[pull] master from php:master - #1304
Merged
Merged
Conversation
dom_html_collection_named_item() seeded the iterator with basep->children, but the handlers disagreed on what that seed meant: the noop handler never moved it, the class name handler skipped the first child, and the children handler never advanced past a non-matching first element. The iterator now starts with a NULL candidate, and the children and tag name handlers start from basep->children when they see NULL. Close GH-23888
* PHP-8.5: Fix GH-23887: HTMLCollection::namedItem() mishandles the first child
* PHP-8.6: Fix GH-23887: HTMLCollection::namedItem() mishandles the first child
The call stack was sized as op_array->last / 2, on the assumption that every
call needs at least an INIT and a DO_FCALL opcode. That assumption does not
hold after the optimizer has removed the DO_FCALL opcodes as dead code, in
which case nothing pops the stack again:
```php
function test() {
new A(new B(new C(new D(match ([]) { 1 => 2 }))));
}
```
The match arm never matches, so everything behind the ZEND_MATCH_ERROR is
removed and the optimized op_array is just four ZEND_NEWs followed by the
ZEND_MATCH_ERROR. The buffer then holds two entries while four are pushed.
Size the stack by op_array->last instead, which is the only safe upper bound
once the pushes and pops are no longer guaranteed to be balanced.
Assisted-By: Claude <noreply@anthropic.com>
Closes GH-23454.
* PHP-8.6: zend_compile: Disable `array_map()` optimization for `strict_types=1` (#23889)
* PHP-8.4: Fix call_stack buffer overflow in zend_analyze_calls()
* PHP-8.5: Fix call_stack buffer overflow in zend_analyze_calls()
* PHP-8.6: Fix call_stack buffer overflow in zend_analyze_calls()
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )