JIT: Fixed incorrect guard elimination

ext/opcache/jit/zend_jit_trace.c

@@ -969,6 +969,11 @@ static int is_checked_guard(const zend_ssa *tssa, const zend_op **ssa_opcodes, u
 				 && (opline->extended_value == ZEND_ADD
 				  || opline->extended_value == ZEND_SUB
 				  || opline->extended_value == ZEND_MUL)) {
+					if ((opline->op2_type & (IS_VAR|IS_CV))
+					  && tssa->ops[idx].op2_use >= 0
+					  && (tssa->var_info[tssa->ops[idx].op2_use].type & MAY_BE_REF)) {
+						return 0;
+					}
 					return 1;
 				}
 			}
@@ -981,6 +986,16 @@ static int is_checked_guard(const zend_ssa *tssa, const zend_op **ssa_opcodes, u
 				 || opline->opcode == ZEND_PRE_INC
 				 || opline->opcode == ZEND_POST_DEC
 				 || opline->opcode == ZEND_POST_INC) {
+					if ((opline->op1_type & (IS_VAR|IS_CV))
+					  && tssa->ops[idx].op1_use >= 0
+					  && (tssa->var_info[tssa->ops[idx].op1_use].type & MAY_BE_REF)) {
+						return 0;
+					}
+					if ((opline->op2_type & (IS_VAR|IS_CV))
+					  && tssa->ops[idx].op2_use >= 0
+					  && (tssa->var_info[tssa->ops[idx].op2_use].type & MAY_BE_REF)) {
+						return 0;
+					}
 					return 1;
 				}
 			}
@@ -4218,7 +4233,9 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 								zend_may_throw(opline, ssa_op, op_array, ssa))) {
 							goto jit_failure;
 						}
-						if ((op1_def_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_LONG|MAY_BE_GUARD)) {
+						if ((op1_def_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_LONG|MAY_BE_GUARD)
+						 && has_concrete_type(op1_info)
+						 && has_concrete_type(op2_info)) {
 							ssa->var_info[ssa_op->op1_def].type &= ~MAY_BE_GUARD;
 							if (opline->result_type != IS_UNUSED) {
 								ssa->var_info[ssa_op->result_def].type &= ~MAY_BE_GUARD;

ext/opcache/tests/jit/assign_op_004.phpt

@@ -0,0 +1,25 @@
+--TEST--
+JIT ASSIGN_OP: 004
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+function test() {
+    $a =& $v;
+    $a = 0;
+    $b = 0; 
+    for ($i = 0; $i < 10; $i++) {
+        $a *= 64;
+        $b += $a;
+        $a += $b + $a;
+        $a++;
+    }
+}
+test(); 
+?>
+DONE
+--EXPECT--
+DONE