Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  Fix GH-24391: JIT: switch on constant null takes default instead of case 0

Author: ndossche

NEWS

@@ -61,6 +61,8 @@ PHP                                                                        NEWS
   . Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
   . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
     exits). (Lazizbek Ergashev)
+  . Fixed bug GH-24391 (JIT switch on constant null takes default instead of
+    case 0). (ndossche)
 
 - PDO:
   . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a

ext/opcache/jit/zend_jit_ir.c

@@ -16301,15 +16301,22 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 	if (opline->op1_type == IS_CONST) {
 		zval *zv = RT_CONSTANT(opline, opline->op1);
 		zval *jump_zv = NULL;
+		const zend_op *target;
 		int b;
 
+		/* Wrong type for SWITCH_LONG/SWITCH_STRING falls back to the ZEND_CASE chain */
+		target = ZEND_OFFSET_TO_OPLINE(opline, opline->extended_value);
 		if (opline->opcode == ZEND_SWITCH_LONG) {
 			if (Z_TYPE_P(zv) == IS_LONG) {
 				jump_zv = zend_hash_index_find(jumptable, Z_LVAL_P(zv));
+			} else {
+				target = opline + 1;
 			}
 		} else if (opline->opcode == ZEND_SWITCH_STRING) {
 			if (Z_TYPE_P(zv) == IS_STRING) {
 				jump_zv = zend_hash_find_known_hash(jumptable, Z_STR_P(zv));
+			} else {
+				target = opline + 1;
 			}
 		} else if (opline->opcode == ZEND_MATCH) {
 			if (Z_TYPE_P(zv) == IS_LONG) {
@@ -16320,21 +16327,13 @@ static int zend_jit_switch(zend_jit_ctx *jit, const zend_op *opline, const zend_
 		} else {
 			ZEND_UNREACHABLE();
 		}
+		if (jump_zv != NULL) {
+			target = ZEND_OFFSET_TO_OPLINE(opline, Z_LVAL_P(jump_zv));
+		}
 		if (next_opline) {
-			const zend_op *target;
-
-			if (jump_zv != NULL) {
-				target = ZEND_OFFSET_TO_OPLINE(opline, Z_LVAL_P(jump_zv));
-			} else {
-				target = ZEND_OFFSET_TO_OPLINE(opline, opline->extended_value);
-			}
 			ZEND_ASSERT(target == next_opline);
 		} else {
-			if (jump_zv != NULL) {
-				b = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE(opline, Z_LVAL_P(jump_zv)) - op_array->opcodes];
-			} else {
-				b = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE(opline, opline->extended_value) - op_array->opcodes];
-			}
+			b = ssa->cfg.map[target - op_array->opcodes];
 			_zend_jit_add_predecessor_ref(jit, b, jit->b, ir_END());
 			jit->b = -1;
 		}

ext/opcache/tests/jit/gh24391.phpt

@@ -0,0 +1,37 @@
+--TEST--
+GH-24391 (JIT: switch on constant of wrong type takes default instead of falling back to the case chain)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=function
+opcache.optimization_level=0
+--FILE--
+<?php
+function long_switch() {
+    switch (null) {
+        case 0: return 1;
+        case 1: return 2;
+        case 2: return 3;
+        case 3: return 4;
+        case 4: return 5;
+        default: return 6;
+    }
+}
+
+function string_switch() {
+    switch (0) {
+        case "aa": return 1;
+        case "bb": return 2;
+        case "cc": return 3;
+        default: return 6;
+    }
+}
+
+var_dump(long_switch());
+var_dump(string_switch());
+?>
+--EXPECT--
+int(1)
+int(6)