Commit cde751d1b0c for php

commit cde751d1b0c9a7910eab01516ed1823fc8326536
Author: David Carlier <devnexen@gmail.com>
Date:   Thu Nov 12 13:18:21 2026 +0000

    Fix GH-25359: tracing JIT drops reference type of a named by-ref argument

    zend_jit_trace_build_tssa() narrowed SEND_VAR_EX op1_def to the by-value
    type using op2.num, which is the name literal for a named argument. The
    callee looked by-value, so the CV lost MAY_BE_REF and the ref leaked or
    was returned unwrapped. Skip the narrowing for named arguments.

    Close GH-25377

diff --git a/NEWS b/NEWS
index f8f42260fd1..b5dbe65a83c 100644
--- a/NEWS
+++ b/NEWS
@@ -73,6 +73,8 @@ PHP                                                                        NEWS
     isset()/empty(). (Jorg Sowa)
   . Fixed tracing JIT reading the int result of ++/-- on a reference as a
     double. (ChrisAbner)
+  . Fixed bug GH-25359 (Tracing JIT drops reference type of a named by-ref
+    argument). (David Carlier)

 - PDO_Firebird:
   . Fixed stack buffer overflow with long connection user names, passwords,
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index 2b9852aa614..5f4bd908a5f 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -2357,6 +2357,7 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 				/* Add statically inferred restrictions */
 				if (ssa_ops[idx].op1_def >= 0) {
 					if (opline->opcode == ZEND_SEND_VAR_EX
+					 && opline->op2_type != IS_CONST
 					 && frame
 					 && frame->call
 					 && frame->call->func
diff --git a/ext/opcache/tests/jit/gh25359.phpt b/ext/opcache/tests/jit/gh25359.phpt
new file mode 100644
index 00000000000..b9c011cea57
--- /dev/null
+++ b/ext/opcache/tests/jit/gh25359.phpt
@@ -0,0 +1,27 @@
+--TEST--
+GH-25359 (Tracing JIT drops reference type of CV passed as a named by-ref argument)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+opcache.jit_hot_func=1
+--FILE--
+<?php
+namespace Test;
+function f(&$a = null, &$b = null) { $b++; }
+function g(int $s) {
+	f(b: $s);
+	return $s + 1;
+}
+for ($i = 0; $i < 5; $i++) {
+	var_dump(g(41));
+}
+?>
+--EXPECT--
+int(43)
+int(43)
+int(43)
+int(43)
+int(43)