Commit b015e2ae499 for php

commit b015e2ae4994eccc99802f806b1c2da0183f3b2c
Merge: f3db5d60f39 1b6ccd5b587
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Sep 27 12:50:39 2026 -0400

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      ext/ffi: Hold a reference to the callable of an FFI callback

diff --cc NEWS
index 24cbe0a83a5,63ca854c759..631267d5647
--- a/NEWS
+++ b/NEWS
@@@ -1,50 -1,16 +1,54 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.12
 +?? ??? ????, PHP 8.6.0RC3

  - Core:
 -  . Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
 -    unfolded, crashing the VM in zval_undefined_cv). (ndossche)
 -  . Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
 -  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
 -  . Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
 -    comparison. (Arnaud)
    . Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
      (ndossche)
 +  . Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy
 +    proxy objects instead of forwarding to the real instance). (lisachenko)
 +  . Fixed bug GH-23882 (array_map() optimization is incorrect for
 +    strict_types=1). (timwolla)
 +  . Fixed OSS-Fuzz #565486253 (coerced arg with '...' on non-variadic
 +    function). (ndossche)
 +
++- FFI:
++  . Fixed crashes with FFI callbacks created from __call() trampolines
++    and array callables whose object is released. (Ilia Alshanetsky)
++
 +- Opcache:
 +  . Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)
 +  . Fixed bug GH-23679 (Tracing JIT writes a parent private property into a
 +    child's shadowing public property). (Ilia Alshanetsky)
 +
 +- PCNTL:
 +  . Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while
 +    an exception is pending. (nicolas-grekas)
 +  . Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler
 +    that throws. (nicolas-grekas)
 +
 +- PDO_PGSQL:
 +  . Fixed crash when a persistent connection fails. (KentarouTakeda)
 +
 +- Zip:
 +  . Fixed bug GH-23899 (Assertion failure when a cancel callback returns an
 +    invalid type during shutdown). (Weilin Du)
 +
 +24 Sep 2026, PHP 8.6.0RC2
 +
 +- Core:
 +  . Fixed incorrect internal pointer and foreach iterator positions when
 +    compacting arrays with holes. (Weilin Du)
 +  . Fix handling of references to typed properties during unserialization
 +    of various internal classes. (ndossche, timwolla)
 +  . Fixed OSS-Fuzz 532353396 (assertion	failure	with static type). (Girgias)
 +  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
 +  . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
 +    register declarations so the caller's -Wvolatile-register-var state is
 +    restored). (yqtian-se)
 +  . Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
 +    closure invoke). (ndossche)
 +  . Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)

  - CLI
    . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
diff --cc ext/ffi/ffi.c
index 518a9d9c47f,5ff2c9a1227..691af066d5b
--- a/ext/ffi/ffi.c
+++ b/ext/ffi/ffi.c
@@@ -953,8 -949,7 +945,8 @@@ static void zend_ffi_callback_trampolin

  		ZEND_HASH_PACKED_FOREACH_PTR(callback_data->type->func.args, arg_type) {
  			arg_type = ZEND_FFI_TYPE(arg_type);
- 			zend_ffi_cdata_to_zval(NULL, args[n], arg_type, BP_VAR_R, &fci.params[n], (zend_ffi_flags)(arg_type->attr & ZEND_FFI_ATTR_CONST),
 -			zend_ffi_cdata_to_zval(NULL, args[n], arg_type, BP_VAR_R, &params[n], (zend_ffi_flags)(arg_type->attr & ZEND_FFI_ATTR_CONST), 0, 0);
++			zend_ffi_cdata_to_zval(NULL, args[n], arg_type, BP_VAR_R, &params[n], (zend_ffi_flags)(arg_type->attr & ZEND_FFI_ATTR_CONST),
 +					       false, false);
  			n++;
  		} ZEND_HASH_FOREACH_END();
  	}