Commit b1a3a4e082d for php

commit b1a3a4e082d629e41746c43c00a8cb31b85df500
Merge: d8d55b75c5d 9c160f20135
Author: Gina Peter Banyard <girgias@php.net>
Date:   Wed Oct 14 18:39:12 2026 +0100

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Update NEWS
      ext/standard/tests: work around Windows quoting with tempfiles.
      .github/scripts/windows: pass an extension_dir to the test runner.
      {ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
      ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
      sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
      std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
      Fiber: hold the object a callable resolved to in the creating frame (#24134)

diff --cc .github/scripts/windows/test_task.bat
index 77b0059fccf,df4570d3214..186c40ed09a
--- a/.github/scripts/windows/test_task.bat
+++ b/.github/scripts/windows/test_task.bat
@@@ -90,7 -90,12 +90,10 @@@ set OPENSSL_CONF
  rem set SSLEAY_CONF=

  rem prepare for OPcache
- if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.protect_memory=1 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing
+ set PHP_BUILD_DIR=%PHP_BUILD_OBJ_DIR%\Release
+ if "%THREAD_SAFE%" equ "1" set PHP_BUILD_DIR=%PHP_BUILD_DIR%_TS
+
 -if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.protect_memory=1 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing
 -rem work-around for failing to dl(mysqli) with OPcache (https://github.com/php/php-src/issues/8508)
 -if "%OPCACHE%" equ "1" set OPCACHE_OPTS=%OPCACHE_OPTS% -d extension=mysqli -d extension_dir=%PHP_BUILD_DIR%
++if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.protect_memory=1 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing -d extension_dir=%PHP_BUILD_DIR%

  rem prepare for enchant
  mkdir %~d0\usr\local\lib\enchant-2
diff --cc NEWS
index 07e265d2193,4be7ba3fdb1..0bf79ac70b0
--- a/NEWS
+++ b/NEWS
@@@ -21,10 -19,14 +21,12 @@@ PH
    . Fixed skipped catch block when switching fibers during exception unwinding
      (Nicolas Grekas)
    . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
+   . Fix UAF for resolved callable zval. (EdmondDantes)
+   . Fix memory leak for nested HTTP calls. (EdmondDantes)

 -- DOM:
 -  . Fixed bug GH-23352 (UAF reading an attribute value node retained across
 -    DOMDocument::adoptNode()). (David Carlier)
 -  . Fixed bug GH-24260 (querySelectorAll() returns duplicate elements for
 -    selector lists). (fivefilters)
 +- Fileinfo:
 +  . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
 +    an invalid $filename). (Lazizbek Ergashev)

  - FPM:
    . Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is
diff --cc sapi/cli/tests/016.phpt
index 0ba9027f216,3c0aa56e44a..e209951cc44
--- a/sapi/cli/tests/016.phpt
+++ b/sapi/cli/tests/016.phpt
@@@ -56,7 -57,7 +57,7 @@@ EOT
  foreach ($codes as $key => $code) {
      echo "\n--------------\nSnippet no. $key:\n--------------\n";
      $code = escapeshellarg($code);
-     echo shell_exec("echo $code | $php -a"), "\n";
 -    echo `echo $code | $php $args -a`, "\n";
++    echo shell_exec("echo $code | $php $args -a"), "\n";
  }

  echo "\nDone\n";