[pull] master from php:master

NEWS

@@ -96,6 +96,12 @@ PHP                                                                        NEWS
   . Added grapheme_levenshtein() function. (Yuya Hamada)
   . Added Locale::addLikelySubtags/Locale::minimizeSubtags to handle
     adding/removing likely subtags to a locale. (David Carlier)
+  . Added IntlListFormatter class to format a list of items with a locale
+    , operands types and units. (BogdanUngureanu)
+
+- LDAP:
+  . Allow ldap_get_option to retrieve global option by allowing NULL for
+    connection instance ($ldap). (Remi)
 
 - MySQLi:
   . Fixed bugs GH-17900 and GH-8084 (calling mysqli::__construct twice).
@@ -105,9 +111,10 @@ PHP                                                                        NEWS
   . Added mysqlnd.collect_memory_statistics to ini quick reference.
     (hauk92)
 
-- OPcache:
+- Opcache:
   . Fixed ZTS OPcache build on Cygwin. (cmb)
   . Added opcache.file_cache_read_only. (Samuel Melrose)
+  . Updated default value of opcache.jit_hot_loop. (Arnaud)
 
 - Output:
   . Fixed calculation of aligned buffer size. (cmb)

UPGRADING

@@ -180,6 +180,12 @@ PHP 8.5 UPGRADE NOTES
     number formats.
   . Added Locale::addLikelySubtags and Locale::minimizeSubtags to
     handle likely tags on a given locale.
+  . Added IntlListFormatter class to format, order, punctuates 
+    a list of items with a given locale, IntlListFormatter::TYPE_AND,
+    IntlListFormatter::TYPE_OR, IntlListFormatter::TYPE_UNITS operands and 
+    IntlListFormatter::WIDTH_WIDE, IntlListFormatter::WIDTH_SHORT and
+    IntlListFormatter::WIDTH_NARROW widths.
+    It is supported from icu 67.
 
 - XSL:
   . The $namespace argument of XSLTProcessor::getParameter(),
@@ -233,6 +239,10 @@ PHP 8.5 UPGRADE NOTES
     have dropped the false from the return type union. Returning false
     was actually never possible.
 
+- LDAP:
+  . ldap_get_option() now accept a NULL connection, as ldap_set_option(),
+    to allow retrieval of global options.
+
 - libxml:
   . libxml_set_external_entity_loader() now has a formal return type of true.
 
@@ -450,6 +460,9 @@ PHP 8.5 UPGRADE NOTES
     Note: A cache generated with a different build of PHP, a different file
     path, or different settings (including which extensions are loaded), may be
     ignored.
+  . The default value of opcache.jit_hot_loop is now 61 (a prime) to prevent it
+    from being a multiple of loop iteration counts.
+    It is recommended that this parameter is set to a prime number.
 
 ========================================
 12. Windows Support
@@ -463,7 +476,7 @@ PHP 8.5 UPGRADE NOTES
   worked for in-tree builds); some extension builds (especially when using
   Makefile.frag.w32) may need adjustments.
 
-* --enable-sanitzer is now supported for MSVC builds.  This enables ASan and
+* --enable-sanitizer is now supported for MSVC builds.  This enables ASan and
   debug assertions, and is supported as of MSVC 16.10 and Windows 10.
 
 * The --with-uncritical-warn-choke configuration option for clang builds is
@@ -506,6 +519,8 @@ PHP 8.5 UPGRADE NOTES
 - Core:
   . Remove OPcodes for identity comparisons against booleans, particularly
     for the match(true) pattern.
+  . Add OPcode specialization for `=== []` and `!== []` comparisons.
+  . Creating exception objects is now much faster.
 
 - ReflectionProperty:
   . Improved performance of the following methods: getValue(), getRawValue(),

UPGRADING.INTERNALS

@@ -64,6 +64,8 @@ PHP 8.5 INTERNALS UPGRADE NOTES
 - ext/standard
   . Added php_url_decode_ex() and php_raw_url_decode_ex() that unlike their
     non-ex counterparts do not work in-place.
+  . The php_std_date() function has been removed. Use php_format_date() with
+    the "D, d M Y H:i:s \\G\\M\\T" format instead.
 
