Fix zend_optimizer_replace_by_const() leaving stale OP2 uses behind

NEWS

@@ -54,6 +54,8 @@ PHP                                                                        NEWS
   . Fixed a tracing JIT crash when compiling a side trace for a method of a
     class that could not be stored in the inheritance cache. (GH-21710)
     (Arnaud, iliaal)
+  . Fixed zend_optimizer_replace_by_const() leaving stale OP2 uses behind.
+    (Mrmaxmeier)
 
 - PDO:
   . Fixed a leak when a persistent connection failed a liveness check

Zend/Optimizer/zend_optimizer.c

@@ -666,6 +666,17 @@ bool zend_optimizer_replace_by_const(zend_op_array *op_array,
 							if (is_last) {
 								break;
 							}
+						} else if (opline->op2_type == type && opline->op2.var == var
+								&& opline->opcode != ZEND_FE_FETCH_R
+								&& opline->opcode != ZEND_FE_FETCH_RW) {
+							/* An OP2 operand is always consumed, so this is the last use.
+							 * OP2 of FE_FETCH is a def rather than a use, stop there. */
+							Z_TRY_ADDREF_P(val);
+							if (!zend_optimizer_update_op2_const(op_array, opline, val)) {
+								zval_ptr_dtor(val);
+								return false;
+							}
+							break;
 						}
 						opline++;
 					}

ext/opcache/tests/fuzzer_function_jit_ssa_case_list_assign.phpt

@@ -0,0 +1,24 @@
+--TEST--
+zend_optimizer_replace_by_const(): OP2 uses of a temporary kept alive by FETCH_LIST_R
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=disable
+--FILE--
+<?php
+function test($v) {
+    switch ($v) {
+        case [$x] = (int)1.5:
+            return "matched " . var_export($x, true);
+        default:
+            return "default";
+    }
+}
+var_dump(test(1));
+var_dump(test(2));
+?>
+--EXPECT--
+string(12) "matched NULL"
+string(7) "default"