Commit ceb4934ba36 for php.net

commit ceb4934ba36a106e20c0e984a834ebace7fa7d7b
Author: Tim Düsterhus <tim@bastelstu.be>
Date:   Sun Jun 14 11:40:08 2026 +0200

    zend_operators: Remove `zend_binary_zval_str(n)cmp()` (#22298)

diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS
index 43a81c87d4b..f89123116c7 100644
--- a/UPGRADING.INTERNALS
+++ b/UPGRADING.INTERNALS
@@ -103,6 +103,10 @@ PHP 8.6 INTERNALS UPGRADE NOTES
   . The deprecated Z_IMMUTABLE(), Z_IMMUTABLE_P(), Z_OPT_IMMUTABLE(), and
     Z_OPT_IMMUTABLE_P() macros have been removed. Check for
     IS_ARRAY && !REFCOUNTED directly.
+  . The zend_binary_zval_strcmp() and zend_binary_zval_strncmp() functions
+    have been removed, because they are unsafe by relying on the zvals
+    having a specific type. Use zend_binary_strcmp() / zend_binary_strncmp(),
+    string_compare_function() or similar instead.
   . Added zend_fcall_info.consumed_args together with
     zend_fci_consumed_arg(), which allows moving a selected callback argument
     instead of copying it in zend_call_function(). Currently only a single
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index a43fdcc9a48..ab8f2c2b54f 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -3354,18 +3354,6 @@ ZEND_API int ZEND_FASTCALL zend_binary_strncasecmp_l(const char *s1, size_t len1
 }
 /* }}} */

-ZEND_API int ZEND_FASTCALL zend_binary_zval_strcmp(const zval *s1, const zval *s2) /* {{{ */
-{
-	return zend_binary_strcmp(Z_STRVAL_P(s1), Z_STRLEN_P(s1), Z_STRVAL_P(s2), Z_STRLEN_P(s2));
-}
-/* }}} */
-
-ZEND_API int ZEND_FASTCALL zend_binary_zval_strncmp(const zval *s1, const zval *s2, const zval *s3) /* {{{ */
-{
-	return zend_binary_strncmp(Z_STRVAL_P(s1), Z_STRLEN_P(s1), Z_STRVAL_P(s2), Z_STRLEN_P(s2), Z_LVAL_P(s3));
-}
-/* }}} */
-
 ZEND_API bool ZEND_FASTCALL zendi_smart_streq(const zend_string *s1, const zend_string *s2) /* {{{ */
 {
 	uint8_t ret1, ret2;
diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index 2dc6dbfbfc6..b6e1923b3bf 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -487,8 +487,6 @@ static zend_always_inline zend_string* zend_string_toupper(zend_string *str) {
 	return zend_string_toupper_ex(str, false);
 }

-ZEND_API int ZEND_FASTCALL zend_binary_zval_strcmp(const zval *s1, const zval *s2);
-ZEND_API int ZEND_FASTCALL zend_binary_zval_strncmp(const zval *s1, const zval *s2, const zval *s3);
 ZEND_API int ZEND_FASTCALL zend_binary_strcmp(const char *s1, size_t len1, const char *s2, size_t len2);
 ZEND_API int ZEND_FASTCALL zend_binary_strncmp(const char *s1, size_t len1, const char *s2, size_t len2, size_t length);
 ZEND_API int ZEND_FASTCALL zend_binary_strcasecmp(const char *s1, size_t len1, const char *s2, size_t len2);