Commit 06be15d22e4 for php

commit 06be15d22e4b2eaa5ec46937dd08cfe5540627c2
Author: lazerg <lazerg2@gmail.com>
Date:   Fri Oct 9 20:51:45 2026 +0500

    Fix GH-24218: Invalid opcode for count() of a literal array without SCCP

    Closes GH-24219.

diff --git a/NEWS b/NEWS
index 8dc808543b7..5c01150cabe 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,8 @@ PHP                                                                        NEWS
   . Fixed memory manager keeping a block reallocated to exactly the size of
     the next smaller bin in its larger bin, which efree_size() then freed
     into the wrong one. (Marc Bennewitz)
+  . Fixed bug GH-24218 (Invalid opcode for count() of a literal array
+    without SCCP). (lazerg)

 - DOM:
   . Fixed bug GH-23352 (UAF reading an attribute value node retained across
@@ -27,6 +29,8 @@ PHP                                                                        NEWS
   . Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)
   . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
   . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
+  . Fixed bug GH-24218 (Invalid opcode for count() of a literal array when
+    SCCP is disabled). (Lazizbek Ergashev)

 - SOAP:
   . Fixed use of uninitialized func in do_request() on OOM bailout.
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 566c9b4c456..b0bda46f8c6 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -9451,7 +9451,7 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED)
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

-ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED)
+ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, op->op1_type != IS_CONST && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED)
 {
 	USE_OPLINE
 	zend_array *ht = Z_ARRVAL_P(GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R));
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 2ebbfaa9c05..44def91de74 100644
Binary files a/Zend/zend_vm_execute.h and b/Zend/zend_vm_execute.h differ
diff --git a/ext/opcache/tests/gh24218.phpt b/ext/opcache/tests/gh24218.phpt
new file mode 100644
index 00000000000..0e5721376be
--- /dev/null
+++ b/ext/opcache/tests/gh24218.phpt
@@ -0,0 +1,17 @@
+--TEST--
+GH-24218 (Invalid opcode for count() of a literal array when SCCP is disabled)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable_cli=1
+opcache.optimization_level=0x60
+--FILE--
+<?php
+
+var_dump(count([1]));
+var_dump(count([1, 2, 3]));
+
+?>
+--EXPECT--
+int(1)
+int(3)