Fix GH-21691: OPcache CFG optimizer eliminates QM_ASSIGN feeding JMPZ with VAR operand

[iliaal]

Fixes #21691

The CFG optimizer (pass 5) removed a QM_ASSIGN that converted IS_VAR to IS_TMP_VAR before JMPZ. Since JMPZ has no handler for IS_VAR operands, this produced "Invalid opcode 43/4/0." The pattern occurs when ASSIGN_REF (which produces IS_VAR) feeds into a conditional via QM_ASSIGN.

Skips the QM_ASSIGN elimination when the source operand is IS_VAR.

[andypost]

Confirm it fixes running test for Drupal, used as patch and tests pass https://git.drupalcode.org/project/drupal/-/jobs/9303090

[dstogov]

The fix is right but incomplete.
The similar checks have to be added at least for ZEND_BOOL_NOT above and for ZEND_JMPN?Z_EX below.

I would add these IS_VAR checks into the conditions chains to avoid additional break. (but this is really not critical, and both decisions may have their advantages).

@iluuu1994 please also take a look. This is relate to ""VAR|TMP overhaul (GH-20628)"".

[iliaal]

Confirmed. ($data = &$this->getData()) && count($data) fatals with opcode 46/4/0, same shape as the original. Updated patch:

• Hoisted src->op1_type != IS_VAR into the enclosing condition in both the JMPZ/JMPNZ and JMPZ_EX/JMPNZ_EX handlers, per your suggestion. This also covers the BOOL_NOT branch defensively.
• Extended gh21691.phpt to exercise both JMPZ and JMPZ_EX paths.

All 880 opcache tests pass. @iluuu1994, worth a look at whether the broader invariant from #20628 warrants auditing other optimizer substitutions.