Fix GH-24337: JIT segfault when decrementing a non-numeric string property

[lazerg]

zend_jit_incdec_obj() calls increment_function()/decrement_function() for a non-long untyped property without storing EX(opline) first. When the value is a non-numeric string, the deprecation goes through zend_error(), which reads the stale opline in zend_get_executed_lineno() and crashes. The non-long path now sets the opline and checks for an exception whenever the value can be anything other than a long or double, since a user error handler can also throw from that warning.

Fixes #24337

[ndossche]

Looks good, please see my remarks

[ndossche]

Can you please extend the test to also test with a bool/array

[lazerg]

Done in 45e4b98. The test now covers bool and array for both ++ and --. Before the fix, function JIT also reported the wrong line for all of these, including the array TypeError.

[ndossche]

I think MAY_BE_NULL may be excluded too for increment opcodes, but this is rare so probably not worth it. What do you think?

[lazerg]

It would be correct: increment_function() turns null into 1 without a notice, and zend_may_throw_ex() already leaves NULL out for PRE/POST_INC. But here var_info is either all of MAY_BE_ANY or the single type from the trace guard. So it only changes the code when the property is exactly null at trace time, and after one ++ it is an int and the guard exits. I left it out to keep the same mask as the CV path in zend_jit_inc_dec(). Happy to add it if you prefer.

[ndossche]

Thanks