Commit c51f4e1fc05 for php
commit c51f4e1fc057cd741636751b6e784b102bfaa7d4
Merge: 1fa14b029a7 6ee6f67832d
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Thu Oct 15 20:57:07 2026 +0200
Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
Fix GH-24337: JIT segfault when decrementing a non-numeric string property
diff --cc ext/opcache/jit/zend_jit_ir.c
index 459d4999f50,7423a22b709..6a3f0382926
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@@ -15974,11 -15923,12 +15974,12 @@@ static int zend_jit_incdec_obj(zend_jit
if (if_long) {
ir_IF_FALSE_cold(if_long);
}
+ if (var_info & (MAY_BE_ANY - (MAY_BE_LONG|MAY_BE_DOUBLE))) {
- may_throw = 1;
++ may_throw = true;
+ jit_SET_EX_OPLINE(jit, opline);
+ }
if (opline->opcode == ZEND_POST_INC_OBJ || opline->opcode == ZEND_POST_DEC_OBJ) {
- jit_ZVAL_COPY(jit, res_addr, -1, var_addr, var_info, 1);
+ jit_ZVAL_COPY(jit, res_addr, -1, var_addr, var_info, true);
}
if (opline->opcode == ZEND_PRE_INC_OBJ || opline->opcode == ZEND_POST_INC_OBJ) {
if (opline->opcode == ZEND_PRE_INC_OBJ && opline->result_type != IS_UNUSED) {