 ========================
 4. OpCode changes

Zend/Optimizer/zend_optimizer.c

@@ -1556,7 +1556,7 @@ void zend_foreach_op_array(zend_script *script, zend_op_array_func_t func, void
 			if (property->ce == ce && property->hooks) {
 				for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
 					zend_function *hook = hooks[i];
-					if (hook && hook->common.scope == ce) {
+					if (hook && hook->common.scope == ce && !(hooks[i]->op_array.fn_flags & ZEND_ACC_TRAIT_CLONE)) {
 						zend_foreach_op_array_helper(&hooks[i]->op_array, func, context);
 					}
 				}

Zend/tests/constants/oss_fuzz_416302790.phpt

@@ -0,0 +1,10 @@
+--TEST--
+OSS-Fuzz #416302790
+--FILE--
+<?php
+function x(){
+    #[Attr] const X = 1;
+}
+?>
+--EXPECTF--
+Parse error: syntax error, unexpected token "const" in %s on line %d

Zend/tests/gh18572.phpt

@@ -0,0 +1,39 @@
+--TEST--
+GH-18572: Nested object comparison leading to stack overflow
+--SKIPIF--
+<?php
+if (getenv('SKIP_ASAN')) die('skip as it fatally crash');
+?>
+--FILE--
+<?php
+
+#[AllowDynamicProperties]
+class Node {
+    public $next;
+    // forcing dynamic property creation is key
+}
+
+$first = new Node();
+$first->previous = $first;
+$first->next = $first;
+
+$cur = $first;
+
+for ($i = 0; $i < 50000; $i++) {
+    $new = new Node();
+    $new->previous = $cur;
+    $cur->next = $new;
+    $new->next = $first;
+    $first->previous = $new;
+    $cur = $new;
+}
+
+try {
+	// Force comparison manually to trigger zend_hash_compare
+	$first == $cur;
+} catch(Error $e) {
+	echo $e->getMessage(). PHP_EOL;
+}
+?>
+--EXPECTREGEX--
+(Maximum call stack size reached during object comparison|Nesting level too deep - recursive dependency\?)

Zend/tests/gh418106144.phpt

@@ -0,0 +1,20 @@
+--TEST--
+OSS-Fuzz #418106144
+--FILE--
+<?php
+
+class Foo {
+    function __toString(){}
+}
+function test($y=new Foo>''){
+    var_dump();
+}
+try {
+    test();
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Foo::__toString(): Return value must be of type string, none returned

Zend/tests/oss_fuzz_417078295.phpt

@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz #417078295
+--FILE--
+<?php
+
+function foo() {
+    $a = new stdClass();
+    static $a = $a;
+    debug_zval_dump($a);
+}
+
+foo();
+
+?>
+--EXPECT--
+object(stdClass)#1 (0) refcount(2){
+}

Zend/zend_ast.c

@@ -626,9 +626,10 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
 				/* op1 > op2 is the same as op2 < op1 */
 				binary_op_type op = ast->kind == ZEND_AST_GREATER
 					? is_smaller_function : is_smaller_or_equal_function;
-				ret = op(result, &op2, &op1);
+				op(result, &op2, &op1);
 				zval_ptr_dtor_nogc(&op1);
 				zval_ptr_dtor_nogc(&op2);
+				ret = EG(exception) ? FAILURE : SUCCESS;
 			}
 			break;
 		case ZEND_AST_UNARY_OP:

Zend/zend_exceptions.c

@@ -30,6 +30,14 @@
 #include "zend_exceptions_arginfo.h"
 #include "zend_observer.h"
 
+#define ZEND_EXCEPTION_MESSAGE_OFF 0
+#define ZEND_EXCEPTION_CODE_OFF 2
+#define ZEND_EXCEPTION_FILE_OFF 3
+#define ZEND_EXCEPTION_LINE_OFF 4
+#define ZEND_EXCEPTION_TRACE_OFF 5
+#define ZEND_EXCEPTION_PREVIOUS_OFF 6
+#define ZEND_EXCEPTION_SEVERITY_OFF 7
+
 ZEND_API zend_class_entry *zend_ce_throwable;
 ZEND_API zend_class_entry *zend_ce_exception;
 ZEND_API zend_class_entry *zend_ce_error_exception;
@@ -254,11 +262,33 @@ ZEND_API void zend_clear_exception(void) /* {{{ */
 }
 /* }}} */
 
