Commit dfec9f2490f for php

commit dfec9f2490f5d02cf133d1889ab6c99339e6c21b
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Wed Nov 4 21:41:28 2026 +0100

    IR: Backport fix for SIGFPE when folding MUL_OV of -1 by INT64_MIN

    Cherry-picks https://github.com/dstogov/ir/commit/c091c0864f7d427b24440c210cc2390aed923a51

diff --git a/NEWS b/NEWS
index ee8ab9f3529..026237984b4 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@ PHP                                                                        NEWS
     deeply nested arrays. (Eyüp Can Akman)

 - Opcache:
+  . Fixed bug GH-24801 (JIT: SIGFPE in ir_fold MUL_OV constant folding).
+    (waroad)
   . Fixed bug GH-25165 (Tracing JIT loops forever once opcache.jit_buffer_size
     is exhausted while compiling side traces). (Ilia Alshanetsky)
   . Fixed bug GH-25164 (Function JIT loop calling a user function runs once
diff --git a/ext/opcache/jit/ir/ir_fold.h b/ext/opcache/jit/ir/ir_fold.h
index a50b2ebdc0c..8b8530956f2 100644
--- a/ext/opcache/jit/ir/ir_fold.h
+++ b/ext/opcache/jit/ir/ir_fold.h
@@ -891,7 +891,8 @@ IR_FOLD(MUL_OV(C_I64, C_I64))
 	int64_t res;
 	IR_ASSERT(IR_OPT_TYPE(opt) == op1_insn->type);
 	res = op1_insn->val.u64 * op2_insn->val.u64;
-	if ((op1_insn->val.i64 != 0 && res / op1_insn->val.i64 != op2_insn->val.i64) || res < min || res > max) {
+	if ((op1_insn->val.i64 == -1 && res == INT64_MIN)
+	 || (op1_insn->val.i64 != 0 && res / op1_insn->val.i64 != op2_insn->val.i64) || res < min || res > max) {
 		IR_FOLD_NEXT;
 	}
 	IR_FOLD_CONST_U(res);