Merge branch 'master' into htmlspecialchars

Author: ArtUkrainskiy

.github/CODEOWNERS

@@ -44,6 +44,7 @@
 /ext/pdo_sqlite @SakiTakamachi
 /ext/pgsql @devnexen
 /ext/random @TimWolla @zeriyoshi
+/ext/reflection @DanielEScherzer
 /ext/session @Girgias
 /ext/simplexml @nielsdos
 /ext/soap @nielsdos

EXTENSIONS

@@ -412,7 +412,7 @@ STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           random
 PRIMARY MAINTAINER   Go Kudo <zeriyoshi@php.net> (2022 - 2024)
-                     Tim Düsterhus <timwolla@php.net> (2022 - 2024)
+                     Tim Düsterhus <timwolla@php.net> (2022 - 2025)
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               8.2.0
@@ -426,6 +426,7 @@ EXTENSION:           reflection
 PRIMARY MAINTAINER:  Marcus Börger <helly@php.net> (2003 - 2009)
                      Johannes Schlüter <johannes@php.net> (2006 - 2014)
                      Nikita Popov <nikic@php.net> (2019 - 2020)
+                     Daniel Scherzer <daniel.e.scherzer@gmail.com> (2025 - 2025)
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------

NEWS

@@ -37,6 +37,10 @@ PHP                                                                        NEWS
     (ilutov)
   . Fixed bug GH-18033 (NULL-ptr dereference when using register_tick_function
     in destructor). (nielsdos)
+  . Fixed bug GH-18026 (Improve "expecting token" error for ampersand). (ilutov)
+  . Added the (void) cast to indicate that not using a value is intentional.
+    (timwolla)
+  . Added get_error_handler(), get_exception_handler() functions. (Arnaud)
 
 - Curl:
   . Added curl_multi_get_handles(). (timwolla)
@@ -59,6 +63,10 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Upgrade to file 5.46. (nielsdos)
 
+- FPM:
+  . Fixed GH-17645 (FPM with httpd ProxyPass does not decode script path).
+    (Jakub Zelenka)
+
 - GD:
   . Fixed bug #68629 (Transparent artifacts when using imagerotate). (pierre,
     cmb)
@@ -88,6 +96,8 @@ PHP                                                                        NEWS
 
 - PCRE:
   . Upgraded to pre2lib from 10.44 to 10.45. (nielsdos)
+  . Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options.
+    (mvorisek)
 
 - PDO_PGSQL:
   . Added Iterable support for PDO::pgsqlCopyFromArray. (KentarouTakeda)
@@ -102,6 +112,8 @@ PHP                                                                        NEWS
   . pg_connect checks if connection_string contains any null byte,
     pg_close_stmt check if the statement contains any null byte.
     (David Carlier)
+  . Added pg_service to get the connection current service identifier.
+    (David Carlier)
 
 - POSIX:
   . Added POSIX_SC_OPEN_MAX constant to get the number of file descriptors
@@ -118,12 +130,18 @@ PHP                                                                        NEWS
     (DanielEScherzer)
   . Fixed bug GH-12856 (ReflectionClass::getStaticPropertyValue() returns UNDEF
     zval for uninitialized typed properties). (nielsdos)
+  . Fixed bug GH-15766 (ReflectionClass::toString() should have better output
+    for enums). (DanielEScherzer)
 
 - Session:
   . session_start() throws a ValueError on option argument if not a hashmap
     or a TypeError if read_and_close value is not compatible with int.
     (David Carlier)
 
+- SimpleXML:
+  . Fixed bug GH-12231 (SimpleXML xpath should warn when returning other return
+    types than node lists). (nielsdos)
+
 - SNMP:
   . snmpget, snmpset, snmp_get2, snmp_set2, snmp_get3, snmp_set3 and
     SNMP::__construct() throw an exception on invalid hostname, community
@@ -169,6 +187,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed crypt() tests on musl when using --with-external-libcrypt
     (Michael Orlitzky).
+  . Fixed bug GH-18062 (is_callable(func(...), callable_name: $name) for first
+    class callables returns wrong name). (timwolla)
 
 - Streams:
   . Fixed bug GH-16889 (stream_select() timeout useless for pipes on Windows).

UPGRADING

@@ -59,6 +59,11 @@ PHP 8.5 UPGRADE NOTES
   . pcntl_exec() now throws ValueErrors when entries or keys of the
     $env_vars parameter contain null bytes.
 
