Bug with JIT / Opcache on float / int calculation

[ahfeel]

Description

The following code:

<?php

function calculateHealthScore(float $p, int $s): int
{
    if ($p === 0.0) {
        return 0;
    }

    $partnerIncreasedSales = $s * 1.5;

    if ($p + $partnerIncreasedSales < 0) {
        return (int) round(($partnerIncreasedSales / abs($p)) * 100);
    }

    return 100;
}

$x = unserialize(file_get_contents('vars.txt'));

foreach ($x as $affiliateId => $affiliateStats) {
    $x[$affiliateId]['health'] = calculateHealthScore(
        $x[$affiliateId]['profitability'],
        $x[$affiliateId]['sales_nb']
    );
}

var_dump($x[2376086]);

Resulted in this output ON THE FIRST RUN:

array(4) {
  ["sales_nb"]=>
  string(1) "7"
  ["affiliate"]=>
  int(2376086)
  ["profitability"]=>
  string(6) "-13.45"
  ["health"]=>
  int(78)
}

Then resulted in this output ON THE SECOND RUN

array(4) {
  ["sales_nb"]=>
  string(1) "7"
  ["affiliate"]=>
  int(2376086)
  ["profitability"]=>
  string(6) "-13.45"
  ["health"]=>
  int(0)
}

But I expected this output instead:

array(4) {
  ["sales_nb"]=>
  string(1) "7"
  ["affiliate"]=>
  int(2376086)
  ["profitability"]=>
  string(6) "-13.45"
  ["health"]=>
  int(78)
}

When running again with the -d opcache.jit=0 option:

array(4) {
  ["sales_nb"]=>
  string(1) "7"
  ["affiliate"]=>
  int(2376086)
  ["profitability"]=>
  string(6) "-13.45"
  ["health"]=>
  int(78)
}

vars.txt

Changing the $p parameter from float to string fixes the issue :-/

PHP Version

PHP 8.5.5 (cli) (built: Apr  9 2026 22:14:19) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.5, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.5, Copyright (c), by Zend Technologies

Operating System

Tested on Ubuntu, Debian and PHP in Docker

[devnexen]

Hi @ahfeel another possible workaround is to avoid the comparison with 0

if (-$partnerIncreasedSales > $p) {

[devnexen]

Both x86 and arm64 are affected.

[ahfeel]

@devnexen thanks for acknowledging the bug quickly and for the trick !

[SakiTakamachi]

A smaller reproducer:

<?php

$x = [
    1, 20, 87, 1, 10, 41, 75, 19,
    2, 9, 181, 34, 5, 1, 315, 2,
    5, 127, 4, 1, 1, 40, 417, 19,
    2006, 5, 1, 53, 1, 1, 15, 30,
    257, 241, 1, 120, 56, 170, 30, 21,
    3, 190, 482, 14, 4, 169, 19, 33,
    3, 28, 66, 11, 93, 10538, 5, 1,
    4, 6, 74, 55, 12, 27, 24, 5,
];

function f(int $s): void
{
    $v = $s * 1.5;

    if (-13.45 + $v < 0) {
        if ($s * 1.5 !== $v) {
            echo 'mismatch!' . "\n";
        }
    }
}

foreach ($x as $s) {
    f($s);
}

Incidentally, this issue does not occur when using opcache.jit=function instead of opcache.jit=tracing.