Commit 061f0ce2935 for php

commit 061f0ce293557c53075756fff894dcc8559b2930
Author: aasim <aasim.slmns@eduge.ch>
Date:   Mon Oct 26 06:39:27 2026 +0100

    Fix GH-24438: Preserve indirect types in JIT side traces

    Closes GH-24699.

diff --git a/NEWS b/NEWS
index af1e0b8055e..0ee1428ba23 100644
--- a/NEWS
+++ b/NEWS
@@ -126,6 +126,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-17733 (System entropy does not take into account function
     order, resulting in wrong functions possibly called
     in different configurations). (ndossche)
+  . Fixed bug GH-24438 (Preserve indirect types in JIT side traces). (aasul)

 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index 8cd125a19d4..413c28d1127 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -1714,7 +1714,7 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 				if (i < op_array->last_var) {
 					ssa_var_info[i].type = MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY  | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				} else {
-					ssa_var_info[i].type = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					ssa_var_info[i].type = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_INDIRECT | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				}
 			}
 			if (i < parent_vars_count) {
diff --git a/ext/opcache/tests/jit/gh24438.phpt b/ext/opcache/tests/jit/gh24438.phpt
new file mode 100644
index 00000000000..43ab8f9a5bd
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24438.phpt
@@ -0,0 +1,40 @@
+--TEST--
+GH-24438 (Tracing JIT preserves indirect arguments on side-trace entry)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+opcache.jit_hot_func=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+opcache.jit_max_polymorphic_calls=0
+--FILE--
+<?php
+function byVal($value) {
+    $value = (int) $value + 1000;
+    return $value;
+}
+
+function byRef(&$value) {
+    $value = (int) $value + 1;
+    return $value;
+}
+
+$fns = ['byVal', 'byRef'];
+$arr = [10, 20];
+for ($i = 0; $i < 120; $i++) {
+    $f = $fns[$i % 2];
+    $f($arr[1]);
+    $f($arr[0]);
+}
+
+var_dump($arr[0], $arr[1]);
+?>
+--EXPECT--
+int(70)
+int(80)