From 8f5156fcba9906664ecd97e4c279ee980e522121 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 27 Nov 2023 22:52:12 +0300
Subject: [PATCH] Fixed trace type inference

---
 ext/opcache/jit/zend_jit_trace.c   | 12 ++++++++----
 ext/opcache/tests/jit/add_015.phpt | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 ext/opcache/tests/jit/add_015.phpt

diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index fcdcad1507d..eb4798446cc 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -1862,6 +1862,14 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 						ADD_OP1_TRACE_GUARD();
 					}
 					break;
+				case ZEND_ADD:
+				case ZEND_SUB:
+				case ZEND_MUL:
+//				case ZEND_DIV: // TODO: check for division by zero ???
+					if (orig_op1_type == IS_UNDEF || orig_op2_type == IS_UNDEF) {
+						break;
+					}
+					ZEND_FALLTHROUGH;
 				case ZEND_IS_EQUAL:
 				case ZEND_IS_NOT_EQUAL:
 				case ZEND_IS_SMALLER:
@@ -1876,10 +1884,6 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 				case ZEND_SL:
 				case ZEND_SR:
 				case ZEND_MOD:
-				case ZEND_ADD:
-				case ZEND_SUB:
-				case ZEND_MUL:
-//				case ZEND_DIV: // TODO: check for division by zero ???
 					ADD_OP2_TRACE_GUARD();
 					ZEND_FALLTHROUGH;
 				case ZEND_ECHO:
diff --git a/ext/opcache/tests/jit/add_015.phpt b/ext/opcache/tests/jit/add_015.phpt
new file mode 100644
index 00000000000..6fcded2fe1f
--- /dev/null
+++ b/ext/opcache/tests/jit/add_015.phpt
@@ -0,0 +1,22 @@
+--TEST--
+JIT ADD: 014 incorrect guard elimination
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+function test() {
+	$j = 0;
+    for ($i = 0; $i < 41; $i++) {
+        $a &= $a &= $aZ - $a;
+        $aZ = $a;
+        $a &= $a &= $aZ = $a;
+        $aZ = $a;
+        $a = &$a + $e = $a-- +$a &= $a &= $a &= $aZ = $a;
+    }
+}
+@test();
+?>
+DONE
+--EXPECT--
+DONE
\ No newline at end of file