From 057b70634bf145ada55e0df99dcafd36bd8eb60f Mon Sep 17 00:00:00 2001 From: Peter Kokot Date: Wed, 8 Apr 2026 10:39:08 +0200 Subject: [PATCH 1/6] Remove redundant PHP manifest file (#21634) --- php-8.3.30.manifest | 36 ------------------------------------ 1 file changed, 36 deletions(-) delete mode 100644 php-8.3.30.manifest diff --git a/php-8.3.30.manifest b/php-8.3.30.manifest deleted file mode 100644 index ef6ffe8aa803..000000000000 --- a/php-8.3.30.manifest +++ /dev/null @@ -1,36 +0,0 @@ -php-8.3.30.tar.bz2 -SHA256 hash: 800b7b6ed50b73c8ee7844ee5f2f7cc612faa7875a0aa7c4529e8ed5866a5030 -PGP signature: ------BEGIN PGP SIGNATURE----- - -iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd -5FioAPwK1gjqwBbGr5g3y1TikqxgKVWMHCtir1n46yGN2hYvtwD/flOR9EqRejNU -wW4RMkmRwXGsXY28V1DH+NKnDKTEWQ8= -=jkCu ------END PGP SIGNATURE----- - - -php-8.3.30.tar.gz -SHA256 hash: e587dc95fb7f62730299fa7b36b6e4f91e6708aaefa2fff68a0098d320c16386 -PGP signature: ------BEGIN PGP SIGNATURE----- - -iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd -5F4eAP44IkpP3p3FRq3S9pDm9Y6bJnrpzxafqfXlZ949ECmUIgEAxFb+m5Tz7gcb -DSU+taIv2W6EQeijjaXPvAE2t1dGswo= -=kn1U ------END PGP SIGNATURE----- - - -php-8.3.30.tar.xz -SHA256 hash: 67f084d36852daab6809561a7c8023d130ca07fc6af8fb040684dd1414934d48 -PGP signature: ------BEGIN PGP SIGNATURE----- - -iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsQAKCRAcB3ncXAqd -5NYpAP9Is0pCLlEuLiSRdAbgWPDee0jPA5JGoriGOFNkdMk67AD/WTzYCx7+dEVG -8Gb54wK005bk9nRGYQqwvZb+r1gqaQU= -=vSr4 ------END PGP SIGNATURE----- - - From d1512d31b2ce72182dd1eadb1afc6293e17eb544 Mon Sep 17 00:00:00 2001 From: Arnaud Le Blanc Date: Wed, 8 Apr 2026 11:42:30 +0200 Subject: [PATCH 2/6] NEWS Closes GH-21460 via 3748255726b84b80ec128485b3885bd801df0049. --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index 4abaa254acb7..d21afe06b193 100644 --- a/NEWS +++ b/NEWS @@ -24,6 +24,7 @@ PHP NEWS . Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg). (Arnaud) . Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch). (ilutov) + . Fixed bug GH-21460 (COND optimization regression). (Dmitry, Arnaud) - OpenSSL: . Fix a bunch of memory leaks and crashes on edge cases. (ndossche) From af50736ee2e0f4edcdb2cab62d7ccb42dd67a75c Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Wed, 8 Apr 2026 12:27:05 +0200 Subject: [PATCH 3/6] [skip if] Drop NEWS entry The faulty commit never reached production, so we don't need a NEWS entry for the fix. --- NEWS | 2 -- 1 file changed, 2 deletions(-) diff --git a/NEWS b/NEWS index d21afe06b193..92cc9be453dd 100644 --- a/NEWS +++ b/NEWS @@ -17,8 +17,6 @@ PHP NEWS - Iconv: . Fixed bug GH-17399 (iconv memory leak on bailout). (iliaal) - . Fixed bug GH-21664 (iconv_mime_encode()/iconv_mime_decode() - crash with corrupt bailout state. (David Carlier) - Opcache: . Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in From 95e93b85fa30b535922726f3e951a382c6ab40e8 Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Wed, 8 Apr 2026 00:00:25 +0200 Subject: [PATCH 4/6] Fix faulty zend_try handling in zend_jit_trace() --- NEWS | 1 + ext/opcache/jit/zend_jit_trace.c | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index 92cc9be453dd..84ef07ea11ee 100644 --- a/NEWS +++ b/NEWS @@ -23,6 +23,7 @@ PHP NEWS zend_jit_use_reg). (Arnaud) . Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch). (ilutov) . Fixed bug GH-21460 (COND optimization regression). (Dmitry, Arnaud) + . Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov) - OpenSSL: . Fix a bunch of memory leaks and crashes on edge cases. (ndossche) diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index b5d980ca5afc..320967419055 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -5167,7 +5167,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par && ssa->vars[ssa_op->op2_def].use_chain < 0 && !ssa->vars[ssa_op->op2_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -5220,7 +5220,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par && ssa->vars[ssa_op->op1_def].use_chain < 0 && !ssa->vars[ssa_op->op1_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -5317,7 +5317,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par && ssa->vars[ssa_op->op1_def].use_chain < 0 && !ssa->vars[ssa_op->op1_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -6539,7 +6539,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par var_num = EX_VAR_TO_NUM(var_num); if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -7179,7 +7179,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par && type != STACK_MEM_TYPE(stack, i) && zend_jit_trace_must_store_type(op_array, op_array_ssa, opline - op_array->opcodes, i, type)) { if (!zend_jit_store_type(jit, i, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, i, type, 1); } @@ -7301,11 +7301,11 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par zend_string_release(name); } +jit_cleanup:; } zend_catch { do_bailout = 1; } zend_end_try(); -jit_cleanup: /* Clean up used op_arrays */ while (num_op_arrays > 0) { op_array = op_arrays[--num_op_arrays]; From e50cd125c9fc273b7dab6e5f8746d32e2c01069e Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 7 Apr 2026 22:51:49 +0200 Subject: [PATCH 5/6] Add EG(bailout) consistency assertion Make sure EG(bailout) is what we expect. This will detect faulty jumps into or out of zend_try blocks, as in 38628e8. Closes GH-21667 --- Zend/zend.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Zend/zend.h b/Zend/zend.h index c2c8d4ee6a2c..c3323e4c4bfa 100644 --- a/Zend/zend.h +++ b/Zend/zend.h @@ -275,7 +275,9 @@ typedef size_t (*zend_write_func_t)(const char *str, size_t str_length); EG(bailout) = &__bailout; \ if (SETJMP(__bailout)==0) { #define zend_catch \ + ZEND_ASSERT(EG(bailout) == &__bailout); \ } else { \ + ZEND_ASSERT(EG(bailout) == &__bailout); \ EG(bailout) = __orig_bailout; #define zend_end_try() \ } \ From 89729383e270c444ec3220755cbddd8baf3e8242 Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Thu, 2 Apr 2026 15:42:48 +0200 Subject: [PATCH 6/6] Fix missing addref for Countable::count() Fixes GH-21605 --- NEWS | 1 + Zend/tests/gh21605.phpt | 24 ++++++++++++++++++++++++ Zend/zend_vm_def.h | 2 ++ Zend/zend_vm_execute.h | 6 ++++++ 4 files changed, 33 insertions(+) create mode 100644 Zend/tests/gh21605.phpt diff --git a/NEWS b/NEWS index 84ef07ea11ee..fcdfd3973d83 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ PHP NEWS destructors). (iliaal) . Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies). (iliaal) + . Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov) - Curl: . Add support for brotli and zstd on Windows. (Shivam Mathur) diff --git a/Zend/tests/gh21605.phpt b/Zend/tests/gh21605.phpt new file mode 100644 index 000000000000..973339ad3bb9 --- /dev/null +++ b/Zend/tests/gh21605.phpt @@ -0,0 +1,24 @@ +--TEST-- +GH-21605: Missing addref for Countable::count() +--CREDITS-- +cnwangjihe +--FILE-- + +--EXPECTF-- +object(C)#%d (0) { +} +int(42) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 4ecd80837b19..34906e1bfcca 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -9419,7 +9419,9 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED) zval retval; zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT)); + GC_ADDREF(zobj); zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval); + OBJ_RELEASE(zobj); count = zval_get_long(&retval); zval_ptr_dtor(&retval); break; diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index d7c14a7cf807..d4b2aff1907b 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -11347,7 +11347,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_COUNT_SPEC_CONST_ zval retval; zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT)); + GC_ADDREF(zobj); zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval); + OBJ_RELEASE(zobj); count = zval_get_long(&retval); zval_ptr_dtor(&retval); break; @@ -18826,7 +18828,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_COUNT_SPEC_TMPVAR_UNUSED_HANDL zval retval; zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT)); + GC_ADDREF(zobj); zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval); + OBJ_RELEASE(zobj); count = zval_get_long(&retval); zval_ptr_dtor(&retval); break; @@ -51390,7 +51394,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_COUNT_SPEC_CV_UNUSED_HANDLER(Z zval retval; zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT)); + GC_ADDREF(zobj); zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval); + OBJ_RELEASE(zobj); count = zval_get_long(&retval); zval_ptr_dtor(&retval); break;