Result of ASSIGN may be different from the assigned value when LHS is a typed reference

diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index c472e49213cbf534dbb996ef294ec9f7e0662674..242ab347dadbaa2859e2e6fdf8f2ccaa344e9390 100644 (file)
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -2711,7 +2711,10 @@ done:
                                                type = STACK_VAR_TYPE(opline->op1.var);
                                        }
                                } else if (opline->opcode == ZEND_ASSIGN) {
-                                       if (opline->op2_type != IS_CONST) {
+                                       if (opline->op2_type != IS_CONST
+                                        && ssa_op->op1_use >= 0
+                                        /* assignment to typed reference may cause conversion */
+                                        && (ssa->var_info[ssa_op->op1_use].type & MAY_BE_REF) == 0) {
                                                /* copy */
                                                type = STACK_VAR_TYPE(opline->op2.var);
                                        }