Function JIT: ++/-- on a typed property holding a reference throws TypeError #24154

Description

The following code:

<?php
class Test
{
    public int $value = 0;

    public function inc(): void
    {
        $this->value++;
    }
}

$test = new Test();
$ref = &$test->value;
$test->inc();
var_dump($test->value);

Run with php -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit=function repro.php

Resulted in this output:

Fatal error: Uncaught TypeError: Cannot assign int to property Test::$value of type int in /path/to/repro.php:8
Stack trace:
#0 /path/to/repro.php(14): Test->inc()
#1 {main}
  thrown in /path/to/repro.php on line 8

But I expected this output instead:

int(1)

$this->value-- fails the same way. It works as expected with opcache.jit=disable and opcache.jit=tracing.

This looks like a regression from 1b2bde4 (GH-24071). In zend_jit_inc_typed_prop() / zend_jit_dec_typed_prop(), ZVAL_DEREF(var_ptr); ZVAL_COPY(&tmp, var_ptr); was replaced with ZVAL_COPY_DEREF(&tmp, var_ptr);, which only dereferences the copy. var_ptr keeps pointing at the reference, so the property type check fails, and the error path then calls zval_ptr_dtor() on the reference and overwrites the property slot.

Function JIT calls these helpers directly when the result of the increment/decrement is unused.
Restoring the explicit dereference fixes maybe:

--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@ -2991,7 +2991,8 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i
 	zend_execute_data *execute_data = EG(current_execute_data);
 	zval tmp;
 
-	ZVAL_COPY_DEREF(&tmp, var_ptr);
+	ZVAL_DEREF(var_ptr);
+	ZVAL_COPY(&tmp, var_ptr);
 
 	increment_function(var_ptr);
 
@@ -3022,7 +3023,8 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i
 	zend_execute_data *execute_data = EG(current_execute_data);
 	zval tmp;
 
-	ZVAL_COPY_DEREF(&tmp, var_ptr);
+	ZVAL_DEREF(var_ptr);
+	ZVAL_COPY(&tmp, var_ptr);
 
 	decrement_function(var_ptr);
 

Operating System

Linux aarch64 / Ubuntu 24.04.5 LTS

PHP Version

PHP 8.7.0-dev (cli) (built: Sep 30 2026 13:00:09) (NTS)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.7.0-dev, Copyright ©, by Zend by Perforce