Merge remote-tracking branch 'upstream/master' into stream_select_unlimited

# Conflicts:
#	NEWS

Author: frodeborli

.github/scripts/download-bundled/jit-ir.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -ex
+cd "$(dirname "$0")/../../.."
+
+tmp_dir=/tmp/php-src-download-bundled/jit-ir
+rm -rf "$tmp_dir"
+
+revision=00bec1ca490b8bc51f636a42040c5e9f64c1a91b
+
+git clone --depth 1 --revision="$revision" https://github.com/dstogov/ir.git "$tmp_dir"
+
+rm -rf ext/opcache/jit/ir
+cp -R "$tmp_dir" ext/opcache/jit/ir
+
+cd ext/opcache/jit/ir
+
+# remove unneeded files
+rm -rf .git
+rm -r .github
+rm -r bench
+rm -r examples
+rm -r tests
+rm -r tools
+rm -r fuzz
+rm README.md
+rm TODO
+rm ir.g
+rm ir_cpuinfo.c
+rm ir_emit_c.c
+rm ir_emit_llvm.c
+rm ir_load.c
+rm ir_load_llvm.c
+rm ir_main.c
+rm ir_mem2ssa.c
+
+# add extra files
+git restore README

.github/workflows/verify-bundled-files.yml

@@ -5,6 +5,7 @@ on:
     paths: &paths
       - '.github/scripts/download-bundled/**'
       - 'Zend/asm/**'
+      - 'ext/opcache/jit/ir/**'
       - 'ext/pcre/pcre2lib/**'
       - 'ext/uri/uriparser/**'
   pull_request:
@@ -34,6 +35,9 @@ jobs:
             'boost-context':
               - '.github/scripts/download-bundled/boost-context.*'
               - 'Zend/asm/**'
+            'jit-ir':
+              - '.github/scripts/download-bundled/jit-ir.*'
+              - 'ext/opcache/jit/ir/**'
             pcre2:
               - '.github/scripts/download-bundled/pcre2.*'
               - 'ext/pcre/pcre2lib/**'
@@ -50,6 +54,15 @@ jobs:
           echo "::group::Verify files"
           .github/scripts/test-directory-unchanged.sh Zend/asm
           echo "::endgroup::"
+      - name: 'JIT IR'
+        if: ${{ !cancelled() && (steps.changes.outputs.jit-ir == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+        run: |
+          echo "::group::Download"
+          .github/scripts/download-bundled/jit-ir.sh
+          echo "::endgroup::"
+          echo "::group::Verify files"
+          .github/scripts/test-directory-unchanged.sh 'ext/opcache/jit/ir'
+          echo "::endgroup::"
       - name: PCRE2
         if: ${{ !cancelled() && (steps.changes.outputs.pcre2 == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
         run: |

NEWS

@@ -6,11 +6,81 @@ PHP                                                                        NEWS
   . Use recommended TYPE, HELP order for OpenMetrics metadata.
     (Marcel Hernandez)
 
+- Hash:
+  . Fixed mhash_keygen_s2k() truncating a $length above INT_MAX instead of
+    throwing a ValueError. (Marc Bennewitz)
+
 - Intl:
   . Fixed Collator attribute and strength methods not rejecting an
     unconstructed Collator. (Ilia Alshanetsky)
 
