Commit 38e0aca422c for php.net

commit 38e0aca422c28e756d74e53215b7bd9139598e42
Author: David Carlier <devnexen@gmail.com>
Date:   Mon May 18 12:14:43 2026 +0100

    Fix GH-22071: JIT assertion on abstract static method call.

    The optimizer's ZEND_INIT_STATIC_METHOD_CALL handling returned the
    function entry even when the resolved method was abstract, leading
    the JIT to assert on a null address in jit_CONST_FUNC_PROTO when
    emitting a direct call (e.g. UnitEnum::cases()).

    close GH-22082

diff --git a/NEWS b/NEWS
index ace3e868e65..c4682385ac1 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,10 @@ PHP                                                                        NEWS
 - CLI:
   . Fixed bug GH-21901 (Stale getopt() optional value). (onthebed)

+- Core:
+  . Fixed bug GH-22071 (JIT assertion on abstract static method call).
+    (David Carlier)
+
 - Date:
   . Fixed bug GH-18422 (int overflow in php_date_llabs). (iliaal)

diff --git a/Zend/Optimizer/zend_optimizer.c b/Zend/Optimizer/zend_optimizer.c
index d3a43617e92..b5de6633146 100644
--- a/Zend/Optimizer/zend_optimizer.c
+++ b/Zend/Optimizer/zend_optimizer.c
@@ -945,7 +945,7 @@ zend_function *zend_optimizer_get_called_func(
 				if (ce) {
 					zend_string *func_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
 					zend_function *fbc = zend_hash_find_ptr(&ce->function_table, func_name);
-					if (fbc) {
+					if (fbc && !(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
 						bool is_public = (fbc->common.fn_flags & ZEND_ACC_PUBLIC) != 0;
 						bool same_scope = fbc->common.scope == op_array->scope;
 						if (is_public || same_scope) {
diff --git a/ext/opcache/tests/gh22071.phpt b/ext/opcache/tests/gh22071.phpt
new file mode 100644
index 00000000000..148ca461be2
--- /dev/null
+++ b/ext/opcache/tests/gh22071.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-22071: Assertion failure jit_CONST_FUNC_PROTO on abstract static method call
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1205
+opcache.jit_buffer_size=16M
+--FILE--
+<?php
+try {
+    $e = enum_exists('UnitEnum') ? UnitEnum::cases() : [];
+} catch (\Throwable $_e) {}
+echo "ok\n";
+?>
+--EXPECT--
+ok