turkdevops · pull · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
diff --git a/Zend/tests/arginfo_zpp_mismatch.inc b/Zend/tests/arginfo_zpp_mismatch.inc
@@ -19,6 +19,7 @@ function skipFunction($function): bool {
      || (is_string($function) && str_starts_with($function, 'ob_'))
      || $function === 'output_add_rewrite_var'
      || $function === 'error_log'
+     || $function === 'syslog'
         /* may spend a lot of time waiting for connection timeouts */
      || (is_string($function) && str_contains($function, 'connect'))
      || (is_string($function) && str_starts_with($function, 'snmp'))

diff --git a/Zend/tests/property_hooks/simple_get_result_type_inference_verification.phpt b/Zend/tests/property_hooks/simple_get_result_type_inference_verification.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Result type inference verification for simple get is skipped
+--FILE--
+<?php
+
+class Foo {
+    private array $backing = [];
+
+    public array $prop {
+        get => $this->backing;
+    }
+
+    public function test(): void {
+        $prop = $this->prop;
+    }
+}
+
+$foo = new Foo;
+$foo->test();
+$foo->test();
+echo "Done\n";
+
+?>
+--EXPECT--
+Done
diff --git a/Zend/zend_verify_type_inference.h b/Zend/zend_verify_type_inference.h
@@ -186,7 +186,8 @@ static void zend_verify_inference_def(zend_execute_data *execute_data, const zen
 	 && opline->opcode != ZEND_DO_FCALL_BY_NAME
 	 /* ZEND_FE_FETCH_R[W] does not define a result in the last iteration. */
 	 && opline->opcode != ZEND_FE_FETCH_R
-	 && opline->opcode != ZEND_FE_FETCH_RW) {
+	 && opline->opcode != ZEND_FE_FETCH_RW
+	 && (opline->opcode != ZEND_FETCH_OBJ_R || EG(current_execute_data) == execute_data)) {
 		zend_verify_type_inference(EX_VAR(opline->result.var), opline->result_def_type, opline->result_type, execute_data, opline, "result_def");
 
 		/* Verify return value in the context of caller. */

diff --git a/ext/intl/config.w32 b/ext/intl/config.w32
@@ -9,7 +9,7 @@ if (PHP_INTL != "no") {
 					CHECK_HEADER("unicode/utf.h", "CFLAGS_INTL")) {
 		// always build as shared - zend_strtod.c/ICU type conflict
 		EXTENSION("intl", "php_intl.c intl_convert.c intl_icu_compat.c intl_convertcpp.cpp intl_error.c ", true,
-								"/I \"" + configure_module_dirname + "\" /DZEND_ENABLE_STATIC_TSRMLS_CACHE=1");
+								"/I \"" + configure_module_dirname + "\" /DZEND_ENABLE_STATIC_TSRMLS_CACHE=1", null, undefined, true);
 		ADD_EXTENSION_DEP('intl', 'date');
 		ADD_SOURCES(configure_module_dirname + "/collator", "\
 				collator_attr.cpp \

diff --git a/ext/mbstring/tests/mb_ereg_replace_kname_unterminated_nul.phpt b/ext/mbstring/tests/mb_ereg_replace_kname_unterminated_nul.phpt
@@ -2,6 +2,10 @@
 mb_ereg_replace() with unterminated \k<name> backref must not embed a NUL byte
 --EXTENSIONS--
 mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_ereg')) die('skip mbregex support not available');
+?>
 --FILE--
 <?php
 var_dump(bin2hex(mb_ereg_replace('(\d+)', '\k<num', '123')));

diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
@@ -12749,25 +12749,62 @@ static int zend_jit_fetch_dim_read(zend_jit_ctx       *jit,
 					ir_IF_TRUE(if_type);
 				}
 			}
-			jit_SET_EX_OPLINE(jit, opline);
 			str_ref = jit_Z_PTR(jit, op1_addr);
-			if (opline->opcode != ZEND_FETCH_DIM_IS) {
-				ir_ref ref;
 