+- Lexbor:
+  . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
+    heap buffer overflow in :lexbor-contains() parsing and buffer overflows
+    in malformed decode replay. (alexandre-daubois)
+
+- MBString:
+  . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
+    a truncated UTF-8 sequence). (Lazizbek Ergashev)
+  . Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)
+  . Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
+    it as valid UTF-8. (Nicolas Grekas)
+
+- MySQLi:
+  . Fix GH-22854: Fixed failed assertion when accessing mysqli property after
+    failed reconnection. (Kamil Tekiela)
+
+- Opcache:
+  . Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
+    loop-invariant addition). (Ilia Alshanetsky)
+  . Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).
+    (ndossche)
+
+- PDO:
+  . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
+    column index. (Ilia Alshanetsky)
+  . Fixed PDOStatement::bindColumn() registering a binding for a column name
+    that is not in the result set. (Ilia Alshanetsky)
+  . Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a
+    transaction still in use by another instance). (Lazizbek Ergashev)
+
+- PGSQL:
+  . Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)
+
+- Posix:
+  . Reverted the validity check on the flags argument of posix_access().
+    (David Carlier)
+
+- Readline:
+  . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
+    set to an empty string. (Ilia Alshanetsky)
+
+- Session:
+  . Fixed session_start() continuing after a failed create_sid() when
+    session.use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)
+  . Fixed exceptions from user-defined create_sid() handlers being replaced
+    by return-value validation errors. (Ilia Alshanetsky)
+
+- SOAP:
+  . Fixed the SOAP client accepting a response body shorter than its
+    Content-Length and reusing the connection. (Ilia Alshanetsky)
+
+- SPL:
+  . Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when
+    __serialize() removes an element). (David Carlier)
+
+- SQLite:
+  . Fixed a crash when SQLite3::close() is called from a userland callback.
+    (Ilia Alshanetsky)
+
 - Standard:
+  . Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false
+    properly). (Jakub Zelenka, Ilija Tovilo)
+  . Fixed three Windows-only proc_open() defects: an uninitialized
+    PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
+    lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
+  . Fix persistent stream context lifetime during shutdown (Levi Morrison)
+  . Fixed bug GH-23780 (unserialize('') fails silently). (timwolla)
   . Fixed stream_select() aborting the whole call once any watched stream's
     descriptor exceeded FD_SETSIZE; it no longer imposes that limit, so watching
     many descriptors no longer requires rebuilding with --enable-fd-setsize.
@@ -22,5 +92,15 @@ PHP                                                                        NEWS
     handles; it now fails gracefully instead. (Frode Børli)
   . Improved performance of array_splice() when inserting without removing
     elements. (mehmetcansahin)
+  . Enforce max_filter_count: limit the number of filters that can be chained
+    in a php://filter URL. (Sjoerd Langkemper)
+
+- URI:
+  . Fix casing of enum cases in UriHostType and UrlHostType to match the RFC
+    and PHP’s naming policy. (timwolla)
+
+- Zlib:
+  . Fixed inflate_init() dropping the preset dictionary for raw streams with
+    a non-default window. (Ilia Alshanetsky)
 
 <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>>

UPGRADING

@@ -19,6 +19,16 @@ PHP 8.7 UPGRADE NOTES
 1. Backward Incompatible Changes
 ========================================
 
+- PDO:
+  . PDOStatement::bindColumn() now throws a ValueError when the column name is
+    not present in the result set. It previously reported the condition
+    through PDO::ATTR_ERRMODE and returned false.
+
+- Standard:
+  . The number of filters that can be chained in a php://filter URL is limited
+    to 16 by default. Set the stream context option max_filter_count to change
+    this.
+
 ========================================
 2. New Features
 ========================================

UPGRADING.INTERNALS

@@ -17,11 +17,28 @@ PHP 8.7 INTERNALS UPGRADE NOTES
 - Removed zend_execute_scripts(). Manually call zend_execute_script() in a loop
   instead.
 - Removed ZEND_STATIC_ASSERT(). Use C11 static_assert() directly instead.
+- Removed zend_atomic.h and the zend_atomic_* types and functions.
+  Use the standard C11 atomic_* types and functions instead.
+- The sapi_terminate_process() function was removed.
+- The sapi_force_http_10() function was removed.
+- The sapi_get_fd() function was removed.
+- The sapi_get_target_uid() and sapi_get_target_gid() functions were removed.
+- Removed HAVE_NORETURN and HAVE_NORETURN_ALIAS. ZEND_NORETURN is guaranteed to
+  work.
+- Redefined ZEND_NORETURN to make use of the [[noreturn]] attribute for C++
+  and C23, which means that ZEND_NORETURN needs to come first in the modifier
+  list. Consider using noreturn (C11) / [[noreturn]] (C23) directly if
+  header interoperability is not required.
 
 ========================
 2. Build system changes
 ========================
 
+- Windows build system changes:
+  . C sources are now compiled as C17 and require C11 atomics. MSVC builds require
+    Visual Studio 2026 or later and enable /experimental:c11atomics.
+  . C++-only extension compiler flags can be added to CXXFLAGS_<EXTENSION>.
+
 - Unix build system changes:
   . Autoconf minimum required version upgraded to 2.71.
 
@@ -40,3 +57,9 @@ PHP 8.7 INTERNALS UPGRADE NOTES
 ========================
 5. SAPI changes
 ========================
+
+- The size of the SAPI structure has changed.
+  . The terminate_process method has been removed.
+  . The force_http_10 method has been removed.
+  . The get_fd method has been removed.
+  . The get_target_uid and get_target_gid methods have been removed.

