[DOM] Register id attributes set via setAttribute() in XML documents

.github/workflows/real-time-benchmark.yml

@@ -214,6 +214,21 @@ jobs:
 
             PHP_JIT=0
           EOF
+      - name: Setup PHP config - benchmarked PHP version with JIT
+        if: env.JIT == '1'
+        run: |
+          set -e
+
+          cat << EOF > ./php-version-benchmarks/config/php/this_jit.ini
+            PHP_NAME="PHP - ${{ env.BRANCH }} (JIT)"
+            PHP_ID=php_${{ env.ID }}_jit
+
+            PHP_REPO=${{ github.server_url }}/${{ env.REPOSITORY }}.git
+            PHP_BRANCH=${{ env.BRANCH }}
+            PHP_COMMIT=${{ env.COMMIT }}
+
+            PHP_JIT=${{ env.JIT }}
+          EOF
       - name: Setup test config
         run: |
           set -e

NEWS

@@ -7,6 +7,15 @@ PHP                                                                        NEWS
     compacting arrays with holes. (Weilin Du)
   . Fix handling of references to typed properties during unserialization
     of various internal classes. (ndossche, timwolla)
+  . Fixed OSS-Fuzz 532353396 (assertion	failure	with static type). (Girgias)
+  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
+  . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
+    register declarations so the caller's -Wvolatile-register-var state is
+    restored). (yqtian-se)
+
+- CLI
+  . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
+    request activation). (matyhtf)
 
 - Date:
   . Fix unserialization of Time\Duration. (timwolla)
@@ -21,6 +30,11 @@ PHP                                                                        NEWS
   . Fixed Dom\HTMLDocument giving attributes the namespace of their element
     when a fragment is parsed with an xlink, xml or xmlns context element.
     (Ilia Alshanetsky)
+  . getElementById() now finds elements whose id attribute was set with
+    setAttribute()/setAttributeNS() on Dom\XMLDocument. (Ilia Alshanetsky)
+
+- Fileinfo:
+  . Upgrade to file 5.48. (Weilin Du)
 
 - Intl:
   . Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
@@ -37,6 +51,11 @@ PHP                                                                        NEWS
 - MBString:
   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
     a truncated UTF-8 sequence). (Lazizbek Ergashev)
+  . Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)
+
+- Opcache:
+  . Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
+    loop-invariant addition). (Ilia Alshanetsky)
 
 - PDO:
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
@@ -49,6 +68,10 @@ PHP                                                                        NEWS
   . Reverted the validity check on the flags argument of posix_access().
     (David Carlier)
 
+- Readline:
+  . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
+    set to an empty string. (Ilia Alshanetsky)
+
 - SPL:
   . Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when
     __serialize() removes an element). (David Carlier)
@@ -60,6 +83,13 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false
     properly). (Jakub Zelenka, Ilija Tovilo)
+  . Fixed three Windows-only proc_open() defects: an uninitialized
+    PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
+    lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
+
+- Zlib:
+  . Fixed inflate_init() dropping the preset dictionary for raw streams with
+    a non-default window. (Ilia Alshanetsky)
 
 
 10 Sep 2026, PHP 8.6.0beta3

UPGRADING

@@ -99,6 +99,9 @@ PHP 8.6 UPGRADE NOTES
     intl.use_exceptions enabled, these failures throw IntlException. Previously,
     these paths emitted a warning and compared the value as an empty string.
 
+- MBstring:
+  . Unicode data tables have been updated to Unicode 18.0
+
 - PCNTL:
   . pcntl_alarm() now raises a ValueError if the seconds argument is
     lower than zero or greater than the platform's UINT_MAX.
@@ -315,6 +318,12 @@ PHP 8.6 UPGRADE NOTES
     platform's key_t range instead of passing a truncated key to the operating
     system.
 
