Fix zend_optimizer_replace_by_const() leaving stale OP2 uses behind

For opcodes that do not consume their OP1 operand, the constant is propagated
into every use of the temporary rather than just the first one. That loop only
ever looked at OP1, so a use of the same temporary as an OP2 operand was left
referring to a temporary that no longer has a definition:

    function test($v) {
        switch ($v) {
            case [$x] = (int)1.5:
                break;
        }
    }

The ZEND_CAST is folded and rewritten into the ZEND_FETCH_LIST_R of the list
assignment, but the comparison emitted for the case expression uses the same
temporary as its OP2 and keeps the dangling reference, which makes SSA
construction fail its integrity check.

An OP2 operand is always consumed (ZEND_FE_FETCH_R/RW, where OP2 is a def
rather than a use, is the sole exception), so such a use is the last one and
the loop can stop there.

Assisted-By: Claude <noreply@anthropic.com>

Author: Mrmaxmeier

Zend/Optimizer/zend_optimizer.c

@@ -666,6 +666,17 @@ bool zend_optimizer_replace_by_const(zend_op_array *op_array,
 							if (is_last) {
 								break;
 							}
+						} else if (opline->op2_type == type && opline->op2.var == var
+								&& opline->opcode != ZEND_FE_FETCH_R
+								&& opline->opcode != ZEND_FE_FETCH_RW) {
+							/* An OP2 operand is always consumed, so this is the last use.
+							 * OP2 of FE_FETCH is a def rather than a use, stop there. */
+							Z_TRY_ADDREF_P(val);
+							if (!zend_optimizer_update_op2_const(op_array, opline, val)) {
+								zval_ptr_dtor(val);
+								return false;
+							}
+							break;
 						}
 						opline++;
 					}

ext/opcache/tests/opt/replace_by_const_op2.phpt

@@ -0,0 +1,23 @@
+--TEST--
+zend_optimizer_replace_by_const(): OP2 uses of a temporary kept alive by FETCH_LIST_R
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+function test($v) {
+    switch ($v) {
+        case [$x] = (int)1.5:
+            return "matched " . var_export($x, true);
+        default:
+            return "default";
+    }
+}
+var_dump(test(1));
+var_dump(test(2));
+?>
+--EXPECT--
+string(12) "matched NULL"
+string(7) "default"