JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property #24337

With the tracing JIT, $this->pu-- on a property holding a non-numeric string crashes the process (SIGSEGV in a release build) instead of raising the "Decrement on non-numeric string" deprecation.

<?php
class Q {
  public $pu = 0;
  function run() { for ($i = 0; $i < 10; $i++) { $this->pu--; } }
}
class S extends Q {
  public $pu = 'u';
  function run() { parent::run(); }
}
$objs = [new Q, new S];
for ($k = 0; $k < 4; $k++) {
  foreach ($objs as $o) { $o->run(); }
}
echo "done\n";

php -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing -d opcache.jit_hot_loop=2 -d opcache.jit_hot_func=2 -d opcache.jit_hot_return=2 -d opcache.jit_hot_side_exit=1 -d display_errors=0 reduced.php

On a UBSan build:

Zend/zend_execute_API.c:716:20: runtime error: member access within misaligned address 0x00000000000a for type 'const struct zend_op', which requires 8 byte alignment
    #0 in zend_get_executed_lineno Zend/zend_execute_API.c:716
    #1 in get_filename_lineno Zend/zend.c:1670
    #2 in zend_error Zend/zend.c:1711
    #3 in decrement_function Zend/zend_operators.c:2907
    #4 0x48783f94  (/dev/zero (deleted)+0x8000f94)

A release build exits with signal 11 (rc 139) and prints nothing.

I expected it to print done, as it does with opcache.jit=0 or opcache off, where the deprecation is emitted for the string property and the value is left unchanged.

Found at commit c65321c; it still reproduces at eec8328 (latest upstream, same UBSan report).

Looks like zend_jit_incdec_obj in ext/opcache/jit/zend_jit_ir.c calls decrement_function for a non-int property without storing EX(opline) first, so zend_error reads a stale opline in zend_get_executed_lineno.

Found with an LLM-based testing tool. As CONTRIBUTING.md asks, the paragraphs in > quotes were written with Claude; I ran every command myself.