From 54452b4811de1b95b2c8d486a41a1f7686bf8fcf Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 3 Oct 2023 13:22:33 +0300
Subject: [PATCH] Fixed GH-12262: Tracing JIT assertion crash when using
 phpstan

---
 Zend/Optimizer/zend_inference.c    |  2 +-
 ext/opcache/tests/jit/gh12262.phpt | 43 ++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 ext/opcache/tests/jit/gh12262.phpt

diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
index 91a142a9f86..4cc9f70c27f 100644
--- a/Zend/Optimizer/zend_inference.c
+++ b/Zend/Optimizer/zend_inference.c
@@ -2177,7 +2177,7 @@ static zend_property_info *zend_fetch_prop_info(const zend_op_array *op_array, z
 	if (opline->op2_type == IS_CONST) {
 		zend_class_entry *ce = NULL;
 
-		if (opline->op1_type == IS_UNUSED) {
+		if (opline->op1_type == IS_UNUSED && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
 			ce = op_array->scope;
 		} else if (ssa_op->op1_use >= 0) {
 			ce = ssa->var_info[ssa_op->op1_use].ce;
diff --git a/ext/opcache/tests/jit/gh12262.phpt b/ext/opcache/tests/jit/gh12262.phpt
new file mode 100644
index 00000000000..66ac918a520
--- /dev/null
+++ b/ext/opcache/tests/jit/gh12262.phpt
@@ -0,0 +1,43 @@
+--TEST--
+GH-12262: Tracing JIT assertion crash when using phpstan
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_hot_func=2
+--FILE--
+<?php
+class C {
+}
+trait T {
+    public function equal(C $type): bool {
+        return $type instanceof self && $this->value === $type->value;
+    }
+}
+class C1 extends C {
+    use T;
+    public function __construct(private int $value) {
+    }
+}
+class C2 extends C {
+    use T;
+	public function __construct(private string $value) {
+	}
+}
+$x = new C1(1);
+var_dump($x->equal($x));
+var_dump($x->equal($x));
+var_dump($x->equal($x));
+
+$a = new C2("aaa");
+var_dump($a->equal($a));
+var_dump($a->equal($a));
+var_dump($a->equal($a));
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)