From 79a67d45d01e5014d20639aa38e4363b9eab2b81 Mon Sep 17 00:00:00 2001
From: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:09:49 +0200
Subject: [PATCH] Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg
 forwarding" with chained Pi nodes

It's possible for back-edge Pi nodes, that it gets forwarded, but due to
the ordering in which BBs are generated, that at the point it wants to
get forwarded that it was not generated yet.
---
 ext/opcache/jit/zend_jit_ir.c      |  4 +++-
 ext/opcache/tests/jit/gh24396.phpt | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/opcache/tests/jit/gh24396.phpt

diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 92a068dbfaca..84e1e668e63d 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -1398,7 +1398,9 @@ static void zend_jit_def_reg(zend_jit_ctx *jit, zend_jit_addr addr, ir_ref val)
 			if (dst_phi->pi >= 0) {
 				jit->ra[src_var].ref = val;
 				src_var = dst_phi->ssa_var;
-				if (!(jit->ra[src_var].flags & ZREG_FORWARD)) {
+				if (!(jit->ra[src_var].flags & ZREG_FORWARD)
+				 /* Pi in a block that is not generated yet. It forwards later on its own. */
+				 || (jit->bb_start_ref && !jit->bb_start_ref[dst_phi->block])) {
 					phi = zend_ssa_next_use_phi(jit->ssa, var, phi);
 					continue;
 				}
diff --git a/ext/opcache/tests/jit/gh24396.phpt b/ext/opcache/tests/jit/gh24396.phpt
new file mode 100644
index 000000000000..0ad5696b208f
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24396.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=function
+--FILE--
+<?php
+function f() {
+    $i = 0;
+    do {
+        $i = ($i + 1) & 255;
+    } while ($i < 2 || $i > 200);
+    return $i;
+}
+var_dump(f());
+?>
+--EXPECT--
+int(2)