[pull] master from php:master

NEWS

@@ -58,6 +58,8 @@ PHP                                                                        NEWS
   . Bumped ICU requirement to ICU >= 57.1. (cmb)
   . IntlDateFormatter::setTimeZone()/datefmt_set_timezone() throws an exception
     with uninitialised classes or clone failure. (David Carlier)
+  . Added DECIMAL_COMPACT_SHORT/DECIMAL_COMPACT_LONG for NumberFormatter class.
+    (BogdanUngureanu)
 
 - MySQLi:
   . Fixed bugs GH-17900 and GH-8084 (calling mysqli::__construct twice).

UPGRADING

@@ -291,6 +291,10 @@ PHP 8.5 UPGRADE NOTES
   . CURLINFO_HTTPAUTH_USED.
   . CURLINFO_PROXYAUTH_USED.
 
+- Intl:
+  . DECIMAL_COMPACT_SHORT.
+  . DECIMAL_COMPACT_LONG.
+
 - POSIX:
   . POSIX_SC_OPEN_MAX.
 

Zend/tests/lazy_objects/gh17941.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-17941 (Stack-use-after-return with lazy objects and hooks)
+--FILE--
+<?php
+
+class SubClass {
+    public $prop {get => $this->prop; set($x) => $this->prop = $x;}
+}
+
+$rc = new ReflectionClass(SubClass::class);
+$obj = $rc->newLazyProxy(function ($object) {
+    echo "init\n";
+    return new SubClass;
+});
+
+function foo(SubClass $x) {
+    $x->prop = 1;
+    var_dump($x->prop);
+}
+
+foo($obj);
+
+?>
+--EXPECT--
+init
+int(1)

Zend/zend_object_handlers.c

@@ -1198,6 +1198,11 @@ lazy_init:;
 
 	variable_ptr = zend_std_write_property(zobj, name, &backup, cache_slot);
 	zval_ptr_dtor(&backup);
+
+	if (variable_ptr == &backup) {
+		variable_ptr = value;
+	}
+
 	return variable_ptr;
 }
 /* }}} */

ext/dom/php_dom.c

@@ -367,13 +367,14 @@ static zend_always_inline const dom_prop_handler *dom_get_prop_handler(const dom
 
 	if (obj->prop_handler != NULL) {
 		if (cache_slot && *cache_slot == obj->prop_handler) {
-			hnd = *(cache_slot + 1);
+			hnd = cache_slot[1];
 		}
 		if (!hnd) {
 			hnd = zend_hash_find_ptr(obj->prop_handler, name);
 			if (cache_slot) {
-				*cache_slot = obj->prop_handler;
-				*(cache_slot + 1) = (void *) hnd;
+				cache_slot[0] = obj->prop_handler;
+				cache_slot[1] = (void *) hnd;
+				cache_slot[2] = NULL;
 			}
 		}
 	}

ext/dom/tests/gh17991.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-17991 (Assertion failure dom_attr_value_write)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$attr = new DOMAttr("r", "iL");
+class Box {
+    public ?Test $value;
+}
+class Test {
+}
+function test($box) {
+    var_dump($box->value = new Test);
+}
+$box = new Box();
+test($box);
+test($attr);
+?>
+--EXPECTF--
+object(Test)#%d (0) {
+}
+
+Fatal error: Uncaught TypeError: Cannot assign Test to property DOMAttr::$value of type string in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(DOMAttr))
+#1 {main}
+  thrown in %s on line %d

ext/gd/gd.c

@@ -3721,7 +3721,7 @@ PHP_FUNCTION(imageconvolution)
 	}
 
 	for (i=0; i<3; i++) {
-		if ((var = zend_hash_index_find(Z_ARRVAL_P(hash_matrix), (i))) != NULL && Z_TYPE_P(var) == IS_ARRAY) {
+		if ((var = zend_hash_index_find_deref(Z_ARRVAL_P(hash_matrix), (i))) != NULL && Z_TYPE_P(var) == IS_ARRAY) {
 			if (zend_hash_num_elements(Z_ARRVAL_P(var)) != 3 ) {
 				zend_argument_value_error(2, "must be a 3x3 array, matrix[%d] only has %d elements", i, zend_hash_num_elements(Z_ARRVAL_P(var)));
 				RETURN_THROWS();
@@ -4034,7 +4034,7 @@ PHP_FUNCTION(imageaffine)
 	}
 
 	for (i = 0; i < nelems; i++) {
-		if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) {
+		if ((zval_affine_elem = zend_hash_index_find_deref(Z_ARRVAL_P(z_affine), i)) != NULL) {
 			switch (Z_TYPE_P(zval_affine_elem)) {
 				case IS_LONG:
 				case IS_DOUBLE:
@@ -4200,7 +4200,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
 	}
 
 	for (i = 0; i < 6; i++) {
-		if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m1), i)) != NULL) {
+		if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m1), i)) != NULL) {
 			switch (Z_TYPE_P(tmp)) {
 				case IS_LONG:
 				case IS_DOUBLE:
@@ -4213,7 +4213,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
 			}
 		}
 
