From 11ce662101fedc9b4617672963ce5e31a7ec0309 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com>
Date: Mon, 29 Sep 2025 22:36:15 +0200
Subject: [PATCH 1/2] lexbor: Cherry pick "Core: Reset length in
 lexbor_str_destroy()"

see lexbor/lexbor@1bc9944a19e837a38f5e47462d3e5abf2caa9387

Fixes php/php-src#19979
---
 NEWS                         |  5 ++++-
 ext/lexbor/lexbor/core/str.c |  1 +
 ext/uri/tests/gh19979.phpt   | 28 ++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 ext/uri/tests/gh19979.phpt

diff --git a/NEWS b/NEWS
index a6749b8ed40..51c3a3df7ef 100644
--- a/NEWS
+++ b/NEWS
@@ -6,7 +6,10 @@ PHP                                                                        NEWS
   . Fixed segfault in function JIT due to NAN to bool warning. (Girgias)
 
 - URI:
-  . Fixed Uri\WhatWg\Url::withPort() when an invalid value is passed. (timwolla)
+  . Fixed Uri\WhatWg\Url::withPort() when an invalid value is passed.
+    (timwolla)
+  . Fixed Uri\WhatWg\Url::parse() when resolving a relative URL
+    against a base URL with query or fragment. (timwolla)
 
 - SOAP:
   . Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en).
diff --git a/ext/lexbor/lexbor/core/str.c b/ext/lexbor/lexbor/core/str.c
index d11a08614dd..bf8fc547d88 100644
--- a/ext/lexbor/lexbor/core/str.c
+++ b/ext/lexbor/lexbor/core/str.c
@@ -80,6 +80,7 @@ lexbor_str_destroy(lexbor_str_t *str, lexbor_mraw_t *mraw, bool destroy_obj)
     }
 
     if (str->data != NULL) {
+        lexbor_str_clean(str);
         str->data = lexbor_mraw_free(mraw, str->data);
     }
 
diff --git a/ext/uri/tests/gh19979.phpt b/ext/uri/tests/gh19979.phpt
new file mode 100644
index 00000000000..982dfb93594
--- /dev/null
+++ b/ext/uri/tests/gh19979.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GH-19979: Zend/zend_string.h:191:24: runtime error: null pointer passed as argument 2, which is declared to never be null
+--FILE--
+<?php
+
+$baseUrl = \Uri\WhatWg\Url::parse('https://example.com/path?query');
+var_dump(\Uri\WhatWg\Url::parse('relative', $baseUrl));
+
+?>
+--EXPECTF--
+object(Uri\WhatWg\Url)#%d (8) {
+  ["scheme"]=>
+  string(5) "https"
+  ["username"]=>
+  NULL
+  ["password"]=>
+  NULL
+  ["host"]=>
+  string(11) "example.com"
+  ["port"]=>
+  NULL
+  ["path"]=>
+  string(9) "/relative"
+  ["query"]=>
+  NULL
+  ["fragment"]=>
+  NULL
+}

From c997212dbfa53947650304f2a86233325c6c66bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com>
Date: Mon, 29 Sep 2025 22:44:39 +0200
Subject: [PATCH 2/2] NEWS: Fix section order

---
 NEWS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index 51c3a3df7ef..c21d7801b3f 100644
--- a/NEWS
+++ b/NEWS
@@ -5,16 +5,16 @@ PHP                                                                        NEWS
 - Opcache
   . Fixed segfault in function JIT due to NAN to bool warning. (Girgias)
 
+- SOAP:
+  . Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en).
+    (nielsdos, KaseyJenkins)
+
 - URI:
   . Fixed Uri\WhatWg\Url::withPort() when an invalid value is passed.
     (timwolla)
   . Fixed Uri\WhatWg\Url::parse() when resolving a relative URL
     against a base URL with query or fragment. (timwolla)
 
-- SOAP:
-  . Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en).
-    (nielsdos, KaseyJenkins)
-
 25 Sep 2025, PHP 8.5.0RC1
 
 - Core: