[php-src] PHP-8.6: Merge branch 'PHP-8.5' into PHP-8.6

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-22T12:24:51-04:00 Commit: https://github.com/php/php-src/commit/acdb154f210465e1ab4f691a2b878ef60cd3f93b Raw diff: https://github.com/php/php-src/commit/acdb154f210465e1ab4f691a2b878ef60cd3f93b.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: ext/opcache: Fix tracing JIT range narrowing against a non-integer operand Changed paths: A ext/opcache/tests/jit/cmp_010.phpt M NEWS M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/NEWS b/NEWS index 899466752700..4f69e30d6f12 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,11 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.6.0RC5 +- Opcache: + . Fixed tracing JIT returning a wrapped integer instead of a float on + integer overflow after an integer was compared with a float or + numeric-string literal. (Ilia Alshanetsky) + - PDO_PGSQL: . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy) diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index a8f5b4b0fcea..57c85b521aee 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -3738,7 +3738,7 @@ static void zend_jit_trace_update_condition_ranges(const zend_op *opline, const zend_long op1_min, op1_max, op2_min, op2_max; if ((OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG - || (OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG) { + || (OP2_INFO() & MAY_BE_ANY) != MAY_BE_LONG) { return; } diff --git a/ext/opcache/tests/jit/cmp_010.phpt b/ext/opcache/tests/jit/cmp_010.phpt new file mode 100644 index 000000000000..562e4e1d5d70 --- /dev/null +++ b/ext/opcache/tests/jit/cmp_010.phpt @@ -0,0 +1,57 @@ +--TEST-- +JIT CMP: 010 Integer range must not be narrowed by a comparison with a non-integer operand +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=tracing +opcache.jit_hot_func=1 +opcache.jit_hot_loop=1 +opcache.jit_hot_return=1 +opcache.jit_hot_side_exit=1 +--EXTENSIONS-- +opcache +--SKIPIF-- +<?php +if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); +?> +--FILE-- +<?php +function lt_float(int $x) { + if ($x < 1.0e19) { + return $x + 1; + } + return 0; +} +function lt_string(int $x) { + if ($x < "1e19") { + return $x + 1; + } + return 0; +} +function le_float(int $x) { + if ($x <= -1.0e19) { + return 0; + } + return $x - 1; +} +foreach ([1, 2, 3, PHP_INT_MAX] as $v) { + $r = lt_float($v); +} +echo "int < float: "; +var_dump($r); +foreach ([1, 2, 3, PHP_INT_MAX] as $v) { + $r = lt_string($v); +} +echo "int < numeric string: "; +var_dump($r); +foreach ([1, 2, 3, PHP_INT_MIN] as $v) { + $r = le_float($v); +} +echo "int <= float (false): "; +var_dump($r); +?> +--EXPECT-- +int < float: float(9.223372036854776E+18) +int < numeric string: float(9.223372036854776E+18) +int <= float (false): float(-9.223372036854776E+18)