update NEWS

Revert "fixed bug #50989 (DOM support for LIBXML_NOXMLDECL)"
This reverts commit 2fcf1259c6.
2026-11-13 20:20:50 +00:00 · 2017-02-01 20:23:05 +01:00 · 2017-02-01 20:22:43 +01:00 · 2017-02-01 20:22:40 +01:00 · 2017-02-01 12:02:20 +01:00 · 2017-01-31 14:28:33 +01:00
1387 changed files with 44038 additions and 19829 deletions
@@ -0,0 +1,57 @@
+
+version: "{branch}.build.{build}"
+
+image: Visual Studio 2015
+
+branches:
+        except:
+                - PHP-5.6
+                - PHP-7.0
+
+skip_commits:
+        files:
+                - NEWS
+                - UPGRADING*
+                - README.*
+
+clone_depth: 64
+
+cache:
+        - c:\build-cache
+        - c:\build-cache\sdk -> .appveyor.yml
+
+environment:
+        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
+        PHP_BUILD_OBJ_DIR: c:\obj
+        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.0beta1
+        # ext and env setup for tests
+        #MYSQL_TEST_PASSWD: Password12!
+        #MYSQL_TEST_USER: root
+        #PDO_MYSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=root password=Password12!"
+        #PDO_MYSQL_TEST_USER: root
+        #PDO_MYSQL_TEST_PASS: Password12!
+        #PGSQL_TEST_CONNSTR: "host=127.0.0.1 dbname=test port=5432 user=postgres password=Password12!"
+        #PDO_PGSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=postgres password=Password12!"
+        #build permutations
+        matrix:
+                - THREAD_SAFE: 0
+                  OPCACHE: 0
+                - THREAD_SAFE: 1
+                  OPCACHE: 1
+
+services:
+        # the setup scripts have to be touched, once some other db version is used
+        - mysql
+        - postgresql95
+
+platform:
+        - x64
+          #        - x86
+
+build_script:
+        - appveyor\build.bat
+
+test_script:
+        - appveyor\test.bat
+
@@ -0,0 +1,16 @@
+; http://editorconfig.org/
+
+root = true
+
+[*.{c,h}]
+charset                  = UTF-8
+end_of_line              = LF
+indent_size              = 4
+indent_style             = tab
+insert_final_newline     = true
+tab_width                = 4
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size              = 2
+indent_style             = space
@@ -29,22 +29,33 @@ document ____executor_globals
 end

 define print_cvs
-	____executor_globals
-	set $p = $eg.current_execute_data.CVs
-	set $c = $eg.current_execute_data.op_array.last_var
-	set $v = $eg.current_execute_data.op_array.vars
-	set $i = 0
-
-	printf "Compiled variables count: %d\n", $c
-	while $i < $c
-		printf "%d = %s\n", $i, $v[$i].name
-		if $p[$i] != 0
-			printzv *$p[$i]
-		else
-			printf "*uninitialized*\n"
-		end
-		set $i = $i + 1
+	if $argc == 0
+		____executor_globals
+		set $cv_ex_ptr = $eg.current_execute_data
+	else
+		set $cv_ex_ptr = (zend_execute_data *)$arg0
 	end
+	set $cv_count = $cv_ex_ptr.func.op_array.last_var
+	set $cv = $cv_ex_ptr.func.op_array.vars
+	set $cv_idx = 0
+	set $callFrameSize = (sizeof(zend_execute_data) + sizeof(zval) - 1) / sizeof(zval)
+
+	printf "Compiled variables count: %d\n\n", $cv_count
+	while $cv_idx < $cv_count
+		printf "[%d] '%s'\n", $cv_idx, $cv[$cv_idx].val
+		set $zvalue = ((zval *) $cv_ex_ptr) + $callFrameSize + $cv_idx
+		printzv $zvalue
+		set $cv_idx = $cv_idx + 1
+	end
+end
+
+document print_cvs
+	Prints the compiled variables and their values.
+	If a zend_execute_data pointer is set this will print the compiled
+	variables of that scope. If no parameter is used it will use
+	current_execute_data for scope.
+
+	usage: print_cvs [zend_execute_data *]
 end

 define dump_bt
@@ -196,12 +207,17 @@ define ____printzv_contents
 		____executor_globals
 		set $handle = $zvalue->value.obj.handle
 		set $handlers = $zvalue->value.obj.handlers
-        set $zobj = $zvalue->value.obj
-        set $cname = $zobj->ce->name->val
+		set $zobj = $zvalue->value.obj
+		set $cname = $zobj->ce->name->val
 		printf "(%s) #%d", $cname, $handle
 		if ! $arg1
 			if $handlers->get_properties == &zend_std_get_properties
-				set $ht = $zobj->properties
+				if $zobj->properties
+					set $ht = $zobj->properties
+				else
+					set $ht = &$zobj->ce->properties_info
+				end
+				printf "\nProperties "
 				if $ht
 					set $ind = $ind + 1
 					____print_ht $ht 1
@@ -212,7 +228,7 @@ define ____printzv_contents
 						set $i = $i - 1
 					end
 				else
-					echo "no properties found"
+					echo "not found"
 				end
 			end
 		end
@@ -455,9 +471,9 @@ define print_inh
 end

