Fixed use-after-free introduced in f2ceb63

Author: dstogov

ext/opcache/jit/zend_jit_arm64.dasc

@@ -12125,10 +12125,6 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 			}
 		}
 	}
-	if (op1_avoid_refcounting) {
-		SET_STACK_REG(JIT_G(current_frame)->stack,
-			EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
-	}
 	if (opline->opcode == ZEND_FETCH_OBJ_W) {
 		if (Z_REG(prop_addr) != ZREG_FCARG1 || Z_OFFSET(prop_addr) != 0) {
 			|	LOAD_ZVAL_ADDR FCARG1x, prop_addr
@@ -12174,6 +12170,10 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 				exit_point = zend_jit_trace_get_exit_point(opline, 0);
 				exit_addr = zend_jit_trace_get_exit_addr(exit_point);
 			} else {
+				if (op1_avoid_refcounting) {
+					SET_STACK_REG(JIT_G(current_frame)->stack,
+						EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
+				}
 				old_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var));
 				SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_UNKNOWN, 1);
 				SET_STACK_REG(stack, EX_VAR_TO_NUM(opline->result.var), ZREG_ZVAL_COPY_GPR0);
@@ -12223,6 +12223,11 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 		}
 	}
 
+	if (op1_avoid_refcounting) {
+		SET_STACK_REG(JIT_G(current_frame)->stack,
+			EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
+	}
+
 	|.cold_code
 
 	if (JIT_G(trigger) != ZEND_JIT_ON_HOT_TRACE || !prop_info) {

ext/opcache/jit/zend_jit_x86.dasc

@@ -12832,10 +12832,6 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 			}
 		}
 	}
-	if (op1_avoid_refcounting) {
-		SET_STACK_REG(JIT_G(current_frame)->stack,
-			EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
-	}
 	if (opline->opcode == ZEND_FETCH_OBJ_W) {
 		if (Z_REG(prop_addr) != ZREG_FCARG1 || Z_OFFSET(prop_addr) != 0) {
 			|	LOAD_ZVAL_ADDR FCARG1a, prop_addr
@@ -12881,6 +12877,10 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 				exit_point = zend_jit_trace_get_exit_point(opline, 0);
 				exit_addr = zend_jit_trace_get_exit_addr(exit_point);
 			} else {
+				if (op1_avoid_refcounting) {
+					SET_STACK_REG(JIT_G(current_frame)->stack,
+						EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
+				}
 				old_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var));
 				SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_UNKNOWN, 1);
 				SET_STACK_REG(stack, EX_VAR_TO_NUM(opline->result.var), ZREG_ZVAL_COPY_GPR0);
@@ -12928,6 +12928,11 @@ static int zend_jit_fetch_obj(dasm_State          **Dst,
 		}
 	}
 
+	if (op1_avoid_refcounting) {
+		SET_STACK_REG(JIT_G(current_frame)->stack,
+			EX_VAR_TO_NUM(opline->op1.var), ZREG_NONE);
+	}
+
 	|.cold_code
 
 	if (JIT_G(trigger) != ZEND_JIT_ON_HOT_TRACE || !prop_info) {