Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282

Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282

3 issues:
1) RETURN_NULL() was used via the macro NODE_GET_OBJ(), but the function
returns false on failure

Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282

3 issues:
1) RETURN_NULL() was used via the macro NODE_GET_OBJ(), but the function
returns false on failure and cannot return null according to its
stub.
2) The struct layout of the different implementors of libxml only
guarantees overlap between the node pointer and the document
reference, so accessing the std zend_object may not work.
3) DOC_GET_OBJ() wasn't using ZSTR_VAL().

Closes GH-16307.

show more ...

PHP-8.3 is now for PHP-8.3.14-dev

Update Lexbor (#16288)

Sync up to lexbor/lexbor@72236d31da1a4c3d83c621446dcf4f70345fda05.
Reason: pulling in mainly
lexbor/lexbor@cbf1263e7875dfc47059f71760935bce9b0c6920 for the WHA

Update Lexbor (#16288)

Sync up to lexbor/lexbor@72236d31da1a4c3d83c621446dcf4f70345fda05.
Reason: pulling in mainly
lexbor/lexbor@cbf1263e7875dfc47059f71760935bce9b0c6920 for the WHATWG
encoding update.

show more ...

[ci skip] Update NEWS for PHP 8.4.0RC2

Fix regression on platforms without `ZEND_CHECK_STACK_LIMIT` set (8.4) (#16285)

The check called an API only available with this def set.
Gate the check behind ifdef and change control f

Fix regression on platforms without `ZEND_CHECK_STACK_LIMIT` set (8.4) (#16285)

The check called an API only available with this def set.
Gate the check behind ifdef and change control flow to better fit it.

Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>

show more ...

Fix various hooked object iterator issues

Fixes GH-16185
Closes GH-16281

Update IR

IR commit: 88c71c9572bdd9dd8aed99c80ad4a54fcbcfe082

Fix PDO_Firebird tests for 32bit

These tests are failing because the integers are too large to be cast
to a PHP int. We fix this by expecting either an int or a string.

Closes

Fix PDO_Firebird tests for 32bit

These tests are failing because the integers are too large to be cast
to a PHP int. We fix this by expecting either an int or a string.

Closes GH-16278.

show more ...

NEWS for GH-16200

Use original op_array when JIT compiling a Closure

zend_jit() assumes that Closure op_arrays have no scope, but this is not true
when using the hot counters, first exec, or trace trigger

Use original op_array when JIT compiling a Closure

zend_jit() assumes that Closure op_arrays have no scope, but this is not true
when using the hot counters, first exec, or trace triggers as they use the
executed op_array, which is in case of Closures is a copy, with a scope.

In the tracing JIT this problem is avoided as we fetch the original op_array
when compiling a Closure. Here I replicate this for the hot counters and first
exec triggers.

Fixes GH-16186
Closes GH-16200

show more ...

Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
Fix GH-16261: Reference invariant broken in mb_convert_variables()

Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
Fix GH-16261: Reference invariant broken in mb_convert_variables()

Fix GH-16261: Reference invariant broken in mb_convert_variables()

The behaviour is weird in the sense that the reference must get
unwrapped. What ended up happening is that when destroy

Fix GH-16261: Reference invariant broken in mb_convert_variables()

The behaviour is weird in the sense that the reference must get
unwrapped. What ended up happening is that when destroying the old
reference the sources list was not cleaned properly. We add handling for
that. Normally we would use use ZEND_TRY_ASSIGN_STRINGL but that doesn't
work here as it would keep the reference and change values through
references (see bug #26639).

Closes GH-16272.

show more ...

Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
Fix GH-16259: Soap segfault when classmap instantiation fails

Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
Fix GH-16259: Soap segfault when classmap instantiation fails

Fix GH-16259: Soap segfault when classmap instantiation fails

Instantiation failure checks were missing.

Closes GH-16273.

Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

In the test, I have an internal `__call` function for `_ZendTestMagicCallForward` that calls

Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

In the test, I have an internal `__call` function for `_ZendTestMagicCallForward` that calls the global function with name `$name` via `call_user_function`.
Note that observer writes the pointer to the previously observed frame in the last temporary of the new call frame (`*prev_observed_frame`).

The following happens:
First, we call `$test->callee`, this will be handled via a trampoline with T=2 for the two arguments. The call frame is allocated at this point. This call frame is not observed because it has `ZEND_ACC_CALL_VIA_TRAMPOLINE` set. Next we use `ZEND_CALL_TRAMPOLINE` to call the trampoline, this reuses the stack frame allocated earlier with T=2, but this time it is observed. The pointer to the previous frame is written outside of the call frame because `T` is too small (should be 3). We are now in the internal function `_ZendTestMagicCallForward::__call` where we call the global function `callee`. This will push a new call frame which will overlap `*prev_observed_frame`. This value gets overwritten by `zend_init_func_execute_data` when `EX(opline)` is set because `*prev_observed_frame` overlaps with `EX(opline)`. From now on, `*prev_observed_frame` is corrupted. When `zend_observer_fcall_end` is called this will result in reading wrong value `*prev_observed_frame` into `current_observed_frame`. This causes issues in `zend_observer_fcall_end_all` leading to the segfault we observe.

Despite function with `ZEND_ACC_CALL_VIA_TRAMPOLINE` not being observed, the reuse of call frames makes problems when `T` is not large enough.
To fix this, we make sure to add 1 to `T` if `ZEND_OBSERVER_ENABLED` is true.

Closes GH-16252.

show more ...

NEWS for GH-16196

Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
NEWS for GH-16196
NEWS for GH-16196
Handle references properties of the Exception class

NEWS for GH-16196

Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
NEWS for GH-16196
Handle references properties of the Exception class

NEWS for GH-16196