[pull] master from php:master

.github/workflows/test-suite.yml

@@ -166,7 +166,7 @@ jobs:
         with:
           configurationParameters: >-
             ${{ matrix.asan && 'CFLAGS="-fsanitize=undefined,address -DZEND_TRACK_ARENA_ALLOC" LDFLAGS="-fsanitize=undefined,address"' || '' }}
-            ${{ matrix.variation && 'CFLAGS="-DZEND_RC_DEBUG=1 -DPROFITABILITY_CHECKS=0 -DZEND_VERIFY_FUNC_INFO=1 -DZEND_VERIFY_TYPE_INFERENCE"' || '' }}
+            ${{ matrix.variation && 'CFLAGS="-DZEND_RC_DEBUG=1 -DPROFITABILITY_CHECKS=0 -DZEND_VERIFY_FUNC_INFO=1 -DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE"' || '' }}
             ${{ (matrix.variation && fromJson(inputs.branch).jobs.LINUX_X64.config.variation_enable_zend_max_execution_timers) && '--enable-zend-max-execution-timers' || '' }}
             --${{ matrix.debug && 'enable' || 'disable' }}-debug
             ${{ matrix.debug && 'CXXFLAGS="-D_GLIBCXX_ASSERTIONS"' || '' }}

NEWS

@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Sync Boost.Context assembly with 1.91.0. (kn1g78)
   . Fixed bug GH-22387 (AST pretty-printing drops meaningful parentheses around
     RHS of instanceof). (timwolla)
+  . Fixed bug GH-15672 and GH-15911 (Stack overflow when an internal function
+    recurses through zend_call_function, such as a self-attached SPL
+    iterator). (iliaal)
 
 - DBA:
   . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

Zend/zend_execute_API.c

@@ -861,6 +861,14 @@ zend_result zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_
 		}
 	}
 
+#ifdef ZEND_CHECK_STACK_LIMIT
+	if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {
+		zend_call_stack_size_error();
+		zend_release_fcall_info_cache(fci_cache);
+		return SUCCESS;
+	}
+#endif
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		func, fci->param_count, object_or_called_scope);
 	uint32_t consumed_args = fci->param_count ? fci->consumed_args : 0;

ext/opcache/tests/jit/gh22443.phpt

@@ -45,7 +45,7 @@ for ($k = 0; $k < 8; $k++) {
 $cold = [makeListener([$svc, 'coldMethod'])];
 
 $s = 0;
-for ($i = 0; $i < 4000000; $i++) {
+for ($i = 0; $i < 400; $i++) {
     $s += invokeListeners($warm, 'e', [$i & 7, ($i >> 2) & 7]);
 }
 for ($j = 0; $j < 5; $j++) {

ext/spl/tests/gh15672.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-15672 (MultipleIterator attached to itself overflows the C stack)
+--SKIPIF--
+<?php
+if (!function_exists('zend_test_zend_call_stack_get')) die("skip zend_test_zend_call_stack_get() is not available");
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--EXTENSIONS--
+zend_test
+--INI--
+memory_limit=2G
+zend.max_allowed_stack_size=512K
+--FILE--
+<?php
+$m = new MultipleIterator();
+$m->attachIterator(new ArrayIterator([1, 2, 3]), "1");
+$m->attachIterator($m, 3);
+foreach ($m as $key => $value) {
+}
+?>
+--EXPECTREGEX--
+.*Maximum call stack size of \d+ bytes.*Infinite recursion\?.*thrown in .* on line \d+

ext/spl/tests/gh15911.phpt

@@ -0,0 +1,21 @@
+--TEST--
+GH-15911 (AppendIterator appended to itself overflows the C stack)
+--SKIPIF--
+<?php
+if (!function_exists('zend_test_zend_call_stack_get')) die("skip zend_test_zend_call_stack_get() is not available");
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--EXTENSIONS--
+zend_test
+--INI--
+memory_limit=2G
+zend.max_allowed_stack_size=512K
+--FILE--
+<?php
+$it = new AppendIterator();
+$it->append($it);
+foreach ($it as $v) {
+}
+?>
+--EXPECTREGEX--
+.*Maximum call stack size of \d+ bytes.*Infinite recursion\?.*thrown in .* on line \d+