reg_allocation_bug.diff

diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
index a60c2ad..b79ba36 100644
--- a/ext/opcache/jit/zend_jit_x86.dasc
+++ b/ext/opcache/jit/zend_jit_x86.dasc
@@ -7448,6 +7448,9 @@ static int zend_jit_send_val(dasm_State **Dst, const zend_op *opline, zend_op_ar
 		goto fallback;
 	}

+	op1_addr = zend_jit_decode_op(op_array, opline->op1_type, opline->op1, opline, ra, ra ? ssa->ops[opline - op_array->opcodes].op1_use : -1);
+	arg_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, opline->result.var);
+
 	op1_info = OP1_INFO();

 	if (!reuse_ip) {
@@ -7458,10 +7461,17 @@ static int zend_jit_send_val(dasm_State **Dst, const zend_op *opline, zend_op_ar

 	if (opline->opcode == ZEND_SEND_VAL_EX) {
 		uint32_t mask = ZEND_SEND_BY_REF << ((arg_num + 3) * 2);
+		zend_regset tmp_reg;

-		|	mov r0, EX:RX->func
+		if (Z_MODE(op1_addr) == IS_REG && Z_REG(op1_addr) == ZREG_R0) {
+			tmp_reg = ZREG_R1;
+		} else {
+			tmp_reg = ZREG_R0;
+		}
+
+		|	mov Ra(tmp_reg), EX:RX->func
 		if (arg_num <= MAX_ARG_FLAG_NUM) {
-			|	test dword [r0 + offsetof(zend_function, quick_arg_flags)], mask
+			|	test dword [Ra(tmp_reg)+offsetof(zend_function, quick_arg_flags)], mask
 			|	jnz	>1
 		} else {
 			ZEND_ASSERT(0);
@@ -7473,9 +7483,6 @@ static int zend_jit_send_val(dasm_State **Dst, const zend_op *opline, zend_op_ar
 		|.code
 	}

-	op1_addr = zend_jit_decode_op(op_array, opline->op1_type, opline->op1, opline, ra, ra ? ssa->ops[opline - op_array->opcodes].op1_use : -1);
-	arg_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, opline->result.var);
-
 	if (opline->op1_type == IS_CONST) {
 		zval *zv = RT_CONSTANT(op_array, opline->op1);