Tracing JIT: Fixed incorrect guard elimination

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -4130,8 +4130,10 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 									zend_may_throw(opline, ssa_op, op_array, ssa))) {
 								goto jit_failure;
 							}
-							if ((res_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_LONG|MAY_BE_GUARD)
-							 || (res_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_DOUBLE|MAY_BE_GUARD)) {
+							if (((res_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_LONG|MAY_BE_GUARD)
+							  || (res_info & (MAY_BE_ANY|MAY_BE_GUARD)) == (MAY_BE_DOUBLE|MAY_BE_GUARD))
+							 && has_concrete_type(op1_info)
+							 && has_concrete_type(op2_info)) {
 								ssa->var_info[ssa_op->result_def].type &= ~MAY_BE_GUARD;
 							}
 						}

ext/opcache/tests/jit/mul_006.phpt

@@ -0,0 +1,19 @@
+--TEST--
+JIT MUL: 006 incorrect guard elimination 
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+for ($i = 0; $i<6; $i++) {
+    $a + -$a=&$a;
+    $a = 3*$a + 0xff000;
+    $a += $a;
+}
+?>
+DONE
+--EXPECT--
+DONE