Fix JIT SWITCH_STRING type checks on referenced operand

The tracing guard checked IS_LONG instead of IS_STRING after ZVAL_DEREF,
passing a non-string to zend_hash_find(). The function JIT path checked
IS_STRING instead of IS_REFERENCE, so the deref fast path was dead.

Closes GH-24796.

Author: jorgsowa

NEWS

@@ -159,6 +159,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT
     buffer accounting). (ndossche)
   . Call orig_post_shutdown_cb(). (ndossche)
+  . Fixed JIT segfault on switch over a string reference holding a
+    non-string value. (jorgsowa)
 
 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.

ext/opcache/jit/zend_jit_ir.c

@@ -16247,7 +16247,7 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 					if (fallback_label) {
 						jit_guard_Z_TYPE(jit, op1_addr, IS_REFERENCE, fallback_label);
 					} else {
-						ir_ref if_ref = jit_if_Z_TYPE(jit, op1_addr, IS_STRING);
+						ir_ref if_ref = jit_if_Z_TYPE(jit, op1_addr, IS_REFERENCE);
 						ir_IF_FALSE_cold(if_ref);
 						ir_refs_add(slow_inputs, ir_END());
 						ir_IF_TRUE(if_ref);
@@ -16257,7 +16257,7 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 					op1_addr = ZEND_ADDR_REF_ZVAL(ref2);
 
 					if (fallback_label) {
-						jit_guard_Z_TYPE(jit, op1_addr, IS_LONG, fallback_label);
+						jit_guard_Z_TYPE(jit, op1_addr, IS_STRING, fallback_label);
 					} else {
 						if_string = jit_if_Z_TYPE(jit, op1_addr, IS_STRING);
 						ir_IF_FALSE_cold(if_string);

ext/opcache/tests/jit/switch_002.phpt

@@ -0,0 +1,27 @@
+--TEST--
+JIT SWITCH_STRING on a reference holding a non-string value
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test($a) {
+    $n = 0;
+    foreach ($a as &$x) {
+        switch ($x) {
+            case "a": case "b": $n++; break;
+        }
+    }
+    return $n;
+}
+var_dump(test(["a"]));
+var_dump(test([1]));
+?>
+--EXPECT--
+int(1)
+int(0)

ext/opcache/tests/jit/switch_003.phpt

@@ -0,0 +1,26 @@
+--TEST--
+JIT SWITCH_STRING on a reference (function JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=function
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test($a) {
+    $n = 0;
+    foreach ($a as &$x) {
+        switch ($x) {
+            case "a": case "b": $n++; break;
+        }
+    }
+    return $n;
+}
+var_dump(test(["a", "b", "c"]));
+var_dump(test([1]));
+?>
+--EXPECT--
+int(2)
+int(0)