[php-src] PHP-8.6: Merge branch 'PHP-8.5' into PHP-8.6

Author: ndossche (ndossche) Date: 2026-10-23T20:00:38+02:00 Commit: https://github.com/php/php-src/commit/37c8477bdb9ede283882227cecd79e3b6d9cc121 Raw diff: https://github.com/php/php-src/commit/37c8477bdb9ede283882227cecd79e3b6d9cc121.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes Changed paths: A ext/opcache/tests/jit/gh24396.phpt M NEWS M ext/opcache/jit/zend_jit_ir.c Diff: diff --git a/NEWS b/NEWS index 42ff62143cff..741985a9ca66 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,8 @@ PHP NEWS numeric-string literal. (Ilia Alshanetsky) . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element. (jorgsowa) + . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" + with chained Pi nodes). (ndossche) - PDO_PGSQL: . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 770eff650290..ca76ae39fbee 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -1423,7 +1423,9 @@ static void zend_jit_def_reg(zend_jit_ctx *jit, zend_jit_addr addr, ir_ref val) if (dst_phi->pi >= 0) { jit->ra[src_var].ref = val; src_var = dst_phi->ssa_var; - if (!(jit->ra[src_var].flags & ZREG_FORWARD)) { + if (!(jit->ra[src_var].flags & ZREG_FORWARD) + /* Pi in a block that is not generated yet. It forwards later on its own. */ + || (jit->bb_start_ref && !jit->bb_start_ref[dst_phi->block])) { phi = zend_ssa_next_use_phi(jit->ssa, var, phi); continue; } diff --git a/ext/opcache/tests/jit/gh24396.phpt b/ext/opcache/tests/jit/gh24396.phpt new file mode 100644 index 000000000000..0ad5696b208f --- /dev/null +++ b/ext/opcache/tests/jit/gh24396.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f() { + $i = 0; + do { + $i = ($i + 1) & 255; + } while ($i < 2 || $i > 200); + return $i; +} +var_dump(f()); +?> +--EXPECT-- +int(2)