Merge branch 'PHP-8.6'

# Conflicts:
#	NEWS

Author: jorgsowa

Zend/Optimizer/zend_inference.c

@@ -2227,6 +2227,9 @@ static uint32_t assign_dim_array_result_type(
 			if (dim_type & (MAY_BE_UNDEF|MAY_BE_NULL)) {
 				tmp |= MAY_BE_ARRAY_KEY_STRING;
 			}
+			if ((tmp & MAY_BE_ARRAY_KEY_STRING) && MAY_BE_PACKED(arr_type)) {
+				tmp |= MAY_BE_ARRAY_NUMERIC_HASH;
+			}
 		}
 	}
 	/* Only add value type if we have a key type. It might be that the key type is illegal
@@ -3622,6 +3625,9 @@ static zend_always_inline zend_result _zend_update_type_info(
 						if (t2 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
 							key_type |= MAY_BE_ARRAY_KEY_STRING;
 						}
+						if ((key_type & MAY_BE_ARRAY_KEY_STRING) && MAY_BE_PACKED(t1)) {
+							key_type |= MAY_BE_ARRAY_NUMERIC_HASH;
+						}
 					}
 				} else if (opline->opcode == ZEND_FETCH_DIM_UNSET) {
 					if (t1 & MAY_BE_ARRAY) {

ext/opcache/tests/jit/assign_dim_packed_string_key_001.phpt

@@ -0,0 +1,31 @@
+--TEST--
+JIT: string key write turns a packed array into a hash with integer keys (function JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=function
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function f() {
+    $arr = [10, 11];
+    for ($i = 2; $i >= 0; $i--) {
+        $arr['b'] = true;
+        echo $i, ":\n";
+        var_dump($arr[$i]);
+    }
+}
+f();
+?>
+--EXPECTF--
+2:
+
+Warning: Undefined array key 2 in %s on line %d
+NULL
+1:
+int(11)
+0:
+int(10)

ext/opcache/tests/jit/assign_dim_packed_string_key_002.phpt

@@ -0,0 +1,22 @@
+--TEST--
+JIT: compound string key assignment turns a packed array into a hash with integer keys
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=function
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function f() {
+    $arr = [1, 2, 3];
+    $arr["a"] += 1;
+    var_dump($arr[1]);
+}
+f();
+?>
+--EXPECTF--
+Warning: Undefined array key "a" in %s on line %d
+int(2)

ext/opcache/tests/jit/assign_dim_packed_string_key_003.phpt

@@ -0,0 +1,29 @@
+--TEST--
+JIT: nested string key write turns a packed array into a hash with integer keys (tracing JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function f($c) {
+    $arr = [0 => 'x', 5 => 'y'];
+    $arr['a'][32] = 1;
+    $r = 0;
+    for ($i = 0; $i < 100; $i++) {
+        $r += isset($arr[0][$c]);
+    }
+    var_dump($r);
+}
+for ($k = 0; $k < 3; $k++) {
+    f(0);
+}
+?>
+--EXPECT--
+int(100)
+int(100)
+int(100)