+- URI:
+  . Uri\WhatWg\Url::__construct() now sets $softErrors to an empty array when
+    URL processing throws an exception, instead of preserving its value.
+    URL validation errors remain available in the
+    Uri\WhatWg\InvalidUrlException::$errors property.
+
 - Zip:
   . ZipArchive::extractTo now raises a TypeError for the files argument if one
     or more of the entries is not a string.
@@ -661,6 +670,23 @@ PHP 8.6 UPGRADE NOTES
 5. Changed Functions
 ========================================
 
+- Date:
+  . The following DateTime, DateTimeImmutable, DateTimeZone, DateInterval, and DatePeriod methods now have tentative static return types:
+    DateTime::createFromInterface()
+    DateTimeImmutable::__set_state()
+    DateTimeImmutable::modify()
+    DateTimeImmutable::add()
+    DateTimeImmutable::sub()
+    DateTimeImmutable::setTimezone()
+    DateTimeImmutable::setTime()
+    DateTimeImmutable::setDate()
+    DateTimeImmutable::setISODate()
+    DateTimeImmutable::setTimestamp()
+    DateTimeImmutable::createFromInterface()
+    DateTimeZone::__set_state()
+    DateInterval::__set_state()
+    DatePeriod::__set_state()
+
 - Filter:
   . filter_var_array() return type has been narrowed from array|false|null to
     array|false. The function always establishes an array before filtering, so
@@ -891,6 +917,8 @@ PHP 8.6 UPGRADE NOTES
 - URI:
   . Uri\Rfc3986\UriBuilder and Uri\WhatWg\UrlBuilder
     RFC: https://wiki.php.net/rfc/uri_followup#uri_building
+  . enum Uri\WhatWg\UrlPercentEncodingMode
+    RFC: https://wiki.php.net/rfc/uri_followup#percent-encoding_support
 
 ========================================
 8. Removed Extensions and SAPIs
@@ -900,6 +928,10 @@ PHP 8.6 UPGRADE NOTES
 9. Other Changes to Extensions
 ========================================
 
+- Fileinfo:
+  . Upgraded to file 5.48.
+    Custom compiled magic databases from older file versions must be regenerated.
+
 - Hash:
   . The bundled version of xxHash was upgraded to 0.8.2.
 
@@ -1079,17 +1111,18 @@ PHP 8.6 UPGRADE NOTES
   . Improved performance of imagegrabscreen() and imagegrabwindow() on
     Windows.
 
-- JSON:
-  . Improve performance of encoding arrays and objects.
-  . Improved performance of indentation generation in json_encode()
-    when using PHP_JSON_PRETTY_PRINT.
-
 - Intl:
   . Improved performance of IntlCalendar::getAvailableLocales() and
     IntlDateFormatter::localtime() / datefmt_localtime() by pre-allocating
     their returned arrays.
   . Improved performance of transliterator_list_ids() and
     resourcebundle_locales() by pre-allocating their returned arrays.
+  . Optimized callback invocation in IntlChar::enumCharTypes().
+
+- JSON:
+  . Improve performance of encoding arrays and objects.
+  . Improved performance of indentation generation in json_encode()
+    when using PHP_JSON_PRETTY_PRINT.
 
 - Mbstring:
   . Improved performance of mb_str_pad().
@@ -1108,6 +1141,7 @@ PHP 8.6 UPGRADE NOTES
   . Improved performance of array_unshift().
   . Improved performance of array_walk().
   . Improved performance of intval('+0b...', 2) and intval('0b...', 2).
+  . Improved performance of pathinfo() when requesting a single component.
   . Improved performance of str_split().
   . Improved performance of str_pad().
   . Improved performance of str_repeat() when the multiplier is 1.

