Fix GH-24438: Preserve indirect types in JIT side traces

Author: aasul

ext/opcache/jit/zend_jit_trace.c

@@ -1714,7 +1714,7 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 				if (i < op_array->last_var) {
 					ssa_var_info[i].type = MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY  | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				} else {
-					ssa_var_info[i].type = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					ssa_var_info[i].type = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_INDIRECT | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				}
 			}
 			if (i < parent_vars_count) {

ext/opcache/tests/jit/gh24438.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-24438 (Tracing JIT preserves indirect arguments on side-trace entry)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+opcache.jit_hot_func=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+opcache.jit_max_polymorphic_calls=0
+--FILE--
+<?php
+function byVal($value) {
+    $value = (int) $value + 1000;
+    return $value;
+}
+
+function byRef(&$value) {
+    $value = (int) $value + 1;
+    return $value;
+}
+
+$fns = ['byVal', 'byRef'];
+$arr = [10, 20];
+for ($i = 0; $i < 120; $i++) {
+    $f = $fns[$i % 2];
+    $f($arr[1]);
+    $f($arr[0]);
+}
+
+var_dump($arr[0], $arr[1]);
+?>
+--EXPECT--
+int(70)
+int(80)