[php-src] PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5

Author: ndossche (ndossche) Date: 2026-10-23T20:00:20+02:00 Commit: https://github.com/php/php-src/commit/cbc391bc13338115e1e9e9a81cc60e567e2050f0 Raw diff: https://github.com/php/php-src/commit/cbc391bc13338115e1e9e9a81cc60e567e2050f0.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes Changed paths: A ext/opcache/tests/jit/gh24396.phpt M NEWS M ext/opcache/jit/zend_jit_ir.c Diff: diff --git a/NEWS b/NEWS index cedad8181808..945dd493a216 100644 --- a/NEWS +++ b/NEWS @@ -84,6 +84,8 @@ PHP NEWS exits with an uninitialized opline). (waroad) . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element. (jorgsowa) + . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" + with chained Pi nodes). (ndossche) - PDO: . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated. diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 8357ba8f8949..52bd527d9d50 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -1401,7 +1401,9 @@ static void zend_jit_def_reg(zend_jit_ctx *jit, zend_jit_addr addr, ir_ref val) if (dst_phi->pi >= 0) { jit->ra[src_var].ref = val; src_var = dst_phi->ssa_var; - if (!(jit->ra[src_var].flags & ZREG_FORWARD)) { + if (!(jit->ra[src_var].flags & ZREG_FORWARD) + /* Pi in a block that is not generated yet. It forwards later on its own. */ + || (jit->bb_start_ref && !jit->bb_start_ref[dst_phi->block])) { phi = zend_ssa_next_use_phi(jit->ssa, var, phi); continue; } diff --git a/ext/opcache/tests/jit/gh24396.phpt b/ext/opcache/tests/jit/gh24396.phpt new file mode 100644 index 000000000000..0ad5696b208f --- /dev/null +++ b/ext/opcache/tests/jit/gh24396.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f() { + $i = 0; + do { + $i = ($i + 1) & 255; + } while ($i < 2 || $i > 200); + return $i; +} +var_dump(f()); +?> +--EXPECT-- +int(2)