Commit cfef166c007 for php

commit cfef166c0075842f0326f608b026e4c0d05f370d
Author: Gina Peter Banyard <girgias@php.net>
Date:   Fri Oct 30 16:27:36 2026 +0000

    Zend: fix calls to zend_arena_calloc() (#25018)

    It's count then unit_size, not the other way round.

diff --git a/Zend/Optimizer/zend_call_graph.c b/Zend/Optimizer/zend_call_graph.c
index fe8049be7e3..2b1b128e0a0 100644
--- a/Zend/Optimizer/zend_call_graph.c
+++ b/Zend/Optimizer/zend_call_graph.c
@@ -268,7 +268,7 @@ ZEND_API zend_call_info **zend_build_call_map(zend_arena **arena, const zend_fun
 		return NULL;
 	}

-	map = zend_arena_calloc(arena, sizeof(zend_call_info *), op_array->last);
+	map = zend_arena_calloc(arena, op_array->last, sizeof(zend_call_info *));
 	for (call = info->callee_info; call; call = call->next_callee) {
 		map[call->caller_init_opline - op_array->opcodes] = call;
 		if (call->caller_call_opline) {
diff --git a/Zend/Optimizer/zend_cfg.c b/Zend/Optimizer/zend_cfg.c
index 837515169d7..ce08d8cafb0 100644
--- a/Zend/Optimizer/zend_cfg.c
+++ b/Zend/Optimizer/zend_cfg.c
@@ -462,7 +462,7 @@ ZEND_API void zend_build_cfg(zend_arena **arena, const zend_op_array *op_array,
 	cfg->blocks_count = blocks_count;

 	/* Build CFG, Step 2: Build Array of Basic Blocks */
-	cfg->blocks = blocks = zend_arena_calloc(arena, sizeof(zend_basic_block), blocks_count);
+	cfg->blocks = blocks = zend_arena_calloc(arena, blocks_count, sizeof(zend_basic_block));

 	blocks_count = -1;

@@ -611,7 +611,7 @@ ZEND_API void zend_cfg_build_predecessors(zend_arena **arena, zend_cfg *cfg) /*
 	}

 	cfg->edges_count = edges;
-	cfg->predecessors = predecessors = (int*)zend_arena_calloc(arena, sizeof(int), edges);
+	cfg->predecessors = predecessors = (int*)zend_arena_calloc(arena, edges, sizeof(int));

 	edges = 0;
 	for (b = blocks; b < end; b++) {
diff --git a/Zend/Optimizer/zend_worklist.h b/Zend/Optimizer/zend_worklist.h
index ea03048e975..03bd5221d45 100644
--- a/Zend/Optimizer/zend_worklist.h
+++ b/Zend/Optimizer/zend_worklist.h
@@ -39,7 +39,7 @@ static inline void zend_worklist_stack_prepare(zend_arena **arena, zend_worklist
 {
 	ZEND_ASSERT(len >= 0);

-	stack->buf = (int*)zend_arena_calloc(arena, sizeof(*stack->buf), len);
+	stack->buf = (int*)zend_arena_calloc(arena, len, sizeof(*stack->buf));
 	stack->len = 0;
 	stack->capacity = len;
 }
@@ -81,7 +81,7 @@ typedef struct _zend_worklist {
 static inline void zend_worklist_prepare(zend_arena **arena, zend_worklist *worklist, int len)
 {
 	ZEND_ASSERT(len >= 0);
-	worklist->visited = (zend_bitset)zend_arena_calloc(arena, sizeof(zend_ulong), zend_bitset_len(len));
+	worklist->visited = (zend_bitset)zend_arena_calloc(arena, zend_bitset_len(len), sizeof(zend_ulong));
 	zend_worklist_stack_prepare(arena, &worklist->stack, len);
 }

diff --git a/Zend/zend_enum.c b/Zend/zend_enum.c
index 8391b32ce19..079d1d58ae3 100644
--- a/Zend/zend_enum.c
+++ b/Zend/zend_enum.c
@@ -445,7 +445,7 @@ void zend_enum_register_funcs(zend_class_entry *ce)
 {
 	const uint32_t fn_flags =
 		ZEND_ACC_PUBLIC|ZEND_ACC_STATIC|ZEND_ACC_HAS_RETURN_TYPE|ZEND_ACC_ARENA_ALLOCATED;
-	zend_internal_function *cases_function = zend_arena_calloc(&CG(arena), sizeof(zend_internal_function), 1);
+	zend_internal_function *cases_function = zend_arena_calloc(&CG(arena), 1, sizeof(zend_internal_function));
 	cases_function->handler = zend_enum_cases_func;
 	cases_function->function_name = ZSTR_KNOWN(ZEND_STR_CASES);
 	cases_function->fn_flags = fn_flags;
@@ -454,7 +454,7 @@ void zend_enum_register_funcs(zend_class_entry *ce)
 	zend_enum_register_func(ce, ZEND_STR_CASES, cases_function);

 	if (ce->enum_backing_type != IS_UNDEF) {
-		zend_internal_function *from_function = zend_arena_calloc(&CG(arena), sizeof(zend_internal_function), 1);
+		zend_internal_function *from_function = zend_arena_calloc(&CG(arena), 1, sizeof(zend_internal_function));
 		from_function->handler = zend_enum_from_func;
 		from_function->function_name = ZSTR_KNOWN(ZEND_STR_FROM);
 		from_function->fn_flags = fn_flags;
@@ -464,7 +464,7 @@ void zend_enum_register_funcs(zend_class_entry *ce)
 		from_function->arg_info = zarginfo_class_BackedEnum_from + 1;
 		zend_enum_register_func(ce, ZEND_STR_FROM, from_function);

-		zend_internal_function *try_from_function = zend_arena_calloc(&CG(arena), sizeof(zend_internal_function), 1);
+		zend_internal_function *try_from_function = zend_arena_calloc(&CG(arena), 1, sizeof(zend_internal_function));
 		try_from_function->handler = zend_enum_try_from_func;
 		try_from_function->function_name = ZSTR_KNOWN(ZEND_STR_TRYFROM);
 		try_from_function->fn_flags = fn_flags;