-		if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m2), i)) != NULL) {
+		if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m2), i)) != NULL) {
 			switch (Z_TYPE_P(tmp)) {
 				case IS_LONG:
 				case IS_DOUBLE:

ext/gd/tests/gh17984.phpt

@@ -0,0 +1,44 @@
+--TEST--
+GH-17984: array of references handling
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+$a = 45;
+$matrix = [&$a, 1, 3, 1, 5, 1];
+$subarray = [&$a, 0, 0];
+$matrix3 = array([0, 0, 0] , &$subarray, [0, 0, 0]);
+$src = imagecreatetruecolor(8, 8);
+var_dump(imageaffine($src, $matrix));
+var_dump(imageaffinematrixconcat($matrix, $matrix));
+var_dump(imageconvolution($src, $matrix3, 1.0, 0.0));
+$poly = imagecolorallocate($src, 255, 0, 0);
+var_dump(imagepolygon($src, array (
+        &$a,   0,
+        100, 200,
+        300, 200
+    ),
+    $poly));
+$style = [&$a, &$a];
+var_dump(imagesetstyle($src, $style)); 
+?>
+--EXPECT--
+object(GdImage)#2 (0) {
+}
+array(6) {
+  [0]=>
+  float(2028)
+  [1]=>
+  float(46)
+  [2]=>
+  float(138)
+  [3]=>
+  float(4)
+  [4]=>
+  float(233)
+  [5]=>
+  float(7)
+}
+bool(true)
+bool(true)
+bool(true)

ext/intl/formatter/formatter.stub.php

@@ -11,6 +11,10 @@ class NumberFormatter
     public const int PATTERN_DECIMAL = UNKNOWN;
     /** @cvalue UNUM_DECIMAL */
     public const int DECIMAL = UNKNOWN;
+    /** @cvalue UNUM_DECIMAL_COMPACT_SHORT */
+    public const int DECIMAL_COMPACT_SHORT = UNKNOWN;
+    /** @cvalue UNUM_DECIMAL_COMPACT_LONG */
+    public const int DECIMAL_COMPACT_LONG = UNKNOWN;
     /** @cvalue UNUM_CURRENCY */
     public const int CURRENCY = UNKNOWN;
     /** @cvalue UNUM_PERCENT */

ext/intl/tests/formatter_format_decimal_compact.phpt

@@ -0,0 +1,57 @@
+--TEST--
+numfmt_format_currency() icu >= 4.8
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+
+function ut_main()
+{
+    $locales = array(
+        'en_UK',
+        'en_US',
+        'ru',
+        'zh_CN',
+        'ro',
+        'uk',
+        'en',
+        'bg'
+    );
+
+    $number = 1234567.89;
+
+    $res_str = '';
+    foreach( $locales as $locale )
+    {
+        $fmt = ut_nfmt_create( $locale, NumberFormatter::DECIMAL_COMPACT_SHORT );
+        $res_str .= "$locale: short = " . ut_nfmt_format ($fmt, $number) . "\n";
+
+        $fmt = ut_nfmt_create( $locale, NumberFormatter::DECIMAL_COMPACT_LONG );
+        $res_str .= "$locale: long = " . ut_nfmt_format ($fmt, $number) . "\n";
+    }
+    return $res_str;
+}
+
+include_once( 'ut_common.inc' );
+
+// Run the test
+ut_run();
+
+?>
+--EXPECTF--
+en_UK: short = 1.2M
+en_UK: long = 1.2 million
+en_US: short = 1.2M
+en_US: long = 1.2 million
+ru: short = 1,2 млн
+ru: long = 1,2 миллиона
+zh_CN: short = 123万
+zh_CN: long = 123万
+ro: short = 1,2 mil.
+ro: long = 1,2 milioane
+uk: short = 1,2 млн
+uk: long = 1,2 мільйона
+en: short = 1.2M
+en: long = 1.2 million
+bg: short = 1,2 млн.
+bg: long = 1,2 милиона