+- PCRE:
+  . The extension is compiled without semi-deprecated
+    PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK compile option.
+    https://github.com/PCRE2Project/pcre2/issues/736#issuecomment-2754024651
+
 - PDO:
   . The constructor arguments set in conjunction with PDO::FETCH_CLASS now
     follow the usual CUFA (call_user_func_array) semantics.
@@ -82,6 +87,11 @@ PHP 8.5 UPGRADE NOTES
   . A ValueError is now thrown when trying to set a cursor name that is too
     long on a PDOStatement resulting from the Firebird driver.
 
+- SimpleXML:
+  - Passing an XPath expression that returns something other than a node set
+    to SimpleXMLElement::xpath() will now emit a warning and return false,
+    instead of silently failing and returning an empty array.
+
 - SPL:
   . ArrayObject no longer accepts enums, as modifying the $name or $value
     properties can break engine assumptions.
@@ -101,6 +111,9 @@ PHP 8.5 UPGRADE NOTES
   . Fatal Errors (such as an exceeded maximum execution time) now include a
     backtrace.
     RFC: https://wiki.php.net/rfc/error_backtraces_v2
+  . Added the (void) to indicate that not using a value is intentional. The
+    (void) cast does nothing by itself.
+    RFC: https://wiki.php.net/rfc/marking_return_value_as_important
 
 - Curl:
   . Added support for share handles that are persisted across multiple PHP
@@ -144,6 +157,10 @@ PHP 8.5 UPGRADE NOTES
   . Added a new --ini=diff option to print INI settings changed from the builtin
     default.
 
+- FPM:
+  . FPM with httpd ProxyPass decodes the full scirpt path script path. Added
+    fastcgi.script_path_encoded INI setting to prevent this new behevior.
+
 ========================================
 4. Deprecated Functionality
 ========================================
@@ -189,6 +206,11 @@ PHP 8.5 UPGRADE NOTES
   . posix_fpathconf checks invalid file descriptors and sets
     last_error to EBADF and raises an E_WARNING message.
 
+- Reflection:
+  . The output of ReflectionClass::toString() for enums has changed to
+    better indicate that the class is an enum, and that the enum cases
+    are enum cases rather than normal class constants.
+
 - Session:
   . session_start is stricter in regard of the option argument.
     It throws a ValueError if the whole is not a hashmap or
@@ -227,6 +249,14 @@ PHP 8.5 UPGRADE NOTES
 6. New Functions
 ========================================
 
+- Core:
+  . get_error_handler() allows retrieving the current user-defined error handler
+    function.
+    RFC: https://wiki.php.net/rfc/get-error-exception-handler
+  . get_exception_handler() allows retrieving the current user-defined exception
+    handler function.
+    RFC: https://wiki.php.net/rfc/get-error-exception-handler
+
 - Curl:
   . curl_multi_get_handles() allows retrieving all CurlHandles current
     attached to a CurlMultiHandle. This includes both handles added using
@@ -248,6 +278,7 @@ PHP 8.5 UPGRADE NOTES
   . pg_close_stmt offers an alternative way to close a prepared
     statement from the DEALLOCATE sql command in that we can reuse
     its name afterwards.
+  . pg_service returns the ongoing service name of the connection.
 
 - Reflection:
   . ReflectionConstant::getFileName() was introduced.

UPGRADING.INTERNALS

@@ -19,6 +19,12 @@ PHP 8.5 INTERNALS UPGRADE NOTES
     a value to a non-reference zval.
   . Added zval_ptr_safe_dtor() to safely destroy a zval when a destructor
     could interfere.
+  . zend_get_callable_name() now returns the name of the underlying function
+    for fake closures.
+  . Added smart_string_append_printf() matching smart_str_append_printf() for
+    char* instead of zend_string*-based smart strings.
+  . Added php_build_provider() to retrieve the value of PHP_BUILD_PROVIDER at
+    runtime.
 
 ========================
 2. Build system changes

Zend/Optimizer/block_pass.c

@@ -274,7 +274,9 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 				 * If it's not local, then the other blocks successors must also eventually either FREE or consume the temporary,
 				 * hence removing the temporary is not safe in the general case, especially when other consumers are not FREE.
 				 * A FREE may not be removed without also removing the source's result, because otherwise that would cause a memory leak. */
-				if (opline->op1_type == IS_TMP_VAR) {
+				if (opline->extended_value == ZEND_FREE_VOID_CAST) {
+					/* Keep the ZEND_FREE opcode alive. */
+				} else if (opline->op1_type == IS_TMP_VAR) {
 					src = VAR_SOURCE(opline->op1);
 					if (src) {
 						switch (src->opcode) {

