JIT: Fixed register clobbering

ext/opcache/jit/zend_jit_x86.dasc

@@ -5924,6 +5924,9 @@ static int zend_jit_simple_assign(dasm_State    **Dst,
 					|.cold_code
 					|1:
 				}
+				if (Z_REG(val_addr) == ZREG_R2) {
+					|	mov aword T1, r2 // save
+				}
 				|	// zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
 				|	GET_ZVAL_PTR r2, val_addr
 				|	GC_DELREF r2
@@ -5948,6 +5951,9 @@ static int zend_jit_simple_assign(dasm_State    **Dst,
 					|	GC_ADDREF Ra(tmp_reg)
 					|2:
 				}
+				if (Z_REG(val_addr) == ZREG_R2) {
+					|	mov r2, aword T1 // restore
+				}
 				if (save_r1) {
 					|	mov aword T1, FCARG1a // save
 				}

ext/opcache/tests/jit/assign_042.phpt

@@ -0,0 +1,28 @@
+--TEST--
+JIT ASSIGN: Assign to of reference with 1 refcount
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+class Test {
+    public $prop;
+    function __construct() {
+        $this->prop = $this->retref();
+    }
+    function &retref() {
+        return str_repeat("a", 5);
+    }
+}
+$o = new Test();
+var_dump($o);
+?>
+--EXPECTF--
+Notice: Only variable references should be returned by reference in %sassign_042.php on line 8
+object(Test)#1 (1) {
+  ["prop"]=>
+  string(5) "aaaaa"
+}