Merge branch 'master' into override-property

Author: TimWolla

.github/workflows/nightly.yml

@@ -1068,6 +1068,7 @@ jobs:
           - zts: ${{ !inputs.run_freebsd_zts && true || '*never*' }}
     name: "FREEBSD_${{ matrix.zts && 'ZTS' || 'NTS' }}"
     runs-on: ubuntu-latest
+    timeout-minutes: 50
     steps:
       - name: git checkout
         uses: actions/checkout@v4

.github/workflows/push.yml

@@ -366,6 +366,7 @@ jobs:
     if: github.repository == 'php/php-src' || github.event_name == 'pull_request'
     name: FREEBSD
     runs-on: ubuntu-latest
+    timeout-minutes: 50
     steps:
       - name: git checkout
         uses: actions/checkout@v4

NEWS

@@ -9,6 +9,13 @@ PHP                                                                        NEWS
     been deprecated, as it no longer has any effect since PHP 8.0. (Girgias)
   . Terminating case statements with a semicolon instead of a colon has
     been deprecated. (theodorejb)
+  . The backtick operator as an alias for shell_exec() has been deprecated.
+    (timwolla)
+  . Returning null from __debugInfo() has been deprecated. (DanielEScherzer)
+
+- Date:
+  . The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been
+    deprecated. (jorgsowa)
 
 - DOM:
   . Fixed bug GH-18877 (\Dom\HTMLDocument querySelectorAll selecting only the
@@ -36,6 +43,8 @@ PHP                                                                        NEWS
     (Girgias)
   . Implement #80495 (Enable to set padding in openssl_(sign|verify).
     (Jakub Zelenka)
+  . Implement #47728 (openssl_pkcs7_sign ignores new openssl flags).
+    (Jakub Zelenka)
 
 - PDO:
   . The "uri:" DSN scheme has been deprecated due to security concerns with
@@ -62,6 +71,8 @@ PHP                                                                        NEWS
   . The socket_set_timeout() alias function has been deprecated. (timwolla)
   . Passing null to to readdir(), rewinddir(), and closedir() to use the last
     opened directory has been deprecated. (Girgias)
+  . Fixed bug GH-19153 (#[\Attribute] validation should error on
+    trait/interface/enum/abstract class). (DanielEScherzer)
 
 31 Jul 2025, PHP 8.5.0alpha4
 

UPGRADING

@@ -50,6 +50,9 @@ PHP 8.5 UPGRADE NOTES
     immediately, without calling user-defined error handlers.
   . Exceptions thrown by user-defined error handlers when handling class linking
     errors are not promoted to fatal errors anymore and do not prevent linking.
+  . Applying #[\Attribute] to an abstract class, enum, interface, or trait triggers
+    an error during compilation. Previously, the attribute could be added, but when
+    ReflectionAttribute::newInstance() was called an error would be thrown.
 
 - DOM:
   . Cloning a DOMNamedNodeMap, DOMNodeList, Dom\NamedNodeMap, Dom\NodeList,
@@ -325,6 +328,17 @@ PHP 8.5 UPGRADE NOTES
   . Terminating case statements with a semicolon instead of a colon has
     been deprecated.
     RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_semicolon_after_case_in_switch_statement
+  . The backtick operator as an alias for shell_exec() has been deprecated.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_backticks_as_an_alias_for_shell_exec
+  . Returning null from __debugInfo() has been deprecated.
+    Return an empty array instead.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_debuginfo_returning_null
+
+- Date:
+  . The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been
+    deprecated. This is because the associated timezone is ignored and always
+    uses GMT.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_date_rfc7231_and_datetimeinterfacerfc7231
 
 - FileInfo:
   . The finfo_close() function has been deprecated.
@@ -671,6 +685,10 @@ PHP 8.5 UPGRADE NOTES
 
 - OpenSSL:
   . OPENSSL_PKCS1_PSS_PADDING
+  . PKCS7_NOSMIMECAP
+  . PKCS7_CRLFEOL
+  . PKCS7_NOCRL
+  . PKCS7_NO_DUAL_CONTENT
 
 - POSIX:
   . POSIX_SC_OPEN_MAX.

Zend/Optimizer/block_pass.c

@@ -420,6 +420,14 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 				}
 				break;
 
+			case ZEND_EXT_STMT:
+				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
+					/* Variable will be deleted later by FREE, so we can't optimize it */
+					Tsource[VAR_NUM(opline->op1.var)] = NULL;
+					break;
+				}
+				break;
+
 			case ZEND_CASE:
 			case ZEND_CASE_STRICT:
 			case ZEND_COPY_TMP:

Zend/Optimizer/zend_ssa.c

@@ -22,6 +22,7 @@
 #include "zend_ssa.h"
 #include "zend_dump.h"
 #include "zend_inference.h"
+#include "zend_worklist.h"
 #include "Optimizer/zend_optimizer_internal.h"
 
 static bool dominates(const zend_basic_block *blocks, int a, int b) {
@@ -816,23 +817,14 @@ ZEND_API int zend_ssa_rename_op(const zend_op_array *op_array, const zend_op *op
 }
 /* }}} */
 
