[php-src] PHP-8.6: Merge branch 'PHP-8.5' into PHP-8.6

Author: ndossche (ndossche) Date: 2026-10-05T20:00:12+02:00 Commit: https://github.com/php/php-src/commit/2a5d6c391608a0063849097ee2c562e7b68a2af7 Raw diff: https://github.com/php/php-src/commit/2a5d6c391608a0063849097ee2c562e7b68a2af7.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object Changed paths: A ext/opcache/tests/opt/sccp_isset_dim_partial_object.phpt M NEWS M Zend/Optimizer/sccp.c Diff: diff --git a/NEWS b/NEWS index f8bd540632e1..7ac3c456a81b 100644 --- a/NEWS +++ b/NEWS @@ -79,6 +79,8 @@ PHP NEWS extensions declaring frameless functions. (Ilia Alshanetsky) . Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls). (ndossche) + . Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object. + (ndossche) - OpenSSL: . Fixed stream_socket_enable_crypto() leaving the socket non-blocking diff --git a/Zend/Optimizer/sccp.c b/Zend/Optimizer/sccp.c index 01ba8e6ba676..42dcb4629fa8 100644 --- a/Zend/Optimizer/sccp.c +++ b/Zend/Optimizer/sccp.c @@ -437,7 +437,11 @@ static inline zend_result ct_eval_isset_dim(zval *result, uint32_t extended_valu } else if (Z_TYPE_P(op1) == IS_STRING) { // TODO return FAILURE; + } else if (IS_PARTIAL_OBJECT(op1)) { + /* Objects may implement ArrayAccess or throw. */ + return FAILURE; } else { + ZEND_ASSERT(Z_TYPE_P(op1) <= IS_DOUBLE); ZVAL_BOOL(result, (extended_value & ZEND_ISEMPTY)); return SUCCESS; } diff --git a/ext/opcache/tests/opt/sccp_isset_dim_partial_object.phpt b/ext/opcache/tests/opt/sccp_isset_dim_partial_object.phpt new file mode 100644 index 000000000000..ac10d6773c68 --- /dev/null +++ b/ext/opcache/tests/opt/sccp_isset_dim_partial_object.phpt @@ -0,0 +1,36 @@ +--TEST-- +SCCP: isset()/empty() on dimension of non-escaping object must not be evaluated +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.optimization_level=-1 +--EXTENSIONS-- +opcache +--FILE-- +<?php +class P {} + +function f() { + $o = new P; + return isset($o[1]); +} + +function g() { + $o = new P; + return empty($o[1]); +} + +try { + var_dump(f()); +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} +try { + var_dump(g()); +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +Cannot use object of type P as array +Cannot use object of type P as array