diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index fc38dd5647fd..437445f46865 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -294,6 +294,7 @@ typedef struct _zend_jit_ctx {
 	ir_ref              *bb_edges;
 	zend_jit_trace_info *trace;
 	zend_jit_reg_var    *ra;
+	ir_ref               op_start_ref;
 	int                  delay_var;
 	ir_refs             *delay_refs;
 	ir_ref               eg_exception_addr;
@@ -1352,6 +1353,8 @@ static bool zend_jit_spilling_may_cause_conflict(zend_jit_ctx *jit, int var, ir_
 		 && jit->ra[jit->ssa->ops[jit->ssa->vars[var].definition].op2_use].ref == val) {
 			/* Avoid spill conflict between of ASSIGN.op1_def and ASSIGN.op1_use */
 			return 1;
+		} else if (val < jit->op_start_ref) {
+			return 1;
 		}
 		return 0;
 	}
@@ -2811,6 +2814,7 @@ static void zend_jit_init_ctx(zend_jit_ctx *jit, uint32_t flags)
 	jit->bb_edges = NULL;
 	jit->trace = NULL;
 	jit->ra = NULL;
+	jit->op_start_ref = IR_UNUSED;
 	jit->delay_var = -1;
 	jit->delay_refs = NULL;
 	jit->eg_exception_addr = 0;
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index ac942f1952b6..b25e123432f3 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -4387,6 +4387,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 			bool gen_handler = false;
 
 			opline = p->opline;
+			jit->op_start_ref = jit->ctx.insns_count;
 			if (op1_type & (IS_TRACE_REFERENCE|IS_TRACE_INDIRECT)) {
 				op1_type = IS_UNKNOWN;
 			}
diff --git a/ext/opcache/tests/jit/gh24471.phpt b/ext/opcache/tests/jit/gh24471.phpt
new file mode 100644
index 000000000000..da7543e2f262
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24471.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-24471 (Tracing JIT: float temporary marked type_only in trace exit, VM reads stale value)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+opcache.file_update_protection=0
+--FILE--
+<?php
+function f($x, $y) {
+    $d = ($x + 0.5) * ($y === [1] ? 2.0 : 1.0);
+    return $d;
+}
+$ys = array_fill(0, 100, [0]);
+$ys[] = [1];
+foreach ($ys as $i => $y) {
+    $r = f($i, $y);
+}
+var_dump($r);
+?>
+--EXPECT--
+float(201)
diff --git a/ext/opcache/tests/jit/gh24471_2.phpt b/ext/opcache/tests/jit/gh24471_2.phpt
new file mode 100644
index 000000000000..c33e2acb709f
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24471_2.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-24471 (Tracing JIT: CSE'd float temporary marked type_only in trace exit)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+opcache.file_update_protection=0
+--FILE--
+<?php
+function f($x, $y) {
+    $r = ($x + 0.5) + ($d = $x + 0.5) * ($y === [1] ? 2.0 : 3.0);
+    return $r + $d;
+}
+$ys = array_fill(0, 100, [0]);
+$ys[] = [1];
+foreach ($ys as $i => $y) {
+    $r = f($i, $y);
+}
+var_dump($r);
+?>
+--EXPECT--
+float(402)