+/* Same as writing to OBJ_PROP_NUM() when there are no hooks,
+ * but checks the offset is correct when Zend is built in debug mode.
+ * This is faster than going through the regular property write routine when the offset is known at compile time. */
+static void zend_update_property_num_checked(zend_object *object, uint32_t prop_num, zend_string *member, zval *value)
+{
+	if (UNEXPECTED(object->ce->num_hooked_props > 0)) {
+		/* Property may have been overridden with a hook. */
+		zend_update_property_ex(object->ce, object, member, value);
+		zval_ptr_dtor(value);
+		return;
+	}
+#if ZEND_DEBUG
+	zend_class_entry *old_scope = EG(fake_scope);
+	EG(fake_scope) = i_get_exception_base(object);
+	const zend_property_info *prop_info = zend_get_property_info(object->ce, member, true);
+	ZEND_ASSERT(OBJ_PROP_TO_NUM(prop_info->offset) == prop_num);
+	EG(fake_scope) = old_scope;
+#endif
+	zval *zv = OBJ_PROP_NUM(object, prop_num);
+	zval_ptr_safe_dtor(zv);
+	ZVAL_COPY_VALUE(zv, value);
+}
+
 static zend_object *zend_default_exception_new(zend_class_entry *class_type) /* {{{ */
 {
 	zval tmp;
 	zval trace;
-	zend_class_entry *base_ce;
 	zend_string *filename;
 
 	zend_object *object = zend_objects_new(class_type);
@@ -269,26 +299,23 @@ static zend_object *zend_default_exception_new(zend_class_entry *class_type) /*
 			0,
 			EG(exception_ignore_args) ? DEBUG_BACKTRACE_IGNORE_ARGS : 0, 0);
 	} else {
-		array_init(&trace);
+		ZVAL_EMPTY_ARRAY(&trace);
 	}
-	Z_SET_REFCOUNT(trace, 0);
 
-	base_ce = i_get_exception_base(object);
+	zend_update_property_num_checked(object, ZEND_EXCEPTION_TRACE_OFF, ZSTR_KNOWN(ZEND_STR_TRACE), &trace);
 
 	if (EXPECTED((class_type != zend_ce_parse_error && class_type != zend_ce_compile_error)
 			|| !(filename = zend_get_compiled_filename()))) {
 		ZVAL_STRING(&tmp, zend_get_executed_filename());
-		zend_update_property_ex(base_ce, object, ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
-		zval_ptr_dtor(&tmp);
+		zend_update_property_num_checked(object, ZEND_EXCEPTION_FILE_OFF, ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
 		ZVAL_LONG(&tmp, zend_get_executed_lineno());
-		zend_update_property_ex(base_ce, object, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
+		zend_update_property_num_checked(object, ZEND_EXCEPTION_LINE_OFF, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
 	} else {
-		ZVAL_STR(&tmp, filename);
-		zend_update_property_ex(base_ce, object, ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
+		ZVAL_STR_COPY(&tmp, filename);
+		zend_update_property_num_checked(object, ZEND_EXCEPTION_FILE_OFF, ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
 		ZVAL_LONG(&tmp, zend_get_compiled_lineno());
-		zend_update_property_ex(base_ce, object, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
+		zend_update_property_num_checked(object, ZEND_EXCEPTION_LINE_OFF, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
 	}
-	zend_update_property_ex(base_ce, object, ZSTR_KNOWN(ZEND_STR_TRACE), &trace);
 
 	return object;
 }
@@ -308,27 +335,26 @@ ZEND_METHOD(Exception, __construct)
 	zend_string *message = NULL;
 	zend_long   code = 0;
 	zval  tmp, *object, *previous = NULL;
-	zend_class_entry *base_ce;
 
 	object = ZEND_THIS;
-	base_ce = i_get_exception_base(Z_OBJ_P(object));
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|SlO!", &message, &code, &previous, zend_ce_throwable) == FAILURE) {
 		RETURN_THROWS();
 	}
 
 	if (message) {
-		ZVAL_STR(&tmp, message);
-		zend_update_property_ex(base_ce, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_MESSAGE), &tmp);
+		ZVAL_STR_COPY(&tmp, message);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_MESSAGE_OFF, ZSTR_KNOWN(ZEND_STR_MESSAGE), &tmp);
 	}
 
 	if (code) {
 		ZVAL_LONG(&tmp, code);
-		zend_update_property_ex(base_ce, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_CODE), &tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_CODE_OFF, ZSTR_KNOWN(ZEND_STR_CODE), &tmp);
 	}
 
