Commit 01e431b1e94 for php

commit 01e431b1e94e2a53d0a24b8140ed633467f930b2
Merge: dab8fe3748b e8714b0f386
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date:   Mon Nov 9 22:00:30 2026 +0100

    Merge branch 'PHP-8.4' into PHP-8.5

    # Conflicts:
    #       NEWS
    #       ext/opcache/jit/zend_jit_helpers.c

diff --cc NEWS
index 2b420fdc3f0,a63b79ed130..cd11801b3cb
--- a/NEWS
+++ b/NEWS
@@@ -34,16 -40,10 +34,18 @@@ PH
    . Fixed memory leak in JIT ASSIGN_DIM when the assignment fails. (Jorg Sowa)
    . Fixed bug GH-16396 (Failed to invoke user error handler during index
      conversion in JIT). (Jorg Sowa)
 +  . Fixed bug GH-24801 (JIT: SIGFPE in ir_fold MUL_OV constant folding).
 +    (waroad)
    . Fixed bug GH-25037 (Function JIT ENTRY live var assertion).
      (Ilia Alshanetsky)
 +  . Fixed bug GH-25195 (smm_shared_globals left dangling without an
 +    SHM backend). (Grégoire Pineau)
 +  . Fixed bug GH-25269 (JIT: misaligned zval passed to
 +    ZEND_ADD_ARRAY_ELEMENT handler). (Jorg Sowa, ndossche)
 +  . Fixed bug GH-25253 (JIT reads parent of an unlinked class).
 +    (lazerg, mlenarciak)
+   . Fixed JIT ignoring leading-numeric string offsets in isset(), empty() and
+     ??. (Jorg Sowa)

  - PDO_Firebird:
    . Fixed stack buffer overflow with long connection user names, passwords,
diff --cc ext/opcache/jit/zend_jit_helpers.c
index 33b1b929909,d8607b1abd9..576fb1f8c3d
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@@ -1264,14 -1112,27 +1264,30 @@@ try_string_offset
  		switch (Z_TYPE_P(dim)) {
  			/* case IS_LONG: */
  			case IS_STRING:
- 				if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset, NULL, false)) {
- 					goto out;
+ 			{
+ 				bool trailing_data = false;
+ 				/* Allow errors to warn on leading-numeric strings, like the VM */
+ 				if (IS_LONG != is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset,
+ 						NULL, /* allow errors */ true, NULL, &trailing_data)) {
+ 					ZVAL_NULL(result);
+ 					return;
  				}
- 				ZVAL_NULL(result);
- 				return;
+ 				if (UNEXPECTED(trailing_data)) {
+ 					if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
+ 						GC_ADDREF(str);
+ 					}
+ 					zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
+ 					if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
+ 						zend_string_efree(str);
+ 						ZVAL_NULL(result);
+ 						return;
+ 					}
+ 				}
 -				break;
++				goto out;
+ 			}
 +			case IS_DOUBLE:
 +				offset = zend_dval_to_lval_silent(Z_DVAL_P(dim));
 +				goto out;
  			case IS_UNDEF:
  				zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
  				ZEND_FALLTHROUGH;