Zend/Optimizer/compact_literals.c

@@ -165,7 +165,7 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 	HashTable hash;
 	zend_string *key = NULL;
 	void *checkpoint = zend_arena_checkpoint(ctx->arena);
-	int *const_slot, *class_slot, *func_slot, *bind_var_slot, *property_slot, *method_slot;
+	int *const_slot, *class_slot, *func_slot, *bind_var_slot, *property_slot, *method_slot, *jmp_slot;
 
 	if (op_array->last_literal) {
 		info = (literal_info*)zend_arena_calloc(&ctx->arena, op_array->last_literal, sizeof(literal_info));
@@ -175,6 +175,9 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 		end = opline + op_array->last;
 		while (opline < end) {
 			switch (opline->opcode) {
+				case ZEND_JMP_FRAMELESS:
+					LITERAL_INFO(opline->op1.constant, 1);
+					break;
 				case ZEND_INIT_FCALL_BY_NAME:
 					LITERAL_INFO(opline->op2.constant, 2);
 					break;
@@ -480,13 +483,14 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 		zend_hash_clean(&hash);
 		op_array->last_literal = j;
 
-		const_slot = zend_arena_alloc(&ctx->arena, j * 6 * sizeof(int));
-		memset(const_slot, -1, j * 6 * sizeof(int));
+		const_slot = zend_arena_alloc(&ctx->arena, j * 7 * sizeof(int));
+		memset(const_slot, -1, j * 7 * sizeof(int));
 		class_slot = const_slot + j;
 		func_slot = class_slot + j;
 		bind_var_slot = func_slot + j;
 		property_slot = bind_var_slot + j;
 		method_slot = property_slot + j;
+		jmp_slot = method_slot + j;
 
 		/* Update opcodes to use new literals table */
 		cache_size = zend_op_array_extension_handles * sizeof(void*);
@@ -773,10 +777,19 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					break;
 				case ZEND_DECLARE_ANON_CLASS:
 				case ZEND_DECLARE_CLASS_DELAYED:
-				case ZEND_JMP_FRAMELESS:
 					opline->extended_value = cache_size;
 					cache_size += sizeof(void *);
 					break;
+				case ZEND_JMP_FRAMELESS:
+					// op1 func
+					if (jmp_slot[opline->op1.constant] >= 0) {
+						opline->extended_value = jmp_slot[opline->op1.constant];
+					} else {
+						opline->extended_value = cache_size;
+						cache_size += sizeof(void *);
+						jmp_slot[opline->op1.constant] = opline->extended_value;
+					}
+					break;
 				case ZEND_SEND_VAL:
 				case ZEND_SEND_VAL_EX:
 				case ZEND_SEND_VAR:

Zend/Optimizer/dce.c

@@ -80,7 +80,6 @@ static inline bool may_have_side_effects(
 		case ZEND_IS_IDENTICAL:
 		case ZEND_IS_NOT_IDENTICAL:
 		case ZEND_QM_ASSIGN:
-		case ZEND_FREE:
 		case ZEND_FE_FREE:
 		case ZEND_TYPE_CHECK:
 		case ZEND_DEFINED:
@@ -127,6 +126,8 @@ static inline bool may_have_side_effects(
 		case ZEND_ARRAY_KEY_EXISTS:
 			/* No side effects */
 			return 0;
+		case ZEND_FREE:
+			return opline->extended_value == ZEND_FREE_VOID_CAST;
 		case ZEND_ADD_ARRAY_ELEMENT:
 			/* TODO: We can't free two vars. Keep instruction alive. <?php [0, "$a" => "$b"]; */
 			if ((opline->op1_type & (IS_VAR|IS_TMP_VAR)) && (opline->op2_type & (IS_VAR|IS_TMP_VAR))) {

Zend/Optimizer/dfa_pass.c

@@ -407,40 +407,28 @@ int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
 		zend_call_info *call_info = func_info->callee_info;
 
 		do {
-			if (call_info->caller_call_opline
-			 && call_info->caller_call_opline->opcode == ZEND_DO_ICALL
+			zend_op *op = call_info->caller_init_opline;
+
+			if ((op->opcode == ZEND_FRAMELESS_ICALL_2
+			  || (op->opcode == ZEND_FRAMELESS_ICALL_3 && (op + 1)->op1_type == IS_CONST))
 			 && call_info->callee_func
-			 && zend_string_equals_literal(call_info->callee_func->common.function_name, "in_array")
-			 && (call_info->caller_init_opline->extended_value == 2
-			  || (call_info->caller_init_opline->extended_value == 3
-			   && (call_info->caller_call_opline - 1)->opcode == ZEND_SEND_VAL
-			   && (call_info->caller_call_opline - 1)->op1_type == IS_CONST))) {
-
-				zend_op *send_array;
-				zend_op *send_needly;
+			 && zend_string_equals_literal_ci(call_info->callee_func->common.function_name, "in_array")) {
+
 				bool strict = 0;
+				bool has_opdata = op->opcode == ZEND_FRAMELESS_ICALL_3;
 				ZEND_ASSERT(!call_info->is_prototype);
 
