[pull] master from php:master

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler()
     triggers "Constant already defined" warning). (ilutov)
+  . Fixed bug GH-19476 (pipe operator fails to correctly handle returning
+    by reference). (alexandre-daubois)
 
 - ODBC:
   . Remove ODBCVER and assume ODBC 3.5. (Calvin Buckley)
@@ -15,6 +17,8 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois)
+  . Passing integers outside the interval [0, 255] to chr() is now deprecated.
+    (Girgias)
 
 14 Aug 2025, PHP 8.5.0beta1
 

UPGRADING

@@ -423,6 +423,9 @@ PHP 8.5 UPGRADE NOTES
     opened directory has been deprecated. Provide the last opened directory
     explicitly instead.
     RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_null_to_readdir_rewinddir_and_closedir
+  . Passing integers outside the interval [0, 255] to chr() is now deprecated.
+    This is because a byte can only hold a value within this interval.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_integers_outside_the_interval_0_255_to_chr
 
 - XML:
   . The xml_parser_free() function has been deprecated, as XMLParser objects

Zend/tests/pipe_operator_reference_context.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Fix GH-19476: Pipe operator with function returning by reference
+--FILE--
+<?php
+
+function &get_ref($_): string {
+    static $a = "original";
+
+    $a .= " ".$_;
+
+    return $a;
+}
+
+function &test_pipe_ref(): string {
+    return "input" |> get_ref(...);
+}
+
+$ref = &test_pipe_ref();
+echo "Before: " . $ref . "\n";
+$ref = "changed";
+echo "After: " . test_pipe_ref() . "\n";
+
+?>
+--EXPECT--
+Before: original input
+After: changed input

Zend/zend_compile.c

@@ -2726,7 +2726,8 @@ static inline bool zend_is_call(zend_ast *ast) /* {{{ */
 	return ast->kind == ZEND_AST_CALL
 		|| ast->kind == ZEND_AST_METHOD_CALL
 		|| ast->kind == ZEND_AST_NULLSAFE_METHOD_CALL
-		|| ast->kind == ZEND_AST_STATIC_CALL;
+		|| ast->kind == ZEND_AST_STATIC_CALL
+		|| ast->kind == ZEND_AST_PIPE;
 }
 /* }}} */
 
@@ -4146,17 +4147,19 @@ static zend_result zend_compile_func_defined(znode *result, zend_ast_list *args)
 }
 /* }}} */
 
-static zend_result zend_compile_func_chr(znode *result, zend_ast_list *args) /* {{{ */
+static zend_result zend_compile_func_chr(znode *result, const zend_ast_list *args) /* {{{ */
 {
-
-	if (args->children == 1 &&
-	    args->child[0]->kind == ZEND_AST_ZVAL &&
-	    Z_TYPE_P(zend_ast_get_zval(args->child[0])) == IS_LONG) {
-
-		zend_long c = Z_LVAL_P(zend_ast_get_zval(args->child[0])) & 0xff;
-
+	zval *zint;
+	if (
+		args->children == 1
+		&& args->child[0]->kind == ZEND_AST_ZVAL
+		&& (zint = zend_ast_get_zval(args->child[0]))
+		&& Z_TYPE_P(zint) == IS_LONG
+		&& Z_LVAL_P(zint) >= 0
+		&& Z_LVAL_P(zint) <= 255
+	) {
 		result->op_type = IS_CONST;
-		ZVAL_CHAR(&result->u.constant, c);
+		ZVAL_CHAR(&result->u.constant, Z_LVAL_P(zint));
 		return SUCCESS;
 	} else {
 		return FAILURE;

ext/gd/tests/gh16232.phpt

@@ -9,10 +9,10 @@ $bad_webp = __DIR__ . "/gh16232.webp";
 copy($good_webp, $bad_webp);
 var_dump(imagecreatefromwbmp($bad_webp));
 $data = file_get_contents($bad_webp);
-$data[3] = chr(-1);
+$data[3] = chr(255);
 file_put_contents($bad_webp, $data);
 var_dump(imagecreatefromwbmp($bad_webp));
-$data[3] = chr(1000);
+$data[3] = chr(232);
 file_put_contents($bad_webp, $data);
 var_dump(imagecreatefromwbmp($bad_webp));
 unlink($bad_webp);