Zend/Optimizer/optimize_func_calls.c

@@ -61,6 +61,8 @@ static void zend_delete_call_instructions(const zend_op_array *op_array, zend_op
 			case ZEND_DO_ICALL:
 			case ZEND_DO_UCALL:
 			case ZEND_DO_FCALL_BY_NAME:
+			case ZEND_CALLABLE_CONVERT:
+			case ZEND_CALLABLE_CONVERT_PARTIAL:
 				call++;
 				break;
 			case ZEND_SEND_VAL:

Zend/tests/gh23662.phpt

@@ -0,0 +1,12 @@
+--TEST--
+GH-23662 (print_r() results in warning for NAN)
+--FILE--
+<?php
+print_r(NAN);
+print_r([NAN]);
+?>
+--EXPECT--
+NANArray
+(
+    [0] => NAN
+)

Zend/tests/typehints/bug43332_1.phpt → Zend/tests/type_declarations/relative_types/bug43332_1.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #43332.1 (self and parent as type hint in namespace)
+Bug #43332.1 (self and parent as type declaration in namespace)
 --FILE--
 <?php
 namespace foobar;

Zend/tests/typehints/bug43332_2.phpt → Zend/tests/type_declarations/relative_types/bug43332_2.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #43332.2 (self and parent as type hint in namespace)
+Bug #43332.2 (self and parent as type declaration in namespace)
 --FILE--
 <?php
 namespace foobar;

Zend/tests/typehints/bug60573.phpt → Zend/tests/type_declarations/relative_types/bug60573.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #60573 (type hinting with "self" keyword causes weird errors)
+Bug #60573 (type declaration with "self" keyword causes weird errors)
 --FILE--
 <?php
 class Foo1 {

Zend/tests/typehints/bug60573_2.phpt → Zend/tests/type_declarations/relative_types/bug60573_2.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #60573 (type hinting with "self" keyword causes weird errors) -- variation 2
+Bug #60573 (type declaration with "self" keyword causes weird errors) -- variation 2
 --FILE--
 <?php
 class Foo1 {

Zend/tests/type_declarations/relative_types/static/fully_qualified_static.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Fully qualified (leading backslash) static type names must fail
+--DESCRIPTION--
+OSS-Fuzz: https://issues.oss-fuzz.com/issues/532353396
+--FILE--
+<?php
+
+function test($i): \static {}
+
+?>
+--EXPECTF--
+Fatal error: Type declaration 'static' must be unqualified in %s on line %d

Zend/tests/type_declarations/relative_types/static/namespace_relative_static.phpt

@@ -0,0 +1,12 @@
+--TEST--
+namespace\static is not a valid type declaration
+--DESCRIPTION--
+OSS-Fuzz: https://issues.oss-fuzz.com/issues/532353396
+--FILE--
+<?php
+
+function test($i): namespace\static {}
+
+?>
+--EXPECTF--
+Fatal error: Type declaration 'static' must be unqualified in %s on line %d

Zend/zend.c

@@ -602,6 +602,9 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 		case IS_LONG:
 			smart_str_append_long(buf, Z_LVAL_P(expr));
 			break;
+		case IS_DOUBLE:
+			smart_str_append_double(buf, Z_DVAL_P(expr), EG(precision), false);
+			break;
 		case IS_REFERENCE:
 			zend_print_zval_r_to_buf(buf, Z_REFVAL_P(expr), indent);
 			break;

Zend/zend_closures.c

@@ -168,7 +168,7 @@ ZEND_METHOD(Closure, call)
 	}
 
 	fci_cache.called_scope = newclass;
-	fci_cache.object = fci.object = new_this;
+	fci_cache.object = new_this;
 
 	fci.size = sizeof(fci);
 	fci.consumed_args = 0;
@@ -384,7 +384,7 @@ static ZEND_NAMED_FUNCTION(zend_closure_call_magic) /* {{{ */ {
 		ZVAL_EMPTY_ARRAY(&fci.params[1]);
 	}
 
-	fcc.object = fci.object = Z_OBJ_P(ZEND_THIS);
+	fcc.object = Z_OBJ_P(ZEND_THIS);
 	fcc.called_scope = zend_get_called_scope(EG(current_execute_data));
 
 	zend_call_function(&fci, &fcc);

Zend/zend_compile.c

@@ -281,6 +281,7 @@ static const builtin_type_info builtin_types[] = {
 	{ZEND_STRL("iterable"), IS_ITERABLE},
 	{ZEND_STRL("object"), IS_OBJECT},
 	{ZEND_STRL("mixed"), IS_MIXED},
+	{ZEND_STRL("static"), IS_STATIC},
 	{NULL, 0, IS_UNDEF}
 };
 