-				if (call_info->caller_init_opline->extended_value == 2) {
-					send_array = call_info->caller_call_opline - 1;
-					send_needly = call_info->caller_call_opline - 2;
-				} else {
-					if (zend_is_true(CT_CONSTANT_EX(op_array, (call_info->caller_call_opline - 1)->op1.constant))) {
+				if (has_opdata) {
+					if (zend_is_true(CT_CONSTANT_EX(op_array, (op + 1)->op1.constant))) {
 						strict = 1;
 					}
-					send_array = call_info->caller_call_opline - 2;
-					send_needly = call_info->caller_call_opline - 3;
 				}
 
-				if (send_array->opcode == ZEND_SEND_VAL
-				 && send_array->op1_type == IS_CONST
-				 && Z_TYPE_P(CT_CONSTANT_EX(op_array, send_array->op1.constant)) == IS_ARRAY
-				 && (send_needly->opcode == ZEND_SEND_VAL
-				  || send_needly->opcode == ZEND_SEND_VAR)
-			    ) {
+				if (op->op2_type == IS_CONST
+				 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op->op2.constant)) == IS_ARRAY) {
 					bool ok = 1;
 
-					HashTable *src = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, send_array->op1.constant));
+					HashTable *src = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, op->op2.constant));
 					HashTable *dst;
 					zval *val, tmp;
 					zend_ulong idx;
@@ -471,59 +459,15 @@ int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
 					}
 
 					if (ok) {
-						uint32_t op_num = send_needly - op_array->opcodes;
-						zend_ssa_op *ssa_op = ssa->ops + op_num;
-
-						if (ssa_op->op1_use >= 0) {
-							/* Reconstruct SSA */
-							int var_num = ssa_op->op1_use;
-							zend_ssa_var *var = ssa->vars + var_num;
-
-							ZEND_ASSERT(ssa_op->op1_def < 0);
-							zend_ssa_unlink_use_chain(ssa, op_num, ssa_op->op1_use);
-							ssa_op->op1_use = -1;
-							ssa_op->op1_use_chain = -1;
-							op_num = call_info->caller_call_opline - op_array->opcodes;
-							ssa_op = ssa->ops + op_num;
-							ssa_op->op1_use = var_num;
-							ssa_op->op1_use_chain = var->use_chain;
-							var->use_chain = op_num;
-						}
-
 						ZVAL_ARR(&tmp, dst);
 
 						/* Update opcode */
-						call_info->caller_call_opline->opcode = ZEND_IN_ARRAY;
-						call_info->caller_call_opline->extended_value = strict;
-						call_info->caller_call_opline->op1_type = send_needly->op1_type;
-						call_info->caller_call_opline->op1.num = send_needly->op1.num;
-						call_info->caller_call_opline->op2_type = IS_CONST;
-						call_info->caller_call_opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
-						if (call_info->caller_init_opline->extended_value == 3) {
-							MAKE_NOP(call_info->caller_call_opline - 1);
-						}
-						MAKE_NOP(call_info->caller_init_opline);
-						MAKE_NOP(send_needly);
-						MAKE_NOP(send_array);
-						removed_ops++;
-
-						op_num = call_info->caller_call_opline - op_array->opcodes;
-						ssa_op = ssa->ops + op_num;
-						if (ssa_op->result_def >= 0) {
-							int var = ssa_op->result_def;
-							int use = ssa->vars[var].use_chain;
-
-							/* If the result is used only in a JMPZ/JMPNZ, replace result type with
-							 * IS_TMP_VAR, which will enable use of smart branches. Don't do this
-							 * in other cases, as not all opcodes support both VAR and TMP. */
-							if (ssa->vars[var].phi_use_chain == NULL
-								&& ssa->ops[use].op1_use == var
-								&& ssa->ops[use].op1_use_chain == -1
-								&& (op_array->opcodes[use].opcode == ZEND_JMPZ
-									|| op_array->opcodes[use].opcode == ZEND_JMPNZ)) {
-								call_info->caller_call_opline->result_type = IS_TMP_VAR;
-								op_array->opcodes[use].op1_type = IS_TMP_VAR;
-							}
+						op->opcode = ZEND_IN_ARRAY;
+						op->extended_value = strict;
+						op->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
+						if (has_opdata) {
+							MAKE_NOP(op + 1);
+							removed_ops++;
 						}
 					}
 				}