 define print_pi
-	set $pi = $arg0
+	set $pi = (zend_property_info *)$arg0
 	printf "[%p] {\n", $pi
-	printf "    h     = %lu\n", $pi->h
+	printf "    ce = [%p] %s\n", $pi->ce, $pi->ce->name->val
 	printf "    flags = %d (", $pi->flags
 	if $pi->flags & 0x100
 		printf "ZEND_ACC_PUBLIC"
@@ -476,16 +492,27 @@ define print_pi
 	end
 	printf ")\n"
 	printf "    name  = "
-	____print_str $pi->name $pi->name_length
-	printf "\n}\n"
+	print_zstr $pi->name
+	printf "}\n"
+end
+
+document print_pi
+	Takes a pointer to an object's property and prints the property information
+	usage: print_pi <ptr>
 end

 define ____print_str
 	set $tmp = 0
 	set $str = $arg0
+	if $argc > 2
+		set $maxlen = $arg2
+	else
+		set $maxlen = 256
+	end
+
 	printf "\""
-	while $tmp < $arg1 && $tmp < 256
-		if $str[$tmp] > 32 && $str[$tmp] < 127
+	while $tmp < $arg1 && $tmp < $maxlen
+		if $str[$tmp] > 31 && $str[$tmp] < 127
 			printf "%c", $str[$tmp]
 		else
 			printf "\\%o", $str[$tmp]
@@ -554,6 +581,23 @@ document printzops
 	dump operands of the current opline
 end

+define print_zstr
+	set $zstr = (zend_string *)$arg0
+	if $argc == 2
+		set $maxlen = $arg1
+	else
+		set $maxlen = $zstr->len
+	end
+	printf "string(%d) ", $zstr->len
+	____print_str $zstr->val $zstr->len $maxlen
+	printf "\n"
+end
+
+document print_zstr
+	print the length and contents of a zend string
+	usage: print_zstr <ptr> [max length]
+end
+
 define zbacktrace
 	____executor_globals
 	dump_bt $eg.current_execute_data
@@ -566,79 +610,6 @@ document zbacktrace
 	> (gdb) dump_bt $eg.current_execute_data
 end

-define zmemcheck
-	set $p = alloc_globals.head
-	set $stat = "?"
-	set $total_size = 0
-	if $arg0 != 0
-		set $not_found = 1
-	else
-		set $not_found = 0
-	end
-	printf " block      size      status file:line\n"
-	printf "-------------------------------------------------------------------------------\n"
-	while $p
-		set $aptr = $p + sizeof(struct _zend_mem_header) + sizeof(align_test)
-		if $arg0 == 0 || (void *)$aptr == (void *)$arg0
-			if $p->magic == 0x7312f8dc 
-				set $stat = "OK"
-			end
-			if $p->magic == 0x99954317
-				set $stat = "FREED"
-			end
-			if $p->magic == 0xfb8277dc
-				set $stat = "CACHED"
-			end
-			set $filename = strrchr($p->filename->val, '/')
-			if !$filename
-				set $filename = $p->filename->val
-			else
-				set $filename = $filename + 1
-			end
-			printf " %p ", $aptr
-			if $p->size == sizeof(struct _zval_struct) && ((struct _zval_struct *)$aptr)->type >= 0 && ((struct _zval_struct *)$aptr)->type < 10
-				printf "ZVAL?(%-2d) ", $p->size
-			else
-				printf "%-9d ", $p->size
-			end
-			set $total_size = $total_size + $p->size
-			printf "%-06s %s:%d", $stat, $filename, $p->lineno
-			if $p->orig_filename
-				set $orig_filename = strrchr($p->orig_filename, '/')
-				if !$orig_filename
-					set $orig_filename = $p->orig_filename
-				else
-					set $orig_filename = $orig_filename + 1
-				end
-				printf " <= %s:%d\n", $orig_filename, $p->orig_lineno
-			else
-				printf "\n"
-			end
-			if $arg0 != 0
-				set $p = 0
-				set $not_found = 0
-			else
-				set $p = $p->pNext
-			end
-		else
-			set $p = $p->pNext
-		end
-	end
-	if $not_found
-		printf "no such block that begins at %p.\n", $aptr
-	end
-	if $arg0 == 0
-		printf "-------------------------------------------------------------------------------\n"
-		printf "     total: %d bytes\n", $total_size
-	end
-end
-
-document zmemcheck
-	show status of a memory block.
-	usage: zmemcheck [ptr].
-	if ptr is 0, all blocks will be listed.
-end
-
 define lookup_root
 	set $found = 0
 	if gc_globals->roots
@@ -148,6 +148,7 @@ tests/*/*/*.sh
 */tests/*/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
+*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log
@@ -108,8 +108,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Unknown
-MAINTENANCE:         Odd fixes
+PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
+MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -286,7 +286,7 @@ MAINTENANCE:         Odd fixes
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           gd
-PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>
+PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>, Christoph M. Becker <cmb@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -1,6 +1,6 @@
 -------------------------------------------------------------------- 
                  The PHP License, version 3.01
-Copyright (c) 1999 - 2016 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2017 The PHP Group. All rights reserved.
 -------------------------------------------------------------------- 