@@ -7641,6 +7642,8 @@ static zend_type zend_compile_single_typename(zend_ast *ast)
 					ZSTR_VAL(zend_string_tolower(type_name)));
 			}
 
+			ZEND_ASSERT(type_code != IS_STATIC && "unqualified static type should have been handled by ZEND_AST_TYPE branch");
+
 			/* Transform iterable into a type union alias */
 			if (type_code == IS_ITERABLE) {
 				/* Set iterable bit for BC compat during Reflection and string representation of type */

Zend/zend_execute.c

@@ -71,9 +71,9 @@
 #endif
 
 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
-# pragma GCC diagnostic ignored "-Wvolatile-register-var"
+ZEND_DIAGNOSTIC_IGNORED_START("-Wvolatile-register-var")
   register zend_execute_data* volatile execute_data __asm__(ZEND_VM_FP_GLOBAL_REG);
-# pragma GCC diagnostic warning "-Wvolatile-register-var"
+ZEND_DIAGNOSTIC_IGNORED_END
 #endif
 
 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
@@ -103,9 +103,9 @@
 #endif
 
 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
-# pragma GCC diagnostic ignored "-Wvolatile-register-var"
+ZEND_DIAGNOSTIC_IGNORED_START("-Wvolatile-register-var")
   register const zend_op* volatile opline __asm__(ZEND_VM_IP_GLOBAL_REG);
-# pragma GCC diagnostic warning "-Wvolatile-register-var"
+ZEND_DIAGNOSTIC_IGNORED_END
 #else
 #endif
 

build/gen_stub.php

@@ -2169,7 +2169,7 @@ public function getMethodSynopsisElement(DOMDocument $doc): ?DOMElement {
 
                 $methodSynopsis->appendChild($methodparam);
                 foreach ($arg->attributes as $attribute) {
-                    $attribute = $doc->createElement("modifier", "#[\\" . $attribute->class . "]");
+                    $attribute = $doc->createElement("modifier", (string) $attribute);
                     $attribute->setAttribute("role", "attribute");
 
                     $methodparam->appendChild($attribute);
@@ -3355,6 +3355,24 @@ public function __construct(
         private readonly array $args,
     ) {}
 
+    public function __toString(): string {
+        $code = '#[\\' . $this->class;
+        if (!empty($this->args)) {
+            $prettyPrinter = new Standard;
+            $args = [];
+            foreach ($this->args as $arg) {
+                $argStr = $prettyPrinter->prettyPrintExpr($arg->value);
+                if ($arg->name !== null) {
+                    $argStr = $arg->name->name . ': ' . $argStr;
+                }
+                $args[] = $argStr;
+            }
+            $code .= '(' . implode(', ', $args) . ')';
+        }
+        $code .= ']';
+        return $code;
+    }
+
     /**
      * @param array<string, ConstInfo> $allConstInfos
      * @param array<string, string> &$declaredStrings Map of string content to
@@ -4407,6 +4425,7 @@ public function getLegacyVersion(): FileInfo {
     public static function parseStubFile(string $code): FileInfo {
         $parser = new PhpParser\Parser\Php7(new PhpParser\Lexer\Emulative());
         $nodeTraverser = new PhpParser\NodeTraverser;
+        $nodeTraverser->addVisitor(new PhpParser\NodeVisitor\CloningVisitor);
         $nodeTraverser->addVisitor(new PhpParser\NodeVisitor\NameResolver);
         $prettyPrinter = new class extends Standard {
             protected function pName_FullyQualified(Name\FullyQualified $node): string {
@@ -4415,7 +4434,7 @@ protected function pName_FullyQualified(Name\FullyQualified $node): string {
         };
 
         $stmts = $parser->parse($code);
-        $nodeTraverser->traverse($stmts);
+        $stmts = $nodeTraverser->traverse($stmts);
 
         $fileTags = DocCommentTag::parseDocComments(self::getFileDocComments($stmts));
         $fileInfo = new FileInfo($fileTags);