[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: ndossche (ndossche) Date: 2026-10-09T18:50:49+02:00 Commit: https://github.com/php/php-src/commit/4f40b69ffa534294b255640635807943e25845f8 Raw diff: https://github.com/php/php-src/commit/4f40b69ffa534294b255640635807943e25845f8.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix GH-24218: Invalid opcode for count() of a literal array without SCCP Changed paths: A ext/opcache/tests/gh24218.phpt M NEWS M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 43e9ef3d9655..3a3c4ff57fc8 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,8 @@ PHP NEWS into the wrong one. (Marc Bennewitz) . Fixed bug GH-24081 (User opcode handlers resume execution against a stale frame under ZEND_VM_KIND_TAILCALL). (devnexen) + . Fixed bug GH-24218 (Invalid opcode for count() of a literal array + without SCCP). (lazerg) - Opcache: . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 1285e5ab3cf0..f107f722526e 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -9538,7 +9538,7 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED) ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); } -ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED) +ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, op->op1_type != IS_CONST && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED) { USE_OPLINE zend_array *ht = Z_ARRVAL_P(GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R)); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 64e0c5f041e1..f0b244f53c33 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -129711,7 +129711,7 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t } break; case ZEND_COUNT: - if ((op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY) { + if (op->op1_type != IS_CONST && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY) { spec = 2580 | SPEC_RULE_OP1; } break; diff --git a/ext/opcache/tests/gh24218.phpt b/ext/opcache/tests/gh24218.phpt new file mode 100644 index 000000000000..0e5721376bec --- /dev/null +++ b/ext/opcache/tests/gh24218.phpt @@ -0,0 +1,17 @@ +--TEST-- +GH-24218 (Invalid opcode for count() of a literal array when SCCP is disabled) +--EXTENSIONS-- +opcache +--INI-- +opcache.enable_cli=1 +opcache.optimization_level=0x60 +--FILE-- +<?php + +var_dump(count([1])); +var_dump(count([1, 2, 3])); + +?> +--EXPECT-- +int(1) +int(3)