Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  Fix JIT SWITCH_STRING type checks on referenced operand

Author: jorgsowa

NEWS

@@ -70,6 +70,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT
     buffer accounting). (ndossche)
   . Call orig_post_shutdown_cb(). (ndossche)
+  . Fixed JIT segfault on switch over a string reference holding a
+    non-string value. (jorgsowa)
 
 - OpenSSL:
   . Fixed build with OpenSSL 4.1. (Weilin Du)

ext/opcache/jit/zend_jit_ir.c

@@ -16569,7 +16569,7 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 					if (fallback_label) {
 						jit_guard_Z_TYPE(jit, op1_addr, IS_REFERENCE, fallback_label);
 					} else {
-						ir_ref if_ref = jit_if_Z_TYPE(jit, op1_addr, IS_STRING);
+						ir_ref if_ref = jit_if_Z_TYPE(jit, op1_addr, IS_REFERENCE);
 						ir_IF_FALSE_cold(if_ref);
 						ir_refs_add(slow_inputs, ir_END());
 						ir_IF_TRUE(if_ref);
@@ -16579,7 +16579,7 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 					op1_addr = ZEND_ADDR_REF_ZVAL(ref2);
 
 					if (fallback_label) {
-						jit_guard_Z_TYPE(jit, op1_addr, IS_LONG, fallback_label);
+						jit_guard_Z_TYPE(jit, op1_addr, IS_STRING, fallback_label);
 					} else {
 						if_string = jit_if_Z_TYPE(jit, op1_addr, IS_STRING);
 						ir_IF_FALSE_cold(if_string);

ext/opcache/tests/jit/switch_002.phpt

@@ -0,0 +1,27 @@
+--TEST--
+JIT SWITCH_STRING on a reference holding a non-string value
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_hot_loop=1
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test($a) {
+    $n = 0;
+    foreach ($a as &$x) {
+        switch ($x) {
+            case "a": case "b": $n++; break;
+        }
+    }
+    return $n;
+}
+var_dump(test(["a"]));
+var_dump(test([1]));
+?>
+--EXPECT--
+int(1)
+int(0)

ext/opcache/tests/jit/switch_003.phpt

@@ -0,0 +1,26 @@
+--TEST--
+JIT SWITCH_STRING on a reference (function JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=function
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test($a) {
+    $n = 0;
+    foreach ($a as &$x) {
+        switch ($x) {
+            case "a": case "b": $n++; break;
+        }
+    }
+    return $n;
+}
+var_dump(test(["a", "b", "c"]));
+var_dump(test([1]));
+?>
+--EXPECT--
+int(2)
+int(0)