Fixed incorrect JIT compilation

Author: dstogov

ext/opcache/jit/zend_jit_x86.dasc

@@ -3505,7 +3505,8 @@ static int zend_jit_math(dasm_State **Dst, const zend_op *opline, int *opnum, ze
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {
@@ -3839,7 +3840,8 @@ static int zend_jit_long_math(dasm_State **Dst, const zend_op *opline, int *opnu
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {
@@ -3980,7 +3982,8 @@ static int zend_jit_concat(dasm_State **Dst, const zend_op *opline, int *opnum,
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {

ext/opcache/tests/jit/send_val_001.phpt

@@ -0,0 +1,23 @@
+--TEST--
+JIT SEND_VAL: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function foo($type) {
+        $key = md5(
+            is_array($type) ? \implode('_', $type) : $type .
+            "ops"
+        );
+		return $key;
+}
+var_dump(foo("int"));
+var_dump(foo(["int"]));
+--EXPECT--
+string(32) "253a948ecc9192cb47e492f692aa63a8"
+string(32) "fa7153f7ed1cb6c0fcf2ffb2fac21748"