-				if ((op2_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_GUARD)) == MAY_BE_LONG) {
-					ref = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_offset_r_helper),
-						str_ref, jit_Z_LVAL(jit, op2_addr));
-				} else {
-					ref = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_r_helper),
-						str_ref, jit_ZVAL_ADDR(jit, op2_addr));
-				}
+			/* Inlined offset read for integer offsets into strings. */
+			if (opline->opcode != ZEND_FETCH_DIM_IS
+			 && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_STRING
+			 && (op2_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_GUARD)) == MAY_BE_LONG) {
+				ir_ref offset_ref = jit_Z_LVAL(jit, op2_addr);
+				ir_ref len_ref = ir_LOAD_L(ir_ADD_OFFSET(str_ref, offsetof(zend_string, len)));
+				ir_ref real_offset_ref = offset_ref;
+				if (!op2_range || op2_range->min < 0) {
+					// JIT: if (offset < 0) offset += ZSTR_LEN(str);
+					/* Branchless way to add -1 for negative offsets to the string length. */
+					real_offset_ref = ir_ADD_L(offset_ref,
+						ir_AND_L(len_ref,
+							ir_SAR_L(offset_ref, ir_CONST_LONG(SIZEOF_ZEND_LONG * 8 - 1))));
+				}
+
+				/* An offset that is still negative wraps around and fails this check as well. */
+				ir_ref if_in_range = ir_IF(ir_ULT(real_offset_ref, len_ref));
+
+				ir_IF_TRUE(if_in_range);
+				// JIT: result = ZSTR_CHAR((uint8_t)ZSTR_VAL(str)[offset]);
+				ir_ref ref = ir_LOAD_A(
+					ir_ADD_A(
+						ir_CONST_ADDR(zend_one_char_string),
+						ir_MUL_A(
+							ir_ZEXT_A(
+								ir_LOAD_U8(
+									ir_ADD_A(ir_ADD_OFFSET(str_ref, offsetof(zend_string, val)),
+										ir_BITCAST_A(real_offset_ref)))),
+							ir_CONST_ADDR(sizeof(zend_string*)))));
+				ir_ref fast_path = ir_END();
+
+				ir_IF_FALSE_cold(if_in_range);
+				jit_SET_EX_OPLINE(jit, opline);
+				ir_ref slow_ref = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_offset_r_helper),
+					str_ref, offset_ref);
+
+				ir_MERGE_WITH(fast_path);
+				ref = ir_PHI_2(IR_ADDR, slow_ref, ref);
 				jit_set_Z_PTR(jit, res_addr, ref);
 				jit_set_Z_TYPE_INFO(jit, res_addr, IS_STRING);
 			} else {
-				ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_is_helper),
-					str_ref,
-					jit_ZVAL_ADDR(jit, op2_addr),
-					jit_ZVAL_ADDR(jit, res_addr));
+				jit_SET_EX_OPLINE(jit, opline);
+				if (opline->opcode != ZEND_FETCH_DIM_IS) {
+					ir_ref ref = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_r_helper),
+						str_ref, jit_ZVAL_ADDR(jit, op2_addr));
+
+					jit_set_Z_PTR(jit, res_addr, ref);
+					jit_set_Z_TYPE_INFO(jit, res_addr, IS_STRING);
+				} else {
+					ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_fetch_dim_str_is_helper),
+						str_ref,
+						jit_ZVAL_ADDR(jit, op2_addr),
+						jit_ZVAL_ADDR(jit, res_addr));
+				}
 			}
 			ir_END_list(end_inputs);
 		}

diff --git a/win32/build/confutils.js b/win32/build/confutils.js
@@ -58,6 +58,7 @@ var MINRE2C = "1.0.3";
 
