Commit 6db2baf86f5 for php

commit 6db2baf86f5f1dd3996288d3a48c1bd625f0fd8b
Author: lazerg <lazerg2@gmail.com>
Date:   Sun Oct 18 08:49:10 2026 +0500

    Fix GH-24388: Tracing JIT segfault when a trace runs out of side exits

    Closes GH-24395.

diff --git a/NEWS b/NEWS
index fea07475b6d..f5b7b534b64 100644
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
     property). (Lazizbek Ergashev)
   . Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
+  . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
+    exits). (Lazizbek Ergashev)

 - PDO:
   . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 8111c18f9c1..e94a86000a0 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -4921,6 +4921,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o

 		exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 		exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+		if (!exit_addr) {
+			return 0;
+		}
 		ir_GUARD_NOT(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));

 		if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4962,6 +4965,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o

 			exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 			exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+			if (!exit_addr) {
+				return 0;
+			}
 			ir_GUARD(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));

 			if (opline->result_type != IS_UNUSED) {
diff --git a/ext/opcache/tests/jit/gh24388.phpt b/ext/opcache/tests/jit/gh24388.phpt
new file mode 100644
index 00000000000..7a73bb7fb3c
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24388.phpt
@@ -0,0 +1,31 @@
+--TEST--
+GH-24388 (Tracing JIT: segfault when a trace runs out of side exits)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+$file = __DIR__ . "/gh24388.inc";
+
+$code = '<?php function f(int $k, int $a) { switch ($k) {';
+for ($i = 0; $i < 507; $i++) {
+    $code .= "case $i: \$l = $i; break;";
+}
+$code .= '} return ++$a; }';
+$code .= 'for ($i = 0; $i < 200; $i++) { $a = 3; f(0, $a); }';
+file_put_contents($file, $code);
+
+include $file;
+?>
+DONE
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh24388.inc");
+?>
+--EXPECT--
+DONE