[php-src] master: Fix GH-24154: Function JIT ++/-- on typed property holding a reference (#24155)

Author: Lazizbek Ergashev (lazerg) Committer: GitHub (web-flow) Pusher: ndossche Date: 2026-10-06T12:09:22+02:00 Commit: https://github.com/php/php-src/commit/32f9db9bad42b566b5895c58f4e547756c0907d2 Raw diff: https://github.com/php/php-src/commit/32f9db9bad42b566b5895c58f4e547756c0907d2.diff Fix GH-24154: Function JIT ++/-- on typed property holding a reference (#24155) Changed paths: A ext/opcache/tests/jit/gh24154.phpt M ext/opcache/jit/zend_jit_helpers.c Diff: diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c index ec8554aa1857..cfb25d72cb8a 100644 --- a/ext/opcache/jit/zend_jit_helpers.c +++ b/ext/opcache/jit/zend_jit_helpers.c @@ -2991,7 +2991,8 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i zend_execute_data *execute_data = EG(current_execute_data); zval tmp; - ZVAL_COPY_DEREF(&tmp, var_ptr); + ZVAL_DEREF(var_ptr); + ZVAL_COPY(&tmp, var_ptr); increment_function(var_ptr); @@ -3022,7 +3023,8 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i zend_execute_data *execute_data = EG(current_execute_data); zval tmp; - ZVAL_COPY_DEREF(&tmp, var_ptr); + ZVAL_DEREF(var_ptr); + ZVAL_COPY(&tmp, var_ptr); decrement_function(var_ptr); diff --git a/ext/opcache/tests/jit/gh24154.phpt b/ext/opcache/tests/jit/gh24154.phpt new file mode 100644 index 000000000000..6488eb1805bf --- /dev/null +++ b/ext/opcache/tests/jit/gh24154.phpt @@ -0,0 +1,39 @@ +--TEST-- +GH-24154 (Function JIT: ++/-- on a typed property holding a reference throws TypeError) +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit_buffer_size=64M +opcache.jit=function +--EXTENSIONS-- +opcache +--FILE-- +<?php +class Test +{ + public int $value = 0; + + public function inc(): void + { + $this->value++; + } + + public function dec(): void + { + $this->value--; + } +} + +$test = new Test(); +$ref = &$test->value; +$test->inc(); +var_dump($test->value); +$test->dec(); +$test->dec(); +var_dump($test->value, $ref); +?> +--EXPECT-- +int(1) +int(-1) +int(-1)