Tracing JIT: Fixed incorrect code generation fofr SEND-ing of result of ASSIGN to typed reference

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -4979,6 +4979,14 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 									res_addr = 0;
 								} else {
 									res_addr = RES_REG_ADDR();
+									if (Z_MODE(res_addr) != IS_REG
+									 && zend_jit_trace_next_is_send_result(opline, p, frame)) {
+										send_result = 1;
+										res_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, (opline+1)->result.var);
+										if (!zend_jit_reuse_ip(&dasm_state)) {
+											goto jit_failure;
+										}
+									}
 								}
 								if (!zend_jit_assign_to_typed_ref(&dasm_state, opline, opline->op2_type, op2_addr, res_addr, 1)) {
 									goto jit_failure;

ext/opcache/tests/jit/assign_056.phpt

@@ -0,0 +1,21 @@
+--TEST--
+JIT ASSIGN: ASSING+SEND and typed reference
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+class Test {
+    static ?Test $test;
+}
+
+$a = new Test;
+Test::$test = &$a;
+var_dump($a = new Test);
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}