 	if (previous) {
-		zend_update_property_ex(base_ce, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_PREVIOUS), previous);
+		Z_ADDREF_P(previous);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_PREVIOUS_OFF, ZSTR_KNOWN(ZEND_STR_PREVIOUS), previous);
 	}
 }
 /* }}} */
@@ -368,34 +394,33 @@ ZEND_METHOD(ErrorException, __construct)
 
 	if (message) {
 		ZVAL_STR_COPY(&tmp, message);
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_MESSAGE), &tmp);
-		zval_ptr_dtor(&tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_MESSAGE_OFF, ZSTR_KNOWN(ZEND_STR_MESSAGE), &tmp);
 	}
 
 	if (code) {
 		ZVAL_LONG(&tmp, code);
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_CODE), &tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_CODE_OFF, ZSTR_KNOWN(ZEND_STR_CODE), &tmp);
 	}
 
 	if (previous) {
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_PREVIOUS), previous);
+		Z_ADDREF_P(previous);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_PREVIOUS_OFF, ZSTR_KNOWN(ZEND_STR_PREVIOUS), previous);
 	}
 
 	ZVAL_LONG(&tmp, severity);
-	zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_SEVERITY), &tmp);
+	zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_SEVERITY_OFF, ZSTR_KNOWN(ZEND_STR_SEVERITY), &tmp);
 
 	if (filename) {
 		ZVAL_STR_COPY(&tmp, filename);
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
-		zval_ptr_dtor(&tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_FILE_OFF, ZSTR_KNOWN(ZEND_STR_FILE), &tmp);
 	}
 
 	if (!lineno_is_null) {
 		ZVAL_LONG(&tmp, lineno);
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_LINE_OFF, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
 	} else if (filename) {
 		ZVAL_LONG(&tmp, 0);
-		zend_update_property_ex(zend_ce_exception, Z_OBJ_P(object), ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
+		zend_update_property_num_checked(Z_OBJ_P(object), ZEND_EXCEPTION_LINE_OFF, ZSTR_KNOWN(ZEND_STR_LINE), &tmp);
 	}
 }
 /* }}} */

Zend/zend_inheritance.c

@@ -2983,7 +2983,7 @@ static void zend_do_traits_property_binding(zend_class_entry *ce, zend_class_ent
 						hooks[j] = new_fn;
 					}
 				}
-				ce->ce_flags |= ZEND_ACC_USE_GUARDS;
+				ce->num_hooked_props++;
 			}
 		} ZEND_HASH_FOREACH_END();
 	}

Zend/zend_language_parser.y

@@ -279,7 +279,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %type <ast> isset_variable type return_type type_expr type_without_static
 %type <ast> identifier type_expr_without_static union_type_without_static_element union_type_without_static intersection_type_without_static
 %type <ast> inline_function union_type_element union_type intersection_type
-%type <ast> attributed_statement attributed_class_statement attributed_parameter
+%type <ast> attributed_statement attributed_top_statement attributed_class_statement attributed_parameter
 %type <ast> attribute_decl attribute attributes attribute_group namespace_declaration_name
 %type <ast> match match_arm_list non_empty_match_arm_list match_arm match_arm_cond_list
 %type <ast> enum_declaration_statement enum_backing_type enum_case enum_case_expr
@@ -391,13 +391,17 @@ attributed_statement:
 	|	trait_declaration_statement			{ $$ = $1; }
 	|	interface_declaration_statement		{ $$ = $1; }
 	|	enum_declaration_statement			{ $$ = $1; }
+;
+
+attributed_top_statement:
+		attributed_statement				{ $$ = $1; }
 	|	T_CONST const_list ';'				{ $$ = $2; }
 ;
 
 top_statement:
 		statement							{ $$ = $1; }
-	|	attributed_statement					{ $$ = $1; }
-	|	attributes attributed_statement		{ $$ = zend_ast_with_attributes($2, $1); }
+	|	attributed_top_statement			{ $$ = $1; }
+	|	attributes attributed_top_statement	{ $$ = zend_ast_with_attributes($2, $1); }
 	|	T_HALT_COMPILER '(' ')' ';'
 			{ $$ = zend_ast_create(ZEND_AST_HALT_COMPILER,
 			      zend_ast_create_zval_from_long(zend_get_scanned_file_offset()));