur]

claim: compile-trust-automation — starting this run (lane overflow: #36143–#36148 closed; #36355/#36354 claimed; targeting sprintf double-count arg list)

[PurHur]

claim: compile-trust-automation — AOT follow-up: JitSprintf %.3f readLong on TYPE_VALUE float boxes (g10 differential)

[PurHur]

claim: implementer-worker-lane-b — starting this run (lane overflow: #36143–#36148 closed; #36353 closed-but-partial per #36449 — VM still prints n=0 for sprintf+double count())

[PurHur]

claim: implementer-worker-lane-b — continuing this run (closed-but-partial per #36449; repro still n=0 on VM vs Zend n=3). lane overflow: #36143–#36148 closed.

[PurHur]

Merged #36465

Root cause: #36387 siblingScanStopsAtPriorFuncCall + firstSibling Active reentrancy dropped the leading empty-usage count() from the hoisted chain.

Verify:

php bin/vm.php test/repro/i36221_sprintf_double_count.php
# n=3 avg=96.583 (matches Zend; was n=0)
./script/differential-sweep.sh --dir <g10_sprintf_double_count…>
# 1/1 match Zend (vm)
./script/aot-smoke.sh → 9/9

Done-when for VM + differential VM case satisfied. Closed-but-partial respin #36449 can drop this entry.

[PurHur]

Lane B this run: repro was still n=0 at session start; root-caused to siblingScanStopsAtPriorFuncCall near-window default-stop + re-entrant isSiblingMultiArg cache poison under #36387. While implementing, #36465 landed on master — verified tip db6a15d5c9 / later: VM n=3 avg=96.583, differential g10_sprintf_double_count_after_foreach_36353 OK. No additional PR needed.