[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-22T12:24:31-04:00 Commit: https://github.com/php/php-src/commit/674f99894a69d02c39bf34e00682cd2bb11f325f Raw diff: https://github.com/php/php-src/commit/674f99894a69d02c39bf34e00682cd2bb11f325f.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: ext/opcache: Fix tracing JIT range narrowing against a non-integer operand Changed paths: A ext/opcache/tests/jit/cmp_010.phpt M NEWS M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/NEWS b/NEWS index db11f661ca5c..ef48a0ef47b7 100644 --- a/NEWS +++ b/NEWS @@ -49,6 +49,9 @@ PHP NEWS MariaDB PAM account). (lazerg) - Opcache: + . Fixed tracing JIT returning a wrapped integer instead of a float on + integer overflow after an integer was compared with a float or + numeric-string literal. (Ilia Alshanetsky) . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a root trace at the opcache.jit_max_root_traces limit, causing spurious "Too few arguments" errors and crashes). (RV7PR) diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 29e7ffa3ad88..fe303cad200a 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -3721,7 +3721,7 @@ static void zend_jit_trace_update_condition_ranges(const zend_op *opline, const zend_long op1_min, op1_max, op2_min, op2_max; if ((OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG - || (OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG) { + || (OP2_INFO() & MAY_BE_ANY) != MAY_BE_LONG) { return; } diff --git a/ext/opcache/tests/jit/cmp_010.phpt b/ext/opcache/tests/jit/cmp_010.phpt new file mode 100644 index 000000000000..562e4e1d5d70 --- /dev/null +++ b/ext/opcache/tests/jit/cmp_010.phpt @@ -0,0 +1,57 @@ +--TEST-- +JIT CMP: 010 Integer range must not be narrowed by a comparison with a non-integer operand +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=tracing +opcache.jit_hot_func=1 +opcache.jit_hot_loop=1 +opcache.jit_hot_return=1 +opcache.jit_hot_side_exit=1 +--EXTENSIONS-- +opcache +--SKIPIF-- +<?php +if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); +?> +--FILE-- +<?php +function lt_float(int $x) { + if ($x < 1.0e19) { + return $x + 1; + } + return 0; +} +function lt_string(int $x) { + if ($x < "1e19") { + return $x + 1; + } + return 0; +} +function le_float(int $x) { + if ($x <= -1.0e19) { + return 0; + } + return $x - 1; +} +foreach ([1, 2, 3, PHP_INT_MAX] as $v) { + $r = lt_float($v); +} +echo "int < float: "; +var_dump($r); +foreach ([1, 2, 3, PHP_INT_MAX] as $v) { + $r = lt_string($v); +} +echo "int < numeric string: "; +var_dump($r); +foreach ([1, 2, 3, PHP_INT_MIN] as $v) { + $r = le_float($v); +} +echo "int <= float (false): "; +var_dump($r); +?> +--EXPECT-- +int < float: float(9.223372036854776E+18) +int < numeric string: float(9.223372036854776E+18) +int <= float (false): float(-9.223372036854776E+18)