ext/standard/string.c

@@ -2665,6 +2665,12 @@ PHP_FUNCTION(chr)
 		Z_PARAM_LONG(c)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (UNEXPECTED(c < 0 || c > 255)) {
+		php_error_docref(NULL, E_DEPRECATED,
+			"Providing a value not in-between 0 and 255 is deprecated,"
+			" this is because a byte value must be in the [0, 255] interval."
+			" The value used will be constrained using %% 256");
+	}
 	c &= 0xff;
 	RETURN_CHAR(c);
 }

ext/standard/tests/array/array_filter_variation9.phpt

@@ -8,7 +8,7 @@ Test array_filter() function : usage variations - built-in functions as 'callbac
 
 echo "*** Testing array_filter() : usage variations - built-in functions as 'callback' argument ***\n";
 
-$input = array(0, 1, -1, 10, 100, 1000);
+$input = array(0, 1, 10, 100);
 
 // using built-in function 'is_int' as 'callback'
 var_dump( array_filter($input, 'is_int') );
@@ -34,33 +34,25 @@ echo "Done"
 ?>
 --EXPECT--
 *** Testing array_filter() : usage variations - built-in functions as 'callback' argument ***
-array(6) {
+array(4) {
   [0]=>
   int(0)
   [1]=>
   int(1)
   [2]=>
-  int(-1)
-  [3]=>
   int(10)
-  [4]=>
+  [3]=>
   int(100)
-  [5]=>
-  int(1000)
 }
-array(6) {
+array(4) {
   [0]=>
   int(0)
   [1]=>
   int(1)
   [2]=>
-  int(-1)
-  [3]=>
   int(10)
-  [4]=>
+  [3]=>
   int(100)
-  [5]=>
-  int(1000)
 }
 array_filter(): Argument #2 ($callback) must be a valid callback or null, function "echo" not found or invalid function name
 array_filter(): Argument #2 ($callback) must be a valid callback or null, function "isset" not found or invalid function name

ext/standard/tests/strings/chr_out_of_range.phpt

@@ -0,0 +1,15 @@
+--TEST--
+chr() with out of range values
+--FILE--
+<?php
+
+var_dump("\xFF" == chr(-1));
+var_dump("\0" == chr(256));
+
+?>
+--EXPECTF--
+Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in %s on line 3
+bool(true)
+
+Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in %s on line 4
+bool(true)

ext/standard/tests/strings/chr_variation1.phpt

@@ -5,36 +5,17 @@ Test chr() function : usage variations - test values for $ascii argument
 
 echo "*** Testing chr() function: with unexpected inputs for 'ascii' argument ***\n";
 
-//defining a class
-class sample  {
-  public function __toString() {
-    return "sample object";
-  }
-}
-
-//getting the resource
-$file_handle = fopen(__FILE__, "r");
-
 // array with different values for $input
-$inputs =  array (
-
-          // integer values
-/*1*/	  0,
-          1,
-          255,
-          256,
-
-          // float values
-/*5*/	  10.5,
-          -20.5,
-          1.1234e6,
-
-          // boolean values
-/*11*/	  true,
-          false,
-          TRUE,
-          FALSE,
-);
+$inputs = [
+	0,
+	1,
+	255,
+	// float values
+	10.5,
+	// bool values
+	true,
+	false,
+];
 
 // loop through with each element of the $inputs array to test chr() function
 $count = 1;
@@ -44,8 +25,6 @@ foreach($inputs as $input) {
   $count ++;
 }
 
-fclose($file_handle);  //closing the file handle
-
 ?>
 --EXPECTF--
 *** Testing chr() function: with unexpected inputs for 'ascii' argument ***
@@ -56,22 +35,10 @@ string(2) "01"
 -- Iteration 3 --
 string(2) "ff"
 -- Iteration 4 --
-string(2) "00"
--- Iteration 5 --
 
 Deprecated: Implicit conversion from float 10.5 to int loses precision in %s on line %d
 string(2) "0a"
--- Iteration 6 --
-
-Deprecated: Implicit conversion from float -20.5 to int loses precision in %s on line %d
-string(2) "ec"
--- Iteration 7 --
-string(2) "48"
--- Iteration 8 --
-string(2) "01"
--- Iteration 9 --
-string(2) "00"
--- Iteration 10 --
+-- Iteration 5 --
 string(2) "01"
--- Iteration 11 --
+-- Iteration 6 --
 string(2) "00"