Merge branch 'PHP-8.6'

* PHP-8.6:
  Fix block pass dropping ZEND_FAST_CALL OP2 definition

Author: ndossche

Zend/Optimizer/block_pass.c

@@ -352,6 +352,18 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 				}
 				break;
 
+			case ZEND_FAST_CALL:
+				if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
+					/* OP2 holds the pending return value. A TMP normally has a single
+					 * consumer, but FAST_CALL reads does not consume it:
+					 * the RETURN behind it is the consumer, and
+					 * zend_dispatch_try_catch_finally_helper() destroys the value
+					 * through OP2 if the finally block throws. Propagating the source
+					 * into the RETURN therefore must not remove it. */
+					Tsource[VAR_NUM(opline->op2.var)] = NULL;
+				}
+				break;
+
 			case ZEND_SWITCH_LONG:
 			case ZEND_SWITCH_STRING:
 			case ZEND_MATCH:

ext/opcache/tests/opt/block_pass_fast_call_op2.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Block pass must not remove the source of the ZEND_FAST_CALL OP2 return value
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+function test_scalar() {
+    $x = 1;
+    try {
+        try {
+            return true ? 1.5 : 2.5;
+        } finally {
+            undef_fn();
+        }
+    } catch (Throwable $e) {
+        echo $e::class, ': ', $e->getMessage(), "\n";
+    }
+    return "fallback";
+}
+
+function test_refcounted() {
+    $x = 1;
+    try {
+        try {
+            return true ? "returned" : "other";
+        } finally {
+            undef_fn();
+        }
+    } catch (Throwable $e) {
+        echo $e::class, ': ', $e->getMessage(), "\n";
+    }
+    return "fallback";
+}
+
+var_dump(test_scalar());
+var_dump(test_refcounted());
+?>
+--EXPECT--
+Error: Call to undefined function undef_fn()
+string(8) "fallback"
+Error: Call to undefined function undef_fn()
+string(8) "fallback"