-static zend_result zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, int *var, int n) /* {{{ */
+static void zend_ssa_rename_in_block(const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, int *var, int n) /* {{{ */
 {
 	zend_basic_block *blocks = ssa->cfg.blocks;
 	zend_ssa_block *ssa_blocks = ssa->blocks;
 	zend_ssa_op *ssa_ops = ssa->ops;
 	int ssa_vars_count = ssa->vars_count;
 	int i, j;
 	zend_op *opline, *end;
-	int *tmp = NULL;
-	ALLOCA_FLAG(use_heap = 0);
-
-	// FIXME: Can we optimize this copying out in some cases?
-	if (blocks[n].next_child >= 0) {
-		tmp = do_alloca(sizeof(int) * (op_array->last_var + op_array->T), use_heap);
-		memcpy(tmp, var, sizeof(int) * (op_array->last_var + op_array->T));
-		var = tmp;
-	}
 
 	if (ssa_blocks[n].phis) {
 		zend_ssa_phi *phi = ssa_blocks[n].phis;
@@ -916,22 +908,90 @@ static zend_result zend_ssa_rename(const zend_op_array *op_array, uint32_t build
 	}
 
 	ssa->vars_count = ssa_vars_count;
+}
+/* }}} */
 
-	j = blocks[n].children;
-	while (j >= 0) {
-		// FIXME: Tail call optimization?
-		if (zend_ssa_rename(op_array, build_flags, ssa, var, j) == FAILURE)
-			return FAILURE;
-		j = blocks[j].next_child;
+static zend_result zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, int *var, int n)
+{
+	/* The worklist contains block numbers, encoded as positive or negative value.
+	 * Positive values indicate that the variable rename still needs to happen for the block.
+	 * Negative values indicate the variable rename was done and all children were handled too.
+	 * In that case, we will clean up.
+	 * Because block 0 is valid, we bias the block numbers by adding 1 such that we can distinguish
+	 * positive and negative values in all cases. */
+	zend_worklist_stack work;
+	ALLOCA_FLAG(work_use_heap);
+	ZEND_WORKLIST_STACK_ALLOCA(&work, ssa->cfg.blocks_count, work_use_heap);
+	zend_worklist_stack_push(&work, n + 1);
+
+	/* This is used to backtrack the right version of the renamed variables to use. */
+	ALLOCA_FLAG(save_vars_use_heap);
+	unsigned int save_vars_top = 0;
+	int **save_vars = do_alloca(sizeof(int *) * (ssa->cfg.blocks_count + 1), save_vars_use_heap);
+	save_vars[0] = var;
+
+	while (work.len) {
+		n = zend_worklist_stack_pop(&work);
+
+		/* Enter state: perform SSA variable rename */
+		if (n > 0) {
+			n--;
+
+			// FIXME: Can we optimize this copying out in some cases?
+			int *new_var;
+			if (ssa->cfg.blocks[n].next_child >= 0) {
+				new_var = emalloc(sizeof(int) * (op_array->last_var + op_array->T));
+				memcpy(new_var, save_vars[save_vars_top], sizeof(int) * (op_array->last_var + op_array->T));
+				save_vars[++save_vars_top] = new_var;
+			} else {
+				new_var = save_vars[save_vars_top];
+			}
+
+			zend_ssa_rename_in_block(op_array, build_flags, ssa, new_var, n);
+
+			int j = ssa->cfg.blocks[n].children;
+			if (j >= 0) {
+				/* Push backtrack state */
+				zend_worklist_stack_push(&work, -(n + 1));
+
+				/* Push children in enter state */
+				unsigned int child_count = 0;
+				int len_prior = work.len;
+				do {
+					zend_worklist_stack_push(&work, j + 1);
+					j = ssa->cfg.blocks[j].next_child;
+					child_count++;
+				} while (j >= 0);
+
+				/* Reverse block order to maintain SSA variable number order given in previous PHP versions,
+				 * but the data structure doesn't allow reverse dominator tree traversal. */
+				for (unsigned int i = 0; i < child_count / 2; i++) {
+					int tmp = work.buf[len_prior + i];
+					work.buf[len_prior + i] = work.buf[work.len - 1 - i];
+					work.buf[work.len - 1 - i] = tmp;
+				}
+			} else {
+				/* Leafs jump directly to backtracking */
+				goto backtrack;
+			}
+		}
+		/* Leave state: backtrack */
+		else {
+			n = -n;
+			n--;
+backtrack:;
+			if (ssa->cfg.blocks[n].next_child >= 0) {
+				efree(save_vars[save_vars_top]);
+				save_vars_top--;
+			}
+		}
 	}
 
-	if (tmp) {
-		free_alloca(tmp, use_heap);
-	}
+	free_alloca(save_vars, save_vars_use_heap);
+	ZEND_WORKLIST_STACK_FREE_ALLOCA(&work, work_use_heap);
 
 	return SUCCESS;
 }
-/* }}} */
 
 ZEND_API zend_result zend_build_ssa(zend_arena **arena, const zend_script *script, const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa) /* {{{ */
 {

Zend/tests/attributes/Attribute/Attribute_on_abstract.phpt

@@ -0,0 +1,12 @@
+--TEST--
+#[Attribute] on an abstract class
+--FILE--
+<?php
+
+#[Attribute]
+abstract class Demo {}
+
+echo "Done\n";
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\Attribute] to abstract class Demo in %s on line %d

Zend/tests/attributes/Attribute/Attribute_on_enum.phpt

@@ -0,0 +1,12 @@
+--TEST--
+#[Attribute] on an enum
+--FILE--
+<?php
+
+#[Attribute]
+enum Demo {}
+
+echo "Done\n";
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\Attribute] to enum Demo in %s on line %d

Zend/tests/attributes/Attribute/Attribute_on_interface.phpt

@@ -0,0 +1,12 @@
+--TEST--
+#[Attribute] on an interface
+--FILE--
+<?php
+
+#[Attribute]
+interface Demo {}
+
+echo "Done\n";
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\Attribute] to interface Demo in %s on line %d

Zend/tests/attributes/Attribute/Attribute_on_trait.phpt

@@ -0,0 +1,12 @@
+--TEST--
+#[Attribute] on a trait
+--FILE--
+<?php
+
+#[Attribute]
+trait Demo {}
+
+echo "Done\n";
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\Attribute] to trait Demo in %s on line %d