 Redistribution and use in source and binary forms, with or without
@@ -1,5 +1,436 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+02 Feb 2017 PHP 7.0.16RC1
+
+- Core:
+  . Fixed bug #73916 (zend_print_flat_zval_r doesn't consider reference).
+    (Laruence)
+  . Fixed bug #73876 (Crash when exporting **= in expansion of assign op).
+    (Sara)
+  . Fixed bug #73969 (segfault in debug_print_backtrace). (andrewnester)
+  . Fixed bug #73973 (assertion error in debug_zval_dump). (andrewnester)
+
+- DOM:
+  . Fixed bug #54382 (getAttributeNodeNS doesn't get xmlns* attributes).
+    (aboks)
+
+- DTrace:
+  . Fixed bug #73965 (DTrace reported as enabled when disabled). (Remi)
+
+- FPM:
+  . Fixed bug #67583 (double fastcgi_end_request on max_children limit).
+    (Dmitry Saprykin)
+  . Fixed bug #69865 (php-fpm does not close stderr when using syslog). 
+    (m6w6)
+
+- GD:
+  . Fixed bug #73968 (Premature failing of XBM reading). (cmb)
+
+- GMP:
+  . Fixed bug #69993 (test for gmp.h needs to test machine includes).
+    (Jordan Gigov) 
+
+- Intl:
+  . Fix bug #73956 (Link use CC instead of CXX). (Remi)
+
+- LDAP:
+  . Fixed bug #73933 (error/segfault with ldap_mod_replace and opcache).
+    (Laruence)
+
+- MySQLi:
+  . Fixed bug #73949 (leak in mysqli_fetch_object). (krakjoe)
+
+- Mysqlnd:
+  . Fixed bug #69899 (segfault on close() after free_result() with mysqlnd).
+    (Richard Fussenegger)
+
+- Opcache:
+  . Fixed bug #73983 (crash on finish work with phar in cli + opcache).
+    (Anatol)
+
+- OpenSSL:
+  . Fixed bug #71519 (add serial hex to return value array). (xrobau)
+
+- PDO_Firebird:
+  . Implemented FR #72583 (All data are fetched as strings). (Dorin Marcoci)
+
+- PDO_PgSQL:
+  . Fixed bug #73959 (lastInsertId fails to throw an exception for wrong 
+    sequence name). (andrewnester)
+
+- Phar:
+  . Fixed bug #70417 (PharData::compress() doesn't close temp file). (cmb)
+
+- posix:
+  . Fixed bug #71219 (configure script incorrectly checks for ttyname_r). (atoth)
+
+- Session:
+  . Fixed bug #69582 (session not readable by root in CLI). (EvgeniySpinov)
+
+- SPL:
+  . Fixed bug #73896 (spl_autoload() crashes when calls magic _call()). (Dmitry)
+
+- Standard:
+  . Fixed bug #69442 (closing of fd incorrect when PTS enabled). (jaytaph)
+  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
+    "Transfer-Encoding: chunked"). (Rowan Collins)
+  . Fixed bug #72974 (imap is undefined service on AIX). (matthieu.sarter)
+  . Fixed bug #72979 (money_format stores wrong length AIX). (matthieu.sarter)
+
+- ZIP:
+  . Fixed bug #70103 (ZipArchive::addGlob ignores remove_all_path option). (cmb,
+    Mitch Hagstrand)
+
+19 Jan 2017 PHP 7.0.15
+
+- Core:
+  . Fixed bug #73792 (invalid foreach loop hangs script). (Dmitry)
+  . Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created
+    with list()). (Laruence)
+  . Fixed bug #73585 (Logging of "Internal Zend error - Missing class
+    information" missing class name). (Laruence)
+  . Fixed bug #73753 (unserialized array pointer not advancing). (David Walker)
+  . Fixed bug #73825 (Heap out of bounds read on unserialize in
+    finish_nested_data()). (Stas)
+  . Fixed bug #73831 (NULL Pointer Dereference while unserialize php object).
+    (Stas)
+  . Fixed bug #73832 (Use of uninitialized memory in unserialize()). (Stas)
+  . Fixed bug #73092 (Unserialize use-after-free when resizing object's
+    properties hash table). (Nikita)
+  . Fixed bug #69425 (Use After Free in unserialize()). (Nikita)
+  . Fixed bug #72731 (Type Confusion in Object Deserialization). (Nikita)
+
+- COM:
+  . Fixed bug #73679 (DOTNET read access violation using invalid codepage).
+    (Anatol)
+
+- DOM:
+  . Fixed bug #67474 (getElementsByTagNameNS filter on default ns). (aboks)
+
+- EXIF:
+  . Bug bug #73737 (FPE when parsing a tag format). (Stas)
+
+- GD:
+  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
+  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
+
+- GMP:
+  . Fixed bug #70513 (GMP Deserialization Type Confusion Vulnerability).
+    (Nikita)
+
+- Mysqli:
+  . Fixed bug #73462 (Persistent connections don't set $connect_errno).
+    (darkain)
+
+- Mysqlnd:
+  . Fixed issue with decoding BIT columns when having more than one rows in the
+    result set. 7.0+ problem. (Andrey)
+  . Fixed bug #73800 (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE). 
+	(vanviegen)
+
+- PCRE:
+  . Fixed bug #73612 (preg_*() may leak memory). (cmb)
+
+- PDO_Firebird:
+  . Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning
+    statement). (Dorin Marcoci)
+
+- Phar:
+  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
+  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
+  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
+
+- Phpdbg:
+  . Fixed bug #73615 (phpdbg without option never load .phpdbginit at startup).
+    (Bob)
+  . Fixed issue getting executable lines from custom wrappers. (Bob)
+  . Fixed bug #73704 (phpdbg shows the wrong line in files with shebang). (Bob)
+
+- Reflection:
+  . Fixed bug #46103 (ReflectionObject memory leak). (Nikita)
+
+- Streams:
+  . Fixed bug #73586 (php_user_filter::$stream is not set to the stream the
+    filter is working on). (Dmitry)
+
+- SQLite3:
+  . Reverted fix for bug #73530	(Unsetting result set may reset other result
+    set). (cmb)
+
+- Standard:
+  . Fixed bug #73594 (dns_get_record does not populate $additional out
+    parameter). (Bruce Weirdan)
+  . Fixed bug #70213 (Unserialize context shared on double class lookup).
+    (Taoguang Chen)
+  . Fixed bug #73154 (serialize object with __sleep function crash). (Nikita)
+  . Fixed bug #70490 (get_browser function is very slow). (Nikita)
+  . Fixed bug #73265 (Loading browscap.ini at startup causes high memory usage).
+    (Nikita)
+  . Fixed bug #31875 (get_defined_functions additional param to exclude
+	disabled functions). (willianveiga)
+
+- Zlib:
+  . Fixed bug #73373 (deflate_add does not verify that output was not truncated).
+    (Matt Bonneau)
+
+08 Dec 2016 PHP 7.0.14
+
+- Core:
+  . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre)
+  . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli
+    / PDO). (Dmitry)
+
+- Calendar:
+  . Fix integer overflows (Joshua Rogers)
+
+- Date:
+  . Fixed bug #69587 (DateInterval properties and isset). (jhdxr)
+
+- DTrace:
+  . Disabled PHP call tracing by default (it makes significant overhead).
+    This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
+    (Dmitry)
+
+- JSON:
+  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
+- ODBC:
+  . Fixed bug #73448 (odbc_errormsg returns trash, always 513 bytes).
+    (Anatol)
+
+- Opcache:
+  . Fixed bug #69090 (check cached files permissions). (dmitry)
+  . Fixed bug #73546 (Logging for opcache has an empty file name). (mhagstrand)
+
+- PCRE:
+  . Fixed bug #73483 (Segmentation fault on pcre_replace_callback). (Laruence)
+  . Fixed bug #73392 (A use-after-free in zend allocator management). 
+    (Laruence)
+
+- PDO_Firebird:
+  . Fixed bug #73087, #61183, #71494 (Memory corruption in bindParam).
+    (Dorin Marcoci)
+
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- Phar:
