[pull] master from php:master

ext/curl/tests/curl_basic_022.phpt

@@ -11,10 +11,10 @@ curl_setopt($ch, CURLOPT_COOKIELIST, 'Set-Cookie: C2=v2; expires=Thu, 31-Dec-203
 var_dump(curl_getinfo($ch, CURLINFO_COOKIELIST));
 
 ?>
---EXPECT--
+--EXPECTF--
 array(2) {
   [0]=>
-  string(38) ".php.net	TRUE	/	FALSE	2145916799	C1	v1"
+  string(38) ".php.net	TRUE	/	FALSE	%d	C1	v1"
   [1]=>
-  string(38) ".php.net	TRUE	/	FALSE	2145916799	C2	v2"
+  string(38) ".php.net	TRUE	/	FALSE	%d	C2	v2"
 }

ext/gd/gd.c

@@ -3956,6 +3956,11 @@ PHP_FUNCTION(imagescale)
 
 	im = php_gd_libgdimageptr_from_zval_p(IM);
 
+	if (tmp_h < 0 && tmp_w < 0) {
+		zend_value_error("Argument #2 ($width) and argument #3 ($height) cannot be both negative");
+		RETURN_THROWS();
+	}
+
 	if (tmp_h < 0 || tmp_w < 0) {
 		/* preserve ratio */
 		long src_x, src_y;

ext/gd/tests/gh17703.phpt

@@ -0,0 +1,17 @@
+--TEST--
+GH-17703 both width and height value being negative triggers ValueError on width.
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+
+$img = imagecreatetruecolor ( 256, 1);
+
+try {
+	imagescale($img, -1, -1, 0);
+} catch (\ValueError $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+Argument #2 ($width) and argument #3 ($height) cannot be both negative

ext/opcache/jit/ir/ir_aarch64.dasc

@@ -1383,9 +1383,16 @@ static void ir_load_local_addr(ir_ctx *ctx, ir_reg reg, ir_ref src)
 	ir_backend_data *data = ctx->data;
 	dasm_State **Dst = &data->dasm_state;
 	ir_reg base = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-	int32_t offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[src].op3);
+	ir_insn *var_insn;
+	int32_t offset;
 
 	IR_ASSERT(ir_rule(ctx, src) == IR_STATIC_ALLOCA);
+	var_insn = &ctx->ir_base[src];
+	if (var_insn->op == IR_VADDR) {
+		var_insn = &ctx->ir_base[var_insn->op1];
+	}
+	IR_ASSERT(var_insn->op == IR_VAR || var_insn->op == IR_ALLOCA);
+	offset = IR_SPILL_POS_TO_OFFSET(var_insn->op3);
 	if (aarch64_may_encode_imm12(offset)) {
 		|	add Rx(reg), Rx(base), #offset
 	} else {
@@ -5680,10 +5687,15 @@ static void ir_allocate_unique_spill_slots(ir_ctx *ctx)
 								ir_reg reg = ir_get_free_reg(constraints.tmp_regs[n].type, available);
 								ir_ref *ops = insn->ops;
 								IR_REGSET_EXCL(available, reg);
-								if (constraints.tmp_regs[n].num > 0
-								 && IR_IS_CONST_REF(ops[constraints.tmp_regs[n].num])) {
-									/* rematerialization */
-									reg |= IR_REG_SPILL_LOAD;
+								if (constraints.tmp_regs[n].num > 0) {
+									if (IR_IS_CONST_REF(ops[constraints.tmp_regs[n].num])) {
+										/* rematerialization */
+										reg |= IR_REG_SPILL_LOAD;
+									} else if (ctx->ir_base[ops[constraints.tmp_regs[n].num]].op == IR_ALLOCA ||
+											ctx->ir_base[ops[constraints.tmp_regs[n].num]].op == IR_VADDR) {
+										/* local address rematerialization */
+										reg |= IR_REG_SPILL_LOAD;
+									}
 								}
 								ctx->regs[i][constraints.tmp_regs[n].num] = reg;
 							} else if (constraints.tmp_regs[n].reg == IR_REG_SCRATCH) {

ext/opcache/jit/ir/ir_gcm.c

@@ -1059,7 +1059,7 @@ int ir_schedule(ir_ctx *ctx)
 	if (ctx->flags & IR_DEBUG_SCHEDULE) {
 		fprintf(stderr, "After Schedule\n");
 		for (i = 1; i != 0; i = _next[i]) {
-			fprintf(stderr, "%d -> %d\n", i, _blocks[i]);
+			fprintf(stderr, "%d -> %d (%d)\n", i, _blocks[i], _xlat[i]);
 		}
 	}
 #endif
@@ -1328,11 +1328,13 @@ int ir_schedule(ir_ctx *ctx)
 	new_ctx.cfg_edges = ctx->cfg_edges;
 	ctx->cfg_blocks = NULL;
 	ctx->cfg_edges = NULL;
+	ir_code_buffer *saved_code_buffer = ctx->code_buffer;
 
 	ir_free(ctx);
 	IR_ASSERT(new_ctx.consts_count == new_ctx.consts_limit);
 	IR_ASSERT(new_ctx.insns_count == new_ctx.insns_limit);
 	memcpy(ctx, &new_ctx, sizeof(ir_ctx));
+	ctx->code_buffer = saved_code_buffer;
 	ctx->flags2 |= IR_LINEAR;
 
 	ir_mem_free(_next);

ext/opcache/jit/ir/ir_private.h

@@ -1013,8 +1013,10 @@ IR_ALWAYS_INLINE uint32_t ir_insn_len(const ir_insn *insn)
 #define IR_HAS_FP_RET_SLOT     (1<<10)
 #define IR_16B_FRAME_ALIGNMENT (1<<11)
 
+/* Temporary: MEM2SSA -> SCCP */
+#define IR_MEM2SSA_VARS        (1<<25)
+
 /* Temporary: SCCP -> CFG */
-#define IR_SCCP_DONE           (1<<25)
 #define IR_CFG_REACHABLE       (1<<26)
 
 /* Temporary: Dominators -> Loops */