JIT: Fixed incorrect guard elimination

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -953,7 +953,8 @@ static const zend_op *zend_jit_trace_find_init_fcall_op(zend_jit_trace_rec *p, c
 
 static int is_checked_guard(const zend_ssa *tssa, const zend_op **ssa_opcodes, uint32_t var, uint32_t phi_var)
 {
-	if ((tssa->var_info[phi_var].type & MAY_BE_ANY) == MAY_BE_LONG) {
+	if ((tssa->var_info[phi_var].type & MAY_BE_ANY) == MAY_BE_LONG
+	 && !(tssa->var_info[var].type & MAY_BE_REF)) {
 		int idx = tssa->vars[var].definition;
 
 		if (idx >= 0) {

ext/opcache/tests/jit/assign_op_003.phpt

@@ -0,0 +1,22 @@
+--TEST--
+JIT ASSIGN_OP: 003
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+function test() {
+    $a = 0;
+    for ($i = 0; $i < 10; $i++) {
+        $a += $a;
+        $a =& $x;
+        $a += $a;
+    }
+}
+test();
+?>
+DONE
+--EXPECT--
+DONE