 /* Store the enabled extensions (summary + QA check) */
 var extensions_enabled = new Array();
+var cxx_mode_targets = {};
 
 /* Store the SAPI enabled (summary + QA check) */
 var sapi_enabled = new Array();
@@ -1460,13 +1461,17 @@ function ZEND_EXTENSION(extname, file_list, shared, cflags, dllname, obj_dir)
 	extensions_enabled[extensions_enabled.length - 1][2] = true;
 }
 
-function EXTENSION(extname, file_list, shared, cflags, dllname, obj_dir)
+function EXTENSION(extname, file_list, shared, cflags, dllname, obj_dir, cxx_mode)
 {
 	var objs = null;
 	var EXT = extname.toUpperCase();
 	var extname_for_printing;
 	var ldflags;
 
+	if (cxx_mode) {
+		cxx_mode_targets[extname] = true;
+	}
+
 	if (shared == null) {
 		if (force_all_shared()) {
 			shared = true;
@@ -1804,8 +1809,9 @@ function ADD_SOURCES(dir, file_list, target, obj_dir, duplicate_sources)
 					var _tmp = src.split("\\");
 					var filename = _tmp.pop();
 					obj = filename.replace(re, ".obj");
+					var c11_flag = VS_TOOLSET && !cxx_mode_targets[target] && /\.c$/i.test(src) ? " /std:c11" : "";
 
-					MFO.WriteLine("\t" + CMD_MOD1 + "$(CC) $(" + flags + ") $(CFLAGS) $(" + bd_flags_name + ") /c " + dir + "\\" + src + " /Fo" + sub_build + d + obj);
+					MFO.WriteLine("\t" + CMD_MOD1 + "$(CC)" + c11_flag + " $(" + flags + ") $(CFLAGS) $(" + bd_flags_name + ") /c " + dir + "\\" + src + " /Fo" + sub_build + d + obj);
 
 					if ("clang" == PHP_ANALYZER) {
 						MFO.WriteLine("\t" + CMD_MOD1 + "\"$(CLANG_CL)\" " + analyzer_base_args + " $(" + flags + "_ANALYZER) $(CFLAGS_ANALYZER) $(" + bd_flags_name + "_ANALYZER) " + dir + "\\" + src);
@@ -1819,11 +1825,20 @@ function ADD_SOURCES(dir, file_list, target, obj_dir, duplicate_sources)
 			} else {
 				/* TODO create a response file at least for the source files to work around the cmd line length limit. */
 				var src_line = "";
+				var src_lines = ["", ""];
 				for (var j in srcs_by_dir[k]) {
-					src_line += dir + "\\" + file_list[srcs_by_dir[k][j]] + " ";
+					var source = file_list[srcs_by_dir[k][j]];
+					var source_path = dir + "\\" + source + " ";
+					src_line += source_path;
+					src_lines[VS_TOOLSET && /\.c$/i.test(source) ? 0 : 1] += source_path;
 				}
 
-				MFO.WriteLine("\t" + CMD_MOD1 + "$(CC) $(" + flags + ") $(CFLAGS) /Fo" + sub_build + d + " $(" + bd_flags_name + ") /c " + src_line);
+				for (var language = 0; language < src_lines.length; language++) {
+					if (src_lines[language]) {
+						var c11_flag = language == 0 && !cxx_mode_targets[target] ? " /std:c11" : "";
+						MFO.WriteLine("\t" + CMD_MOD1 + "$(CC)" + c11_flag + " $(" + flags + ") $(CFLAGS) /Fo" + sub_build + d + " $(" + bd_flags_name + ") /c " + src_lines[language]);
+					}
+				}
 
 				if ("clang" == PHP_ANALYZER) {
 					MFO.WriteLine("\t\"$(CLANG_CL)\" " + analyzer_base_args + " $(" + flags + "_ANALYZER) $(CFLAGS_ANALYZER)  $(" + bd_flags_name + "_ANALYZER) " + src_line);