Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  NEWS
  Fix property hook escape analysis causing misoptimization
  Fix __isset escape analysis causing misoptimization

Author: ndossche

NEWS

@@ -87,7 +87,8 @@ PHP                                                                        NEWS
     proxy objects instead of forwarding to the real instance). (lisachenko)
   . Fixed bug GH-23679 (Tracing JIT writes a parent private property into a
     child's shadowing public property). (Ilia Alshanetsky)
-  . Fix incorrect DCE due to unsound escape analysis. (ndossche)
+  . Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,
+    arnaud-lb)
 
 - OpenSSL:
   . Fixed stream_socket_enable_crypto() leaving the socket non-blocking

Zend/Optimizer/escape_analysis.c

@@ -173,6 +173,8 @@ static bool is_allocation_def(zend_op_array *op_array, zend_ssa *ssa, int def, i
 				 && !ce->destructor
 				 && !ce->__get
 				 && !ce->__set
+				 && !ce->__isset
+				 && !ce->num_hooked_props
 				 && !(ce->ce_flags & forbidden_flags)
 				 && (ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
 					return 1;
@@ -242,6 +244,8 @@ static bool is_local_def(zend_op_array *op_array, zend_ssa *ssa, int def, int va
 				 && !ce->destructor
 				 && !ce->__get
 				 && !ce->__set
+				 && !ce->__isset
+				 && !ce->num_hooked_props
 				 && !ce->parent) {
 					return 1;
 				}

ext/opcache/tests/opt/dce_016.phpt

@@ -0,0 +1,50 @@
+--TEST--
+DCE must not remove assignments to properties of an object escaping through __isset
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.file_update_protection=0
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+
+class C {
+    public $x = 0;
+    function __isset($n) {
+        global $g;
+        $g = $this;
+        return true;
+    }
+}
+
+function f() {
+    $o = new C;
+    isset($o->foo);
+    $o->x = 42;
+}
+
+f();
+var_dump($g->x);
+
+#[AllowDynamicProperties]
+class F {
+    function __isset($n) {
+        $this->x = 2;
+        return true;
+    }
+}
+
+function i() {
+    $o = new F;
+    $o->x = 1;
+    isset($o->foo);
+    var_dump($o->x);
+}
+i();
+
+?>
+--EXPECT--
+int(42)
+int(2)

ext/opcache/tests/opt/dce_017.phpt

@@ -0,0 +1,55 @@
+--TEST--
+DCE must not remove assignments to properties of an object escaping through a property hook
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.file_update_protection=0
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+
+class D {
+    public $x = 0;
+    public $h {
+        get {
+            global $g;
+            $g = $this;
+            return 1;
+        }
+    }
+}
+
+function g() {
+    $o = new D;
+    $o->h;
+    $o->x = 42;
+}
+
+g();
+var_dump($g->x);
+
+class E {
+    public $x = 0;
+    public $h {
+        set {
+            global $g;
+            $g = $this;
+        }
+    }
+}
+
+function h() {
+    $o = new E;
+    $o->h = 1;
+    $o->x = 42;
+}
+
+h();
+var_dump($g->x);
+
+?>
+--EXPECT--
+int(42)
+int(42)