+  . Fixed bug #73580 (Phar::isValidPharFilename illegal memory access). (Stas)
+
+- Soap:
+  . Fixed bug #73538 (SoapClient::__setSoapHeaders doesn't overwrite SOAP
+    headers). (duncan3dc)
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
+- SPL:
+  . Fixed bug #73423 (Reproducible crash with GDB backtrace). (Laruence)
+
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+  . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+    (rowan dot collins at gmail dot com)
+  . Fixed bug #73645 (version_compare illegal write access). (Stas)
+
+- Wddx:
+  . Fixed bug #73631 (Invalid read when wddx decodes empty boolean element).
+  (Stas)
+
+- XML:
+  . Fixed bug #72135 (malformed XML causes fault) (edgarsandi)
+
+10 Nov 2016 PHP 7.0.13
+
+- Core:
+  . Fixed bug #73350 (Exception::__toString() cause circular references).
+    (Laruence)
+  . Fixed bug #73181 (parse_str() without a second argument leads to crash).
+    (Nikita)
+  . Fixed bug #66773 (Autoload with Opcache allows importing conflicting class
+    name to namespace). (Nikita)
+  . Fixed bug #66862 ((Sub-)Namespaces unexpected behaviour). (Nikita)
+  . Fix pthreads detection when cross-compiling (ffontaine)
+  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
+    operation). (Dmitry)
+  . Fixed bug #73338 (Exception thrown from error handler causes valgrind
+    warnings (and crashes)). (Bob, Dmitry)
+  . Fixed bug #73329 ((Float)"Nano" == NAN). (Anatol)
+
+- GD:
+  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
+  . Fixed bug #73272 (imagescale() is not affected by, but affects
+    imagesetinterpolation()). (cmb)
+  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
+  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
+    overflow). (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
+    (Anatol)
+
+- OCI8
+  . Fixed bug #71148 (Bind reference overwritten on PHP 7). (Oracle Corp.)
+
+- phpdbg:
+  . Properly allow for stdin input from a file. (Bob)
+  . Add -s command line option / stdin command for reading script from stdin.
+    (Bob)
+  . Ignore non-executable opcodes in line mode of phpdbg_end_oplog(). (Bob)
+  . Fixed bug #70776 (Simple SIGINT does not have any effect with -rr). (Bob)
+  . Fixed bug #71234 (INI files are loaded even invoked as -n --version). (Bob)
+
+- Session:
+  . Fixed bug #73273 (session_unset() empties values from all variables in which
+    is $_session stored). (Nikita)
+
+- SOAP:
+  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
+  . Fixed bug #73237 (Nested object in "any" element overwrites other fields).
+    (Keith Smiley)
+  . Fixed bug #69137 (Peer verification fails when using a proxy with SoapClient)
+    (Keith Smiley)
+
+- SQLite3:
+  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
+
+- Standard:
+  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
+  . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
+    (adsr)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
+
+13 Oct 2016 PHP 7.0.12
+
+- Core:
+  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+    zend_virtual_cwd.c). (cmb)
+  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
+    password_verify). (Anatol)
+  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
+  . Fixed bug #69579 (Invalid free in extension trait). (John Boehr)
+  . Fixed bug #73156 (segfault on undefined function). (Dmitry)
+  . Fixed bug #73163 (PHP hangs if error handler throws while accessing undef
+    const in default value). (Nikita)
+  . Fixed bug #73172 (parse error: Invalid numeric literal). (Nikita, Anatol)
+  . Fixed for #73240 (Write out of bounds at number_format). (Stas)
+  . Fixed bug #73147 (Use After Free in PHP7 unserialize()). (Stas)
+  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
+
+- BCmath:
+  . Fix bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
+
+- COM:
+  . Fixed bug #73126 (Cannot pass parameter 1 by reference). (Anatol)
+
+- Date:
+  . Fixed bug #73091 (Unserializing DateInterval object may lead to __toString
+    invocation). (Stas)
+
+- DOM:
+  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
+
+- Filter:
+  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
+    FILTER_FLAG_NO_PRIV_RANGE). (julien)
+  . Fixed bug #73054 (default option ignored when object passed to int filter).
+    (cmb)
+
+- GD:
+  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
+    (cmb)
+  . Fixed bug #50194 (imagettftext broken on transparent background w/o
+    alphablending). (cmb)
+  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
+    cmb)
+  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
+    (Mark Plomer, cmb)
+  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
+  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
+  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
+    files). (cmb)
+  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
+
+- Intl:
+  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
+
+- Mbstring:
+  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
+  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion) (Yasuo)
+  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
+    (Yasuo)
+
+- Mysqlnd:
+  . Fixed bug #72489 (PHP Crashes When Modifying Array Containing MySQLi Result
+    Data). (Nikita)
+
+- Opcache:
+  . Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp()
+    function). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
+    (Jakub Zelenka)
+  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)
+  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
+
+- PCRE:
+  . Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported
+    on s390). (Anatol)
+  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)
+
+- PDO_DBlib:
+  . Fixed bug #72414 (Never quote values as raw binary data). (Adam Baratz)
+  . Allow \PDO::setAttribute() to set query timeouts. (Adam Baratz)
+  . Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
+    (Adam Baratz)
+  . Add common PDO test suite. (Adam Baratz)
+  . Free error and message strings when cleaning up PDO instances.
+    (Adam Baratz)
+  . Fixed bug #67130 (\PDOStatement::nextRowset() should succeed when all rows
+    in current rowset haven't been fetched). (Peter LeBrun)
+  . Ignore potentially misleading dberr values. (Chris Kings-Lynne)
+
+- phpdbg:
+  . Fixed bug #72996 (phpdbg_prompt.c undefined reference to DL_LOAD). (Nikita)
+  . Fixed next command not stopping when leaving function. (Bob)
+
+- Session:
+  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
+    (Yasuo)
+  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
+    (cmb)
+
+- SimpleXML:
+  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
+    (Stas)
+
+- SOAP:
+  . Fixed bug #71711 (Soap Server Member variables reference bug). (Nikita)
+  . Fixed bug #71996 (Using references in arrays doesn't work like expected).
+    (Nikita)
+
+- SPL:
+  . Fixed bug #73257, #73258 (SplObjectStorage unserialize allows use of
+    non-object as key). (Stas)
+
+- SQLite3:
+  . Updated bundled SQLite3 to 3.14.2. (cmb)
+
+- Zip:
+  . Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
+    (cmb)
+
 15 Sep 2016 PHP 7.0.11

 - Core:
@@ -41,6 +472,10 @@ PHP                                                                        NEWS
 - Intl:
  . Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF
    sequence). (cmb)
+  . Fixed bug #73007 (add locale length check). (Stas)
+
+- Mysqlnd:
+  . Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)

 - OCI8
  . Fixed invalid handle error with Implicit Result Sets. (Chris Jones)
@@ -65,6 +500,12 @@ PHP                                                                        NEWS
    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)

+- Phar:
+  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
+    phar_parse_zipfile). (Stas)
+  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
+    phar_parse_tarfile). (Stas)
+
 - Reflection:
  . Fixed bug #72846 (getConstant for a array constant with constant values
    returns NULL/NFC/UKNOWN). (Laruence)
@@ -79,6 +520,9 @@ PHP                                                                        NEWS
  . Fixed bug #72957 (Null coalescing operator doesn't behave as expected with
    SimpleXMLElement). (Nikita)

+- SPL:
+  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)
+
 - Standard:
  . Fixed bug #55451 (substr_compare NULL length interpreted as 0). (Lauri
    Kenttä)
@@ -93,6 +537,9 @@ PHP                                                                        NEWS
  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    (cmb)

+- SQLite3:
+  . Downgraded bundled SQLite to 3.8.10.2. (Anatol);
+
 - Sysvshm:
  . Fixed bug #72858 (shm_attach null dereference). (Anatol)

@@ -100,6 +547,10 @@ PHP                                                                        NEWS
  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
  . Fixed bug #72714 (_xml_startElementHandler() segmentation fault). (cmb)

