Fixed trace type inference

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -1862,6 +1862,14 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 						ADD_OP1_TRACE_GUARD();
 					}
 					break;
+				case ZEND_ADD:
+				case ZEND_SUB:
+				case ZEND_MUL:
+//				case ZEND_DIV: // TODO: check for division by zero ???
+					if (orig_op1_type == IS_UNDEF || orig_op2_type == IS_UNDEF) {
+						break;
+					}
+					ZEND_FALLTHROUGH;
 				case ZEND_IS_EQUAL:
 				case ZEND_IS_NOT_EQUAL:
 				case ZEND_IS_SMALLER:
@@ -1876,10 +1884,6 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 				case ZEND_SL:
 				case ZEND_SR:
 				case ZEND_MOD:
-				case ZEND_ADD:
-				case ZEND_SUB:
-				case ZEND_MUL:
-//				case ZEND_DIV: // TODO: check for division by zero ???
 					ADD_OP2_TRACE_GUARD();
 					ZEND_FALLTHROUGH;
 				case ZEND_ECHO:

ext/opcache/tests/jit/add_015.phpt

@@ -0,0 +1,22 @@
+--TEST--
+JIT ADD: 014 incorrect guard elimination
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+function test() {
+	$j = 0;
+    for ($i = 0; $i < 41; $i++) {
+        $a &= $a &= $aZ - $a;
+        $aZ = $a;
+        $a &= $a &= $aZ = $a;
+        $aZ = $a;
+        $a = &$a + $e = $a-- +$a &= $a &= $a &= $aZ = $a;
+    }
+}
+@test();
+?>
+DONE
+--EXPECT--
+DONE