Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  Fix GH-23626: OPcache: orphaned temporaries cause leaks and assertions

Author: ndossche

NEWS

@@ -86,6 +86,8 @@ PHP                                                                        NEWS
     static calls in trait methods shared by several classes). (jorgsowa,
     mgoulart)
   . Fix block pass dropping ZEND_FAST_CALL OP2 definition. (Mrmaxmeier)
+  . Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).
+    (ndossche, khaledalam)
 
 - OpenSSL:
   . Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite

Zend/zend_compile.c

@@ -7302,10 +7302,9 @@ static void zend_compile_match(znode *result, zend_ast *ast)
 		if (opline->op1_type == IS_CONST) {
 			Z_TRY_ADDREF_P(CT_CONSTANT(opline->op1));
 		}
-		if (arms->children == 0) {
-			/* Mark this as an "expression throw" for opcache. */
-			opline->extended_value = ZEND_THROW_IS_EXPR;
-		}
+		/* Mark this as an "expression throw" for opcache.
+		 * Even if there are arms, they may become unreachable after optimization, which loses live ranges. */
+		opline->extended_value = ZEND_THROW_IS_EXPR;
 	}
 
 	for (uint32_t i = 0; i < arms->children; ++i) {

ext/opcache/tests/gh23626.phpt

@@ -0,0 +1,59 @@
+--TEST--
+GH-23626: OPcache: orphaned temporaries cause leaks and assertions
+--CREDITS--
+Mrmaxmeier
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+class D {
+    public function __construct(public string $name) {}
+    public function __clone() { $this->name .= '-clone'; }
+    public function __destruct() { echo "destruct {$this->name}\n"; }
+}
+
+function test_assert($u) {
+    (function () use ($u) {}) ** match (1) { 2 => 3 };
+}
+
+function one($o) {
+    (clone $o) ** match (1) { 2 => 3 };
+}
+
+function two($a, $b) {
+    (clone $a) ** ((clone $b) ** match (1) { 2 => 3 });
+}
+
+function rope($o) {
+    return "x{$o->name}y" . match (1) { 2 => 3 };
+}
+
+$a = new D('a');
+$b = new D('b');
+
+foreach (['test_assert' => [1], 'one' => [$a], 'two' => [$a, $b], 'rope' => [$a]] as $fn => $args) {
+    try {
+        $fn(...$args);
+    } catch (\UnhandledMatchError $e) {
+        echo "$fn: ", $e->getMessage(), "\n";
+    }
+}
+
+unset($a, $b, $args, $e);
+echo "done\n";
+?>
+--EXPECT--
+test_assert: Unhandled match case 1
+destruct a-clone
+one: Unhandled match case 1
+destruct a-clone
+destruct b-clone
+two: Unhandled match case 1
+rope: Unhandled match case 1
+destruct b
+destruct a
+done