[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: Jorg Sowa (jorgsowa) Date: 2026-10-22T19:08:54+02:00 Commit: https://github.com/php/php-src/commit/730ef3d368369366c1bf921b56bd8a56ef476561 Raw diff: https://github.com/php/php-src/commit/730ef3d368369366c1bf921b56bd8a56ef476561.diff Merge branch 'PHP-8.5' into PHP-8.6 Changed paths: A ext/opcache/tests/jit/assign_dim_op_008.phpt A ext/opcache/tests/jit/assign_dim_op_009.phpt A ext/opcache/tests/jit/assign_dim_op_010.phpt A ext/opcache/tests/jit/assign_dim_op_011.phpt A ext/opcache/tests/jit/assign_dim_op_012.phpt M NEWS M ext/opcache/jit/zend_jit_ir.c Diff: diff --git a/NEWS b/NEWS index 7c45d91d17e5..ce986ea27f92 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,8 @@ PHP NEWS . Fixed tracing JIT returning a wrapped integer instead of a float on integer overflow after an integer was compared with a float or numeric-string literal. (Ilia Alshanetsky) + . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an + empty array element. (jorgsowa) - PDO_PGSQL: . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index ca7bd8383337..7e2b9f8e14cf 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -13816,6 +13816,9 @@ static int zend_jit_assign_dim_op(zend_jit_ctx *jit, ir_MERGE_list(end_inputs); } + if (op1_data_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) { + op1_data_info |= MAY_BE_RC1|MAY_BE_RCN; + } jit_FREE_OP(jit, (opline+1)->op1_type, (opline+1)->op1, op1_data_info, NULL); jit_FREE_OP(jit, opline->op2_type, opline->op2, op2_info, NULL); if (!op1_indirect) { diff --git a/ext/opcache/tests/jit/assign_dim_op_008.phpt b/ext/opcache/tests/jit/assign_dim_op_008.phpt new file mode 100644 index 000000000000..67179c0b1287 --- /dev/null +++ b/ext/opcache/tests/jit/assign_dim_op_008.phpt @@ -0,0 +1,21 @@ +--TEST-- +JIT ASSIGN_DIM_OP: CONCAT of a temporary string into a null element +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f($n) { + $arr = [5 => null]; + $arr[5] .= dechex($n); + return $arr; +} +var_dump(f(255)); +?> +--EXPECT-- +array(1) { + [5]=> + string(2) "ff" +} diff --git a/ext/opcache/tests/jit/assign_dim_op_009.phpt b/ext/opcache/tests/jit/assign_dim_op_009.phpt new file mode 100644 index 000000000000..479a4fa079c0 --- /dev/null +++ b/ext/opcache/tests/jit/assign_dim_op_009.phpt @@ -0,0 +1,19 @@ +--TEST-- +JIT ASSIGN_DIM_OP: CONCAT of a temporary string into a referenced null element +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f($n) { + $arr = [5 => null]; + $r = &$arr[5]; + $arr[5] .= dechex($n); + return $r; +} +var_dump(f(255)); +?> +--EXPECT-- +string(2) "ff" diff --git a/ext/opcache/tests/jit/assign_dim_op_010.phpt b/ext/opcache/tests/jit/assign_dim_op_010.phpt new file mode 100644 index 000000000000..2e50bef85771 --- /dev/null +++ b/ext/opcache/tests/jit/assign_dim_op_010.phpt @@ -0,0 +1,26 @@ +--TEST-- +JIT ASSIGN_DIM_OP: CONCAT of a temporary string into a typed reference +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +class C { + public ?string $p = null; +} +function f($n) { + $c = new C; + $arr = [5 => null]; + $arr[5] = &$c->p; + $arr[5] .= dechex($n); + return $c; +} +var_dump(f(255)); +?> +--EXPECT-- +object(C)#1 (1) { + ["p"]=> + string(2) "ff" +} diff --git a/ext/opcache/tests/jit/assign_dim_op_011.phpt b/ext/opcache/tests/jit/assign_dim_op_011.phpt new file mode 100644 index 000000000000..5f95a9111a96 --- /dev/null +++ b/ext/opcache/tests/jit/assign_dim_op_011.phpt @@ -0,0 +1,28 @@ +--TEST-- +JIT ASSIGN_DIM_OP: CONCAT of a temporary string into an ArrayAccess offset +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +class A implements ArrayAccess { + public $d = []; + function offsetGet($o): mixed { return $this->d[$o] ?? null; } + function offsetSet($o, $v): void { $this->d[$o] = $v; } + function offsetExists($o): bool { return isset($this->d[$o]); } + function offsetUnset($o): void {} +} +function f($n) { + $a = new A; + $a[5] .= dechex($n); + return $a->d; +} +var_dump(f(255)); +?> +--EXPECT-- +array(1) { + [5]=> + string(2) "ff" +} diff --git a/ext/opcache/tests/jit/assign_dim_op_012.phpt b/ext/opcache/tests/jit/assign_dim_op_012.phpt new file mode 100644 index 000000000000..e2f168708041 --- /dev/null +++ b/ext/opcache/tests/jit/assign_dim_op_012.phpt @@ -0,0 +1,26 @@ +--TEST-- +JIT ASSIGN_DIM_OP: ADD of a temporary array +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f($n) { + $arr = [5 => []]; + $arr[5] += $n ? [1, str_repeat("a", $n)] : 1; + return $arr; +} +var_dump(f(3)); +?> +--EXPECT-- +array(1) { + [5]=> + array(2) { + [0]=> + int(1) + [1]=> + string(3) "aaa" + } +}