Zend/Optimizer/escape_analysis.c

@@ -297,8 +297,10 @@ static bool is_escape_use(const zend_op_array *op_array, const zend_ssa *ssa, in
 			case ZEND_ASSIGN_STATIC_PROP_OP:
 			case ZEND_ASSIGN_DIM:
 			case ZEND_ASSIGN_OBJ:
-			case ZEND_ASSIGN_OBJ_REF:
 				break;
+			case ZEND_ASSIGN_OBJ_REF:
+				/* The property may now alias a variable outside of the object. */
+				return true;
 			case ZEND_PRE_INC_OBJ:
 			case ZEND_PRE_DEC_OBJ:
 			case ZEND_POST_INC_OBJ:

Zend/tests/fibers/gh23921.phpt

@@ -0,0 +1,17 @@
+--TEST--
+GH-23921 (Fibers start with error_reporting = 0 when the error_reporting INI directive is not set)
+--FILE--
+<?php
+echo error_reporting(), "\n";
+(new Fiber(function () {
+    echo error_reporting(), "\n";
+    echo $undefined;
+    echo "after\n";
+}))->start();
+?>
+--EXPECTF--
+30719
+30719
+
+Warning: Undefined variable $undefined in %s on line 5
+after

Zend/tests/fibers/silence-operator-outside-fiber-should-no-widen-error-reporting.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Silence operator must not change the error_reporting value within the fiber
+--FILE--
+<?php
+
+error_reporting(E_WARNING);
+
+@(new Fiber(function () {
+	var_dump(E_ALL);
+	var_dump(E_WARNING);
+    var_dump(error_reporting());
+}))->start();
+
+?>
+--EXPECT--
+int(30719)
+int(2)
+int(2)

Zend/tests/partial_application/constexpr_016.phpt

@@ -0,0 +1,43 @@
+--TEST--
+PFA in constexpr: binding a by-reference parameter
+--FILE--
+<?php
+
+function byRef($a, &$b) {}
+function byRefVariadic(&...$args) {}
+
+class C {
+    public static function staticByRef($a, &$b) {}
+}
+
+function f1($x = byRef(new stdClass, new stdClass, ...)) {}
+function f2($x = byRef(b: new stdClass, a: ?)) {}
+function f3($x = byRefVariadic(new stdClass, ...)) {}
+function f4($x = byRefVariadic(extra: new stdClass, ...)) {}
+function f5($x = C::staticByRef(new stdClass, new stdClass, ...)) {}
+
+foreach (['f1', 'f2', 'f3', 'f4', 'f5'] as $f) {
+    try {
+        $f();
+    } catch (Error $e) {
+        echo get_class($e), ": ", $e->getMessage(), "\n";
+    }
+}
+
+function f6($x = byRef(new stdClass, ?)) {
+    return $x;
+}
+
+$partial = f6();
+$var = 1;
+var_dump($partial instanceof Closure);
+$partial($var);
+
+?>
+--EXPECT--
+Error: byRef(): Argument #2 ($b) could not be passed by reference
+Error: byRef(): Argument #2 ($b) could not be passed by reference
+Error: byRefVariadic(): Argument #1 could not be passed by reference
+Error: byRefVariadic(): Argument #1 could not be passed by reference
+Error: C::staticByRef(): Argument #2 ($b) could not be passed by reference
+bool(true)

Zend/zend.c

@@ -1264,7 +1264,7 @@ ZEND_COLD void zenderror(const char *error) /* {{{ */
 }
 /* }}} */
 
-ZEND_API ZEND_COLD ZEND_NORETURN void _zend_bailout(const char *filename, uint32_t lineno) /* {{{ */
+ZEND_NORETURN ZEND_API ZEND_COLD void _zend_bailout(const char *filename, uint32_t lineno) /* {{{ */
 {
 
 	if (!EG(bailout)) {
@@ -1715,7 +1715,7 @@ ZEND_API ZEND_COLD void zend_error_unchecked(int type, const char *format, ...)
 	zend_error_impl(type, format);
 }
 
-ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_at_noreturn(
+ZEND_NORETURN ZEND_API ZEND_COLD void zend_error_at_noreturn(
 		int type, zend_string *filename, uint32_t lineno, const char *format, ...)
 {
 	va_list args;
@@ -1744,17 +1744,17 @@ ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_at_noreturn(
 		abort(); \
 	} while (0)
 
-ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_noreturn(int type, const char *format, ...)
+ZEND_NORETURN ZEND_API ZEND_COLD void zend_error_noreturn(int type, const char *format, ...)
 {
 	zend_error_noreturn_impl(type, format);
 }
 
-ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_noreturn_unchecked(int type, const char *format, ...)
+ZEND_NORETURN ZEND_API ZEND_COLD void zend_error_noreturn_unchecked(int type, const char *format, ...)
 {
 	zend_error_noreturn_impl(type, format);
 }
 
-ZEND_API ZEND_COLD ZEND_NORETURN void zend_strerror_noreturn(int type, int errn, const char *message)
+ZEND_NORETURN ZEND_API ZEND_COLD void zend_strerror_noreturn(int type, int errn, const char *message)
 {
 #ifdef HAVE_STRERROR_R
 	char b[1024];