Commit 07fc708950b for php

commit 07fc708950b0924e8d51a0cb8a922acb9ee23166
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Wed Oct 21 16:26:31 2026 -0400

    ext/opcache: Fix tracing JIT range narrowing against a non-integer operand

    Require both comparison operands to be integers before narrowing their
    ranges, so overflow checks are preserved for float and numeric-string
    literals.

    Closes GH-24528

diff --git a/NEWS b/NEWS
index db88846f75f..4c87bae6097 100644
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,9 @@ PHP                                                                        NEWS
     MariaDB PAM account). (lazerg)

 - Opcache:
+  . Fixed tracing JIT returning a wrapped integer instead of a float on
+    integer overflow after an integer was compared with a float or
+    numeric-string literal. (Ilia Alshanetsky)
   . Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property
     hook with minimal tracing JIT). (ndossche)
   . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index dc0ae8eea51..e2bb21cbbf4 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -3688,7 +3688,7 @@ static void zend_jit_trace_update_condition_ranges(const zend_op *opline, const
 	zend_long op1_min, op1_max, op2_min, op2_max;

 	if ((OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG
-	 || (OP1_INFO() & MAY_BE_ANY) != MAY_BE_LONG) {
+	 || (OP2_INFO() & MAY_BE_ANY) != MAY_BE_LONG) {
 		return;
 	}

diff --git a/ext/opcache/tests/jit/cmp_010.phpt b/ext/opcache/tests/jit/cmp_010.phpt
new file mode 100644
index 00000000000..562e4e1d5d7
--- /dev/null
+++ b/ext/opcache/tests/jit/cmp_010.phpt
@@ -0,0 +1,57 @@
+--TEST--
+JIT CMP: 010 Integer range must not be narrowed by a comparison with a non-integer operand
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_hot_func=1
+opcache.jit_hot_loop=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only");
+?>
+--FILE--
+<?php
+function lt_float(int $x) {
+    if ($x < 1.0e19) {
+        return $x + 1;
+    }
+    return 0;
+}
+function lt_string(int $x) {
+    if ($x < "1e19") {
+        return $x + 1;
+    }
+    return 0;
+}
+function le_float(int $x) {
+    if ($x <= -1.0e19) {
+        return 0;
+    }
+    return $x - 1;
+}
+foreach ([1, 2, 3, PHP_INT_MAX] as $v) {
+    $r = lt_float($v);
+}
+echo "int < float: ";
+var_dump($r);
+foreach ([1, 2, 3, PHP_INT_MAX] as $v) {
+    $r = lt_string($v);
+}
+echo "int < numeric string: ";
+var_dump($r);
+foreach ([1, 2, 3, PHP_INT_MIN] as $v) {
+    $r = le_float($v);
+}
+echo "int <= float (false): ";
+var_dump($r);
+?>
+--EXPECT--
+int < float: float(9.223372036854776E+18)
+int < numeric string: float(9.223372036854776E+18)
+int <= float (false): float(-9.223372036854776E+18)