Commit 0fcc9cd9783 for php

commit 0fcc9cd978316cfd0533e8ee2da9e3ce4de1be4b
Merge: 1c92d577570 5266eaa998f
Author: Weilin Du <weilindu@php.net>
Date:   Fri Oct 30 00:58:11 2026 +0800

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Merge branch 'PHP-8.4' into PHP-8.5

diff --cc NEWS
index e41fb4e5c69,186d729a28a..edc5baa549b
--- a/NEWS
+++ b/NEWS
@@@ -1,16 -1,34 +1,18 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.13
 +?? ??? ????, PHP 8.6.0RC5

  - Core:
 -  . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
 -    graceful restart, potentially causing incompatible OPcache file cache
 -    entries to be reused). (Levi Morrison)
 -  . Fixed memory leak when an exception already contains the pending exception
 -    in its previous chain. (Edmond)
 -  . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
 -    enclosing function). (ndossche)
 -  . Fixed memory manager keeping a block reallocated to exactly the size of
 -    the next smaller bin in its larger bin, which efree_size() then freed
 -    into the wrong one. (Marc Bennewitz)
 -  . Fixed bug GH-24081 (User opcode handlers resume execution against a stale
 -    frame under ZEND_VM_KIND_TAILCALL). (devnexen)
 -  . Fixed bug GH-24218 (Invalid opcode for count() of a literal array
 -    without SCCP). (lazerg)
 -  . Fix throwing behaviour with recursive arrays in VM. (ndossche)
 -  . Fixed skipped catch block when switching fibers during exception unwinding
 -    (Nicolas Grekas)
 -  . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
 -  . Fix UAF for resolved callable zval. (EdmondDantes)
 -  . Fix memory leak for nested HTTP calls. (EdmondDantes)
    . Fix function and constant imports in compile_to_ast and add support
      for grouping. (Klaas Skelte van der Werf)
+   . Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an
+     existing CV). (yasu20200121web-prog, lazerg)
    . Fixed unmapping of an unrelated range when the aligned chunk mmap fails
      (Marti2203).
 +  . Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).
 +    (lazerg)
 +  . Fixed bug GH-25007 (Partial function application: named args in a constant
 +    expression cause out-of-bounds write in zp_compile()). (lazerg)

  - CLI:
    . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).
diff --cc ext/zend_test/test.c
index 0658f6a3cf4,4396f8f22f0..c1ede5c6043
--- a/ext/zend_test/test.c
+++ b/ext/zend_test/test.c
@@@ -1834,27 -1232,30 +1834,45 @@@ static ZEND_FUNCTION(zend_new_singleton
  	array_init_singleton(return_value);
  }

+ static ZEND_FUNCTION(zend_test_set_local_var)
+ {
+ 	zend_string *name;
+ 	zval *value;
+
+ 	ZEND_PARSE_PARAMETERS_START(2, 2)
+ 		Z_PARAM_STR(name)
+ 		Z_PARAM_ZVAL(value)
+ 	ZEND_PARSE_PARAMETERS_END();
+
+ 	Z_TRY_ADDREF_P(value);
+ 	if (zend_set_local_var(name, value, false) == FAILURE) {
+ 		zval_ptr_dtor(value);
+ 		RETURN_FALSE;
+ 	}
+ 	RETURN_TRUE;
+ }
+
  static zend_object *zend_test_class_new(zend_class_entry *class_type)
  {
 -	zend_object *obj = zend_objects_new(class_type);
 -	object_properties_init(obj, class_type);
 -	obj->handlers = &zend_test_class_handlers;
 -	return obj;
 +	zend_test_object *intern = zend_object_alloc(sizeof(zend_test_object), class_type);
 +	zend_object_std_init(&intern->std, class_type);
 +	object_properties_init(&intern->std, class_type);
 +	return &intern->std;
 +}
 +
 +static void zend_test_class_free_obj(zend_object *object)
 +{
 +	zend_test_object *intern = ZEND_CONTAINER_OF(object, zend_test_object, std);
 +
 +	if (intern->tmp_method) {
 +		zend_internal_function *func = intern->tmp_method;
 +		intern->tmp_method = NULL;
 +		zend_string_release_ex(func->function_name, 0);
 +		zend_free_internal_arg_info(func, false);
 +		efree(func);
 +	}
 +
 +	zend_object_std_dtor(object);
  }

  static zend_function *zend_test_class_method_get(zend_object **object, zend_string *name, const zval *key)
diff --cc ext/zend_test/test_arginfo.h
index 87622c185cf,d35ae490d8d..184bcdbae14
Binary files differ
diff --cc ext/zend_test/test_decl.h
index db7652512c8,00000000000..cab05e40a40
mode 100644,000000..100644
Binary files differ
diff --cc ext/zend_test/test_legacy_arginfo.h
index a673b373142,00000000000..d58dc5d2622
mode 100644,000000..100644
Binary files differ