Commit d5ab3605e9c for php

commit d5ab3605e9c97c32ba1df3d554603df0618e9d0a
Author: waroad <dohanam2@illinois.edu>
Date:   Sat Oct 24 03:05:46 2026 -0500

    Tracing JIT: keep the SEND_VAL type guard after assigning to a reference

    Assisted-by: Claude

    Closes GH-24436.

diff --git a/NEWS b/NEWS
index bb57e074de6..5ea9ecbafb0 100644
--- a/NEWS
+++ b/NEWS
@@ -119,6 +119,8 @@ PHP                                                                        NEWS
     with chained Pi nodes). (ndossche)
   . Fixed JIT treating an array as packed after a string key write turned it
     into a hash. (jorgsowa)
+  . Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after
+    assigning to a reference). (waroad)

 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index ac942f1952b..8cd125a19d4 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -5131,19 +5131,6 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 								 && ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) {
 									ssa->var_info[ssa_op->op1_def].guarded_reference = 1;
 								}
-								if (opline->result_type == IS_UNUSED) {
-									res_addr = 0;
-								} else {
-									res_addr = RES_REG_ADDR();
-									if (Z_MODE(res_addr) != IS_REG
-									 && zend_jit_trace_next_is_send_result(opline, p, frame)) {
-										send_result = 1;
-										res_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, (opline+1)->result.var);
-										if (!zend_jit_reuse_ip(&ctx)) {
-											goto jit_failure;
-										}
-									}
-								}
 								op1_def_addr = op1_addr;
 								op1_def_info &= ~MAY_BE_REF;
 							} else if (op1_info & MAY_BE_REF) {
@@ -5161,6 +5148,9 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 							res_addr = RES_REG_ADDR();
 							res_info = RES_INFO();
 							if (Z_MODE(res_addr) != IS_REG
+							 /* assignment to typed reference may cause conversion,
+							  * so SEND_VAL has to check the type of the result */
+							 && !ref_addr
 							 && zend_jit_trace_next_is_send_result(opline, p, frame)) {
 								send_result = 1;
 								res_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, (opline+1)->result.var);
diff --git a/ext/opcache/tests/jit/gh24436.phpt b/ext/opcache/tests/jit/gh24436.phpt
new file mode 100644
index 00000000000..cc60764759c
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24436.phpt
@@ -0,0 +1,38 @@
+--TEST--
+GH-24436 (Tracing JIT: wrong value of assignment to typed reference passed as argument)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+class Box {
+    public $v = 1;
+    public float $f = 1;
+    public string $s = "";
+}
+
+function sink($x) {
+    return $x;
+}
+
+function work(&$x, $y) {
+    return sink($x = $y + 2);
+}
+
+$o = new Box;
+foreach (['v', 'v', 'v', 'f', 's'] as $p) {
+    var_dump(work($o->$p, 3));
+}
+var_dump($o->f, $o->s);
+?>
+--EXPECT--
+int(5)
+int(5)
+int(5)
+float(5)
+string(1) "5"
+float(5)
+string(1) "5"