Commit 32f9db9bad4 for php

commit 32f9db9bad42b566b5895c58f4e547756c0907d2
Author: Lazizbek Ergashev <lazerg2@gmail.com>
Date:   Tue Oct 6 15:09:22 2026 +0500

    Fix GH-24154: Function JIT ++/-- on typed property holding a reference (#24155)

diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
index ec8554aa185..cfb25d72cb8 100644
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@ -2991,7 +2991,8 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i
 	zend_execute_data *execute_data = EG(current_execute_data);
 	zval tmp;

-	ZVAL_COPY_DEREF(&tmp, var_ptr);
+	ZVAL_DEREF(var_ptr);
+	ZVAL_COPY(&tmp, var_ptr);

 	increment_function(var_ptr);

@@ -3022,7 +3023,8 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i
 	zend_execute_data *execute_data = EG(current_execute_data);
 	zval tmp;

-	ZVAL_COPY_DEREF(&tmp, var_ptr);
+	ZVAL_DEREF(var_ptr);
+	ZVAL_COPY(&tmp, var_ptr);

 	decrement_function(var_ptr);

diff --git a/ext/opcache/tests/jit/gh24154.phpt b/ext/opcache/tests/jit/gh24154.phpt
new file mode 100644
index 00000000000..6488eb1805b
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24154.phpt
@@ -0,0 +1,39 @@
+--TEST--
+GH-24154 (Function JIT: ++/-- on a typed property holding a reference throws TypeError)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=function
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+class Test
+{
+    public int $value = 0;
+
+    public function inc(): void
+    {
+        $this->value++;
+    }
+
+    public function dec(): void
+    {
+        $this->value--;
+    }
+}
+
+$test = new Test();
+$ref = &$test->value;
+$test->inc();
+var_dump($test->value);
+$test->dec();
+$test->dec();
+var_dump($test->value, $ref);
+?>
+--EXPECT--
+int(1)
+int(-1)
+int(-1)