[php-src] master: Merge branch 'PHP-8.6'

Author: ndossche (ndossche) Date: 2026-10-23T20:00:43+02:00 Commit: https://github.com/php/php-src/commit/29d1a07989c88c64f4f8df066d103556584c5552 Raw diff: https://github.com/php/php-src/commit/29d1a07989c88c64f4f8df066d103556584c5552.diff Merge branch 'PHP-8.6' * PHP-8.6: Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes Changed paths: A ext/opcache/tests/jit/gh24396.phpt M ext/opcache/jit/zend_jit_ir.c Diff: diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 7243416469be..f9b1be1b3ea2 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -1369,7 +1369,9 @@ static void zend_jit_def_reg(zend_jit_ctx *jit, zend_jit_addr addr, ir_ref val) if (dst_phi->pi >= 0) { jit->ra[src_var].ref = val; src_var = dst_phi->ssa_var; - if (!(jit->ra[src_var].flags & ZREG_FORWARD)) { + if (!(jit->ra[src_var].flags & ZREG_FORWARD) + /* Pi in a block that is not generated yet. It forwards later on its own. */ + || (jit->bb_start_ref && !jit->bb_start_ref[dst_phi->block])) { phi = zend_ssa_next_use_phi(jit->ssa, var, phi); continue; } diff --git a/ext/opcache/tests/jit/gh24396.phpt b/ext/opcache/tests/jit/gh24396.phpt new file mode 100644 index 000000000000..0ad5696b208f --- /dev/null +++ b/ext/opcache/tests/jit/gh24396.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f() { + $i = 0; + do { + $i = ($i + 1) & 255; + } while ($i < 2 || $i > 200); + return $i; +} +var_dump(f()); +?> +--EXPECT-- +int(2)