Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  JIT: Fix OP_DATA read from an unwritten slot in zend_jit_assign_dim_op()

NEWS

@@ -71,6 +71,8 @@ PHP                                                                        NEWS
     is reloaded from memory). (ndossche)
   . Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
     reference check). (ndossche)
+  . Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
+    zend_jit_assign_dim_op()). (waroad)
 
 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.

ext/opcache/jit/zend_jit_ir.c

@@ -13670,9 +13670,10 @@ static int zend_jit_assign_dim_op(zend_jit_ctx   *jit,
 						if (!zend_jit_spill_store_inv(jit, op3_addr, real_addr, op1_data_info)) {
 							return 0;
 						}
-						op3_addr = real_addr;
+						arg2 = jit_ZVAL_ADDR(jit, real_addr);
+					} else {
+						arg2 = jit_ZVAL_ADDR(jit, op3_addr);
 					}
-					arg2 = jit_ZVAL_ADDR(jit, op3_addr);
 					ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_assign_op_to_typed_ref),
 						reference, arg2, ir_CONST_FC_FUNC(binary_op));
 

ext/opcache/tests/jit/gh24437.phpt

@@ -0,0 +1,50 @@
+--TEST--
+GH-24437 (JIT: tracing JIT gives wrong sum for `$a[0] += $i + 1` on an array parameter in a loop)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+class C {
+    public int $prop = 10;
+}
+
+function f($a) {
+    for ($i = 0; $i < 3; $i++) {
+        @$a[0] += $i + 1;
+    }
+    return $a[0];
+}
+
+function g(array $a) {
+    for ($i = 0; $i < 3; $i++) {
+        $a[0] += $i + 1;
+    }
+    return $a[0];
+}
+
+function h($a) {
+    for ($i = 0; $i < 3; $i++) {
+        $a[2] %= $i + 1;
+        $x = $a[0] %= 1;
+    }
+}
+
+var_dump(f([1 => 2]));
+$x = 10;
+var_dump(g([&$x]), $x);
+$c = new C;
+var_dump(g([&$c->prop]), $c->prop);
+@h([]);
+?>
+DONE
+--EXPECT--
+int(6)
+int(16)
+int(16)
+int(16)
+int(16)
+DONE