+- Wddx:
+  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
+  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)
+
 - ZIP:
  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)

@@ -131,6 +582,8 @@ PHP                                                                        NEWS
  . Fixed bug #72683 (getmxrr broken). (Anatol)
  . Fixed bug #72742 (memory allocator fails to realloc small block to large
    one). (Stas)
+  . Fixed URL rewriter partially. It would not rewrite '//example.com/' URL
+    unconditionally. Only requested host(HTTP_HOST) is rewritten. (Yasuo)

 - Bz2:
  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
@@ -176,6 +629,8 @@ PHP                                                                        NEWS
  . Fixed bug #68712 (suspicious if-else statements). (cmb)
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
+    cmb)

 - Intl:
  . Fixed bug #72639 (Segfault when instantiating class that extends
@@ -1397,6 +1852,8 @@ PHP                                                                        NEWS

 - Filter:
  . New FILTER_VALIDATE_DOMAIN and better RFC conformance for FILTER_VALIDATE_URL. (Kevin Dunglas)
+  . Fixed bug #67167 (Wrong return value from FILTER_VALIDATE_BOOLEAN,
+    FILTER_NULL_ON_FAILURE). (levim)

 - FPM:
  . Fixed bug #70538 ("php-fpm -i" crashes). (rainer dot jung at
@@ -93,24 +93,27 @@ Commit the changes to the main branch.
 12. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure
 and build three tarballs (gz, bz2 and xz).

-13. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
+13. run ``scripts/dev/gen_verify_stub <version> [identity]``, this will sign the tarballs
+and output verification information to be included in announcement email
+
+14. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
 directory "downloads/". Copy them into there, so that the system can generate
 MD5 sums. If you do not have this directory, talk to Derick or Dan.

-14. Now the RC can be found on http://downloads.php.net/yourname,
+15. Now the RC can be found on http://downloads.php.net/yourname,
 f.e. http://downloads.php.net/derick/

-15. Once the release has been tagged, contact the PHP Windows development team
+16. Once the release has been tagged, contact the PHP Windows development team
 (internals-win@lists.php.net) so that Windows binaries can be created. Once
 those are made, they should be placed into the same directory as the source snapshots.

 Getting the non stable release (alpha/beta/RC) announced
 --------------------------------------------------------

-1. Send an email (see example here: http://news.php.net/php.internals/19486)
-**To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` lists
-pointing out "the location of the release" and "the possible release date of
-either the next RC, or the final release".
+1. Send an email **To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` 
+lists pointing out "the location of the release" and "the possible release date of
+either the next RC, or the final release". Include in this information the verification
+information output by ``gen_verify_stub``.

 2. Send an email (see example here http://news.php.net/php.pear.qa/5201) **To**
 ``php-qa@lists.php.net`` and ``primary-qa-tester@lists.php.net``.
@@ -190,8 +193,8 @@ Check if the pear files are updated (phar).
 This is to fetch the last commit id from php-distributions.git and commit this
 last commit id to web/php.git, then, mirrors will now sync

-12. Once the release has been tagged, contact the PHP Windows development team
-(internals-win@lists.php.net) so that Windows binaries can be created.
+12. Once the release has been tagged, contact release managers, windows builders, and package maintainers
+so that they can build releases. Do not send this announcement to any public lists.

 Getting the stable release announced
 ------------------------------------
@@ -5,6 +5,7 @@ This is the github mirror of the official PHP repository located at
 http://git.php.net.

 [![Build Status](https://secure.travis-ci.org/php/php-src.svg?branch=master)](http://travis-ci.org/php/php-src)
+[![Build status](https://ci.appveyor.com/api/projects/status/meyur6fviaxgdwdy?svg=true)](https://ci.appveyor.com/project/php/php-src)

 Pull Requests
 =============
@@ -66,7 +66,7 @@ dnl
 dnl Check whether the current setup can use POSIX threads calls
 dnl
 AC_DEFUN([PTHREADS_CHECK_COMPILE], [
-AC_TRY_RUN( [
+AC_LINK_IFELSE([ AC_LANG_SOURCE([
 #include <pthread.h>
 #include <stddef.h>

@@ -80,18 +80,11 @@ int main() {
    int data = 1;
    pthread_mutexattr_init(&mattr);
    return pthread_create(&thd, NULL, thread_routine, &data);
-} ], [
-  pthreads_working=yes
+} ]) ], [
+  pthreads_checked=yes
  ], [
-  pthreads_working=no
-  ], [
-  dnl For cross compiling running this test is of no use. NetWare supports pthreads
-  pthreads_working=no
-  case $host_alias in
-  *netware*)
-    pthreads_working=yes
-  esac
-]
+  pthreads_checked=no
+  ]
 ) ] )dnl
 dnl
 dnl PTHREADS_CHECK()
@@ -129,30 +122,34 @@ else
      CFLAGS="$CFLAGS $flag"
      PTHREADS_CHECK_COMPILE
      CFLAGS=$ac_save
-      if test "$pthreads_working" = "yes"; then
+      if test "$pthreads_checked" = "yes"; then
        ac_cv_pthreads_cflags=$flag
        break
      fi
    done
  fi
-fi
-])
+  ])

-AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
-ac_cv_pthreads_lib=
-if test "$pthreads_working" != "yes"; then
-  for lib in pthread pthreads c_r; do
-    ac_save=$LIBS
-    LIBS="$LIBS -l$lib"
-    PTHREADS_CHECK_COMPILE
-    LIBS=$ac_save
-    if test "$pthreads_working" = "yes"; then
-      ac_cv_pthreads_lib=$lib
-      break
-    fi
-  done
+  AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
+  ac_cv_pthreads_lib=
+  if test "$pthreads_working" != "yes"; then
+   for lib in pthread pthreads c_r; do
+      ac_save=$LIBS
+      LIBS="$LIBS -l$lib"
+      PTHREADS_CHECK_COMPILE
+      LIBS=$ac_save
+      if test "$pthreads_checked" = "yes"; then
+        ac_cv_pthreads_lib=$lib
+        break
+      fi
+    done
+  fi
+  ])
+
+  if test "x$ac_cv_pthreads_cflags" != "x" -o "x$ac_cv_pthreads_lib" != "x"; then
+    pthreads_working="yes"
+  fi
 fi
-])

 if test "$pthreads_working" = "yes"; then
  threads_result="POSIX-Threads found"
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -484,6 +484,7 @@ Other
    is defined in the interface.
  . session.lazy_write(default=On) INI setting enables only write session data when
    session data is updated.
+  . session_regenerate_id() saves current $_SESSION before creating new session ID.

 - Opcache
  . Removed opcache.load_comments configuration directive. Now doc comments
@@ -651,6 +652,11 @@ Other
  Since 7.0.9, getenv() has optional second parameter, making it only
  consider local environment and not SAPI environment if true.

+- fopen()
+  Since 7.0.16, mode 'e' was added, which sets the close-on-exec flag
+  on the opened file descriptor. This mode is only available in PHP compiled on
+  POSIX.1-2008 conform systems.
+
 ========================================
 6. New Functions
 ========================================
@@ -721,12 +727,22 @@ out, that the corresponding SDK isn't available anymore.
  Mhash is not an extension anymore, use function_exists("mhash") to check whether
  it is avaliable.

+- PDO_Firebird
+  As of PHP 7.0.16, the fetched data for integer fields is aware of the Firebird
+  datatypes. Previously all integers was fetched as strings, starting with the
+  aforementioned PHP version integer fields are translated to the PHP integer
+  datatype. The 64-bit integers are still fetched as strings in 32-bit PHP
+  builds.
+
 - GD
  The bundled libgd requires libwebp instead of libvpx for the WebP functionality.

 - Openssl
  minimum supported OpenSSL version series was raised to 0.9.8

+- Shmop
+  The shmop identifiers have been changed from ints to resources of type shmop.
+
 ========================================
 10. New Global Constants
 ========================================
@@ -784,6 +800,7 @@ out, that the corresponding SDK isn't available anymore.
  . Removed asp_tags ini directive. Trying to enable it will result in a fatal
    error.
  . Removed always_populate_raw_post_data ini directive.
+  . realpath_cache_size set to 4096k by default

 ========================================
 12. Windows Support
@@ -26,7 +26,6 @@ var_dump(count(get_defined_constants()));
 function test () {
 }

-var_dump(get_defined_functions(true));
 var_dump(gettype(get_defined_functions()));
 var_dump(count(get_defined_functions()));

@@ -65,9 +64,6 @@ NULL
 string(5) "array"
 string(5) "array"
 int(%d)
-
-Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
-NULL
 string(5) "array"
 int(%d)

