Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  ext/opcache: Clear vacated MERGE inputs before conversion to BEGIN

Author: iliaal

NEWS

@@ -74,6 +74,8 @@ PHP                                                                        NEWS
     cannot describe a parameter). (Ilia Alshanetsky)
 
 - Opcache:
+  . Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
+    (Ilia Alshanetsky)
   . Fixed tracing JIT returning a wrapped integer instead of a float on
     integer overflow after an integer was compared with a float or
     numeric-string literal. (Ilia Alshanetsky)

ext/opcache/jit/zend_jit_ir.c

@@ -3696,6 +3696,11 @@ static void _zend_jit_fix_merges(zend_jit_ctx *jit)
 				if (k != n) {
 					ir_ref n2, k2;
 
+					/* BEGIN reads op2 as a label, so clear the vacated inputs */
+					while (r != q) {
+						*r = IR_UNUSED;
+						r++;
+					}
 					if (k <= 1) {
 						insn->op = IR_BEGIN;
 						insn->inputs_count = 0;

ext/opcache/tests/jit/gh24397.phpt

@@ -0,0 +1,23 @@
+--TEST--
+GH-24397 (JIT: stale label operand on a MERGE reduced to BEGIN)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=function
+opcache.jit_debug=0x1000000
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function f() {
+    foreach ([1, 2] as $v) {
+        $c[] = $v;
+    }
+}
+f();
+echo "Done\n";
+?>
+--EXPECTF--
+%ADone