Fix nullsafe operator with delayed oplines

Closes GH-6056.

Author: nikic

Zend/zend_compile.c

@@ -2224,7 +2224,12 @@ static zend_op *zend_delayed_compile_end(uint32_t offset) /* {{{ */
 	for (i = offset; i < count; ++i) {
 		opline = get_next_op();
 		memcpy(opline, &oplines[i], sizeof(zend_op));
+		if (opline->opcode == ZEND_JMP_NULL) {
+			uint32_t opnum = get_next_op_number() - 1;
+			zend_stack_push(&CG(short_circuiting_opnums), &opnum);
+		}
 	}
+
 	CG(delayed_oplines_stack).top = offset;
 	return opline;
 }
@@ -2799,7 +2804,11 @@ static zend_op *zend_delayed_compile_prop(znode *result, zend_ast *ast, uint32_t
 		opline = zend_delayed_compile_var(&obj_node, obj_ast, type, 0);
 		zend_separate_if_call_and_write(&obj_node, obj_ast, type);
 		if (nullsafe) {
-			zend_emit_jmp_null(&obj_node);
+			/* We will push to the short_cirtcuiting_opnums stack in zend_delayed_compile_end(). */
+			opline = zend_delayed_emit_op(NULL, ZEND_JMP_NULL, &obj_node, NULL);
+			if (opline->op1_type == IS_CONST) {
+				Z_TRY_ADDREF_P(CT_CONSTANT(opline->op1));
+			}
 		}
 	}