Fix block pass dropping ZEND_FAST_CALL OP2 definition

NEWS

@@ -51,6 +51,8 @@ PHP                                                                        NEWS
   . Fixed a tracing JIT crash when compiling a side trace for a method of a
     class that could not be stored in the inheritance cache. (GH-21710)
     (Arnaud, iliaal)
+  . Fixed the block pass dropping the definition of the ZEND_FAST_CALL OP2
+    operand. (Mrmaxmeier)
 
 - PDO:
   . Fixed a leak when a persistent connection failed a liveness check

Zend/Optimizer/block_pass.c

@@ -398,6 +398,16 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 				}
 				break;
 
+			case ZEND_FAST_CALL:
+				if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
+					/* OP2 holds the pending return value, which is consumed by the
+					 * following RETURN, or destroyed by
+					 * zend_dispatch_try_catch_finally_helper() if the finally block
+					 * throws. Its source must not be removed. */
+					Tsource[VAR_NUM(opline->op2.var)] = NULL;
+				}
+				break;
+
 			case ZEND_SWITCH_LONG:
 			case ZEND_SWITCH_STRING:
 			case ZEND_MATCH:

ext/opcache/tests/fuzzer_function_jit_live_range_fast_call.phpt

@@ -0,0 +1,49 @@
+--TEST--
+Block pass must not remove the source of the ZEND_FAST_CALL OP2 return value
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=disable
+--ENV--
+USE_ZEND_ALLOC=0
+USE_TRACKED_ALLOC=1
+--FILE--
+<?php
+function test_scalar() {
+    $x = 1;
+    try {
+        try {
+            return true ? 1.5 : 2.5;
+        } finally {
+            undef_fn();
+        }
+    } catch (Throwable $e) {
+        echo $e::class, ': ', $e->getMessage(), "\n";
+    }
+    return "fallback";
+}
+
+function test_refcounted() {
+    $x = 1;
+    try {
+        try {
+            return true ? "returned" : "other";
+        } finally {
+            undef_fn();
+        }
+    } catch (Throwable $e) {
+        echo $e::class, ': ', $e->getMessage(), "\n";
+    }
+    return "fallback";
+}
+
+var_dump(test_scalar());
+var_dump(test_refcounted());
+?>
+--EXPECT--
+Error: Call to undefined function undef_fn()
+string(8) "fallback"
+Error: Call to undefined function undef_fn()
+string(8) "fallback"