JIT: Fixed incorrect deoptimization info

Author: dstogov

ext/opcache/jit/zend_jit_arm64.dasc

@@ -12832,9 +12832,15 @@ static int zend_jit_incdec_obj(dasm_State          **Dst,
 			 && !ZEND_TYPE_IS_SET(prop_info->type)
 			 && (res_info & MAY_BE_GUARD)
 			 && (res_info & MAY_BE_LONG)) {
-				int32_t exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
-				const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+				zend_jit_trace_stack *stack = JIT_G(current_frame)->stack;
+				uint32_t old_res_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var));
+				int32_t exit_point;
+				const void *exit_addr;
 
+				SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
+				exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
+				exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+				SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
 				ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
 				|	b &exit_addr
 				|.code

ext/opcache/jit/zend_jit_x86.dasc

@@ -13559,9 +13559,15 @@ static int zend_jit_incdec_obj(dasm_State          **Dst,
 			 && !ZEND_TYPE_IS_SET(prop_info->type)
 			 && (res_info & MAY_BE_GUARD)
 			 && (res_info & MAY_BE_LONG)) {
-				int32_t exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
-				const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+				zend_jit_trace_stack *stack = JIT_G(current_frame)->stack;
+				uint32_t old_res_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var));
+				int32_t exit_point;
+				const void *exit_addr;
 
+				SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
+				exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
+				exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+				SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
 				ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
 				|	jmp &exit_addr
 				|.code

ext/opcache/tests/jit/inc_obj_004.phpt

@@ -0,0 +1,38 @@
+--TEST--
+PRE_INC_OBJ: 004
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+class Test {
+    public $prop;
+    function foo() {
+        $this->prop = PHP_INT_MAX-5;
+        for ($i = 0; $i - 15; $i++) {
+            var_dump(++$this->prop);
+        }
+    }
+}
+$test = new Test;
+$test->foo();
+?>
+--EXPECTF--
+int(%d)
+int(%d)
+int(%d)
+int(%d)
+int(%d)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)
+float(%f)