Fix block pass dropping a JMP across an unreachable_free block

NEWS

@@ -54,6 +54,8 @@ PHP                                                                        NEWS
   . Fixed a tracing JIT crash when compiling a side trace for a method of a
     class that could not be stored in the inheritance cache. (GH-21710)
     (Arnaud, iliaal)
+  . Fixed a ZEND_JMP being removed across an unreachable block that is kept
+    alive for its loop variable frees. (Mrmaxmeier)
 
 - PDO:
   . Fixed a leak when a persistent connection failed a liveness check

Zend/Optimizer/block_pass.c

@@ -950,7 +950,12 @@ static void assemble_code_blocks(zend_cfg *cfg, zend_op_array *op_array, zend_op
 			if (opline->opcode == ZEND_JMP) {
 				zend_basic_block *next = b + 1;
 
-				while (next < end && !(next->flags & ZEND_BB_REACHABLE)) {
+				/* Unreachable blocks that are kept alive for their loop var
+				 * frees are emitted as well, so they still separate this block
+				 * from its successor. */
+				while (next < end
+				 && !(next->flags & ZEND_BB_REACHABLE)
+				 && !((next->flags & ZEND_BB_UNREACHABLE_FREE) && next->len != 0)) {
 					next++;
 				}
 				if (next < end && next == blocks + b->successors[0]) {
@@ -1149,6 +1154,11 @@ static zend_always_inline zend_basic_block *get_next_block(const zend_cfg *cfg,
 			return NULL;
 		} else if (next_block->flags & ZEND_BB_REACHABLE) {
 			break;
+		} else if ((next_block->flags & ZEND_BB_UNREACHABLE_FREE) && next_block->len != 0) {
+			/* This block is unreachable, but it is still emitted to keep the
+			 * live range of a loop var alive, so it separates the block from
+			 * whatever follows it. */
+			return NULL;
 		}
 		next_block++;
 	}

ext/opcache/tests/fuzzer_function_jit_unreachable_free_jmp.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Block pass must not strip a JMP across an unreachable block that is kept for its loop var frees
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=disable
+--ENV--
+USE_ZEND_ALLOC=0
+USE_TRACKED_ALLOC=1
+--FILE--
+<?php
+function test($a, $b, $c) {
+    do {
+        if ($a) {
+            switch ($b[0]) {
+                case 'x':
+                    switch ($c[0]) {
+                        default:
+                            return "returned";
+                    }
+                default:
+                    continue 2;
+            }
+        }
+    } while (false);
+    return $b[0];
+}
+
+// Take the "continue 2" path with a refcounted switch subject.
+var_dump(test(true, [uniqid("p") !== "" ? "y" . uniqid("") : ""], ["z"]) !== "");
+// Take the "case 'x'" path.
+var_dump(test(true, ["x"], ["z"]));
+// Take the path that skips the switch entirely.
+var_dump(test(false, ["y"], ["z"]));
+echo "OK\n";
+?>
+--EXPECT--
+bool(true)
+string(8) "returned"
+string(1) "y"
+OK