@@ -0,0 +1,25 @@
+--TEST--
+Next free element may overflow in array literals
+--FILE--
+<?php
+
+$i = PHP_INT_MAX;
+$array = [$i => 42, new stdClass];
+var_dump($array);
+
+const FOO = [PHP_INT_MAX => 42, "foo"];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -0,0 +1,12 @@
+--TEST--
+Assign to $this leaks when $this not defined
+--FILE--
+<?php
+
+try {
+	$this->a = new stdClass;
+} catch (Error $e) { echo $e->getMessage(), "\n"; }
+
+?>
+--EXPECT--
+Using $this when not in object context
@@ -0,0 +1,11 @@
+--TEST--
+ZEND_POW_ASSIGN
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+
+assert_options(ASSERT_WARNING);
+assert(false && ($a **= 2));
+--EXPECTF--
+Warning: assert(): assert(false && ($a **= 2)) failed in %s%ezend-pow-assign.php on line %d
@@ -0,0 +1,50 @@
+--TEST--
+Bug #73156 (segfault on undefined function)
+--FILE--
+<?php
+class A {
+    public function __call($name, $args) {
+        eval('$args = array(); var_dump(debug_backtrace());');
+    }
+}
+
+$a = new A();
+
+$a->test("test");
+?>
+--EXPECTF--
+array(2) {
+  [0]=>
+  array(3) {
+    ["file"]=>
+    string(%d) "%sbug73156.php"
+    ["line"]=>
+    int(4)
+    ["function"]=>
+    string(4) "eval"
+  }
+  [1]=>
+  array(7) {
+    ["file"]=>
+    string(%d) "%sbug73156.php"
+    ["line"]=>
+    int(10)
+    ["function"]=>
+    string(6) "__call"
+    ["class"]=>
+    string(1) "A"
+    ["object"]=>
+    object(A)#%d (0) {
+    }
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(2) {
+      [0]=>
+      string(4) "test"
+      [1]=>
+      array(0) {
+      }
+    }
+  }
+}
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73163 (PHP hangs if error handler throws while accessing undef const in default value)
+--FILE--
+<?php
+
+function doSomething(string $value = UNDEFINED) {
+}
+
+set_error_handler(function($errno, $errstr) {
+    throw new Exception($errstr);
+});
+
+doSomething();
+
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: Use of undefined constant UNDEFINED - assumed 'UNDEFINED' in %s:%d
+Stack trace:
+#0 %s(%d): {closure}(%s)
+#1 %s(%d): doSomething()
+#2 {main}
+  thrown in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73181: parse_str() without a second argument leads to crash
+--FILE--
+<?php
+
+function x() {
+    parse_str("1&x");
+    var_dump(get_defined_vars());
+}
+
+x();
+
+?>
+--EXPECT--
+array(2) {
+  [1]=>
+  string(0) ""
+  ["x"]=>
+  string(0) ""
+}
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73337 (try/catch not working with two exceptions inside a same operation)
+--FILE--
+<?php
+class d { function __destruct() { throw new Exception; } }
+try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
+?>
+--EXPECTF--
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+Exception properly caught
@@ -0,0 +1,18 @@
+--TEST--
+Bug #73338: Ensure exceptions in function init opcodes are cleaned properly
+--FILE--
+<?php
+
+try { call_user_func(new class { function __destruct () { throw new Error; } }); } catch (Error $e) {}
+
+set_error_handler(function() { throw new Error; });
+
+try { var_dump(new stdClass, call_user_func("fail")); } catch (Error $e) {}
+
+try { (function() { call_user_func("fail"); })(); } catch (Error $e) {}
+
+try { [new class { static function foo() {} function __destruct () { throw new Error; } }, "foo"](); } catch (Error $e) {}
+
+?>
+--EXPECTF--
+Warning: call_user_func() expects parameter 1 to be a valid callback, no array or string given in %s on line %d
@@ -0,0 +1,27 @@
+--TEST--
+Bug #73350 (Exception::__toString() cause circular references)
+--FILE--
+<?php
+$e = new Exception();
+
+// This line cause problem :(
+// Comment it to see the difference.
+(string) $e;
+
+// This line show the clue (PHP Warning: ...).
+var_export($e);
+?>
+--EXPECTF--
+Exception::__set_state(array(
+   'message' => '',
+   'string' => 'Exception in %sbug73350.php:%d
+Stack trace:
+#0 {main}',
+   'code' => 0,
+   'file' => '%sbug73350.php',
+   'line' => %d,
+   'trace' => 
+  array (
+  ),
+   'previous' => NULL,
+))
@@ -0,0 +1,73 @@
+--TEST--
+Bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+	$ref = range(1, 10);
+	return;
+}
+
+$func = function (&$ref) {
+	return change($ref);
+};
+
+$array = [1];
+var_dump(list($val) = $array); // NG: Invalid opcode
+
+change(list($val) = $array);
+var_dump($array);
+
+$array = [1];
+
+$func(list($val) = $array);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}
@@ -0,0 +1,29 @@
+--TEST--
+Bug #73753 Non packed arrays and duplication
+--FILE--
+<?php
+function iterate($current, $a, $result = null) {
+    if (!$current) {
+        return $result;
+    }
+
+    return iterate(getNext($a), $a, $current);
+}
+
+function getNext(&$a) {
+    return next($a);
+}
+
+function getCurrent($a) {
+    return current($a);
+}
+
+function traverse($a) {
+    return iterate(getCurrent($a), $a);
+}
+
+$arr = array(1 => 'foo', 'b' => 'bar', 'baz');
+var_dump(traverse($arr));
+?>
+--EXPECTF--
+string(3) "baz"
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73792 (invalid foreach loop hangs script)
+--FILE--
+<?php
+$a = 'aaa';
+
+foreach ($a['bbb'] as &$value) {
+	echo 'loop';
+}
+
+unset($value);
+echo 'done';
+?>
+--EXPECTF--
+Warning: Illegal string offset 'bbb' in %sbug73792.php on line 4
+
+Fatal error: Uncaught Error: Cannot iterate on string offsets by reference in %sbug73792.php:4
+Stack trace:
+#0 {main}
+  thrown in %sbug73792.php on line 4
@@ -0,0 +1,16 @@
+--TEST--
+Bug #73916 (zend_print_flat_zval_r doesn't consider reference)
+--FILE--
+<?php
+$a = array('a');
+class b{};
+$b = new b;
+$test[] =& $a;
+$test[] =& $b;
+test($test);
+function test() {
+	debug_print_backtrace();
+}
+?>
+--EXPECTF--
+#0  test(Array ([0] => Array ([0] => a),[1] => b Object ())) called at [%sbug73916.php:%d]
@@ -0,0 +1,184 @@
+--TEST--
+Behavior of failing compound assignment
+--INI--
+opcache.optimization_level=0
+--FILE--
+<?php
+
+try {
+	$a = 1;
+	$a %= 0;
+} catch (Error $e) { var_dump($a); }
+
+try {
+	$a = 1;
+	$a >>= -1;
+} catch (Error $e) { var_dump($a); }
+
+try {
+	$a = 1;
+	$a <<= -1;
+} catch (Error $e) { var_dump($a); }
+
+set_error_handler(function($type, $msg) { throw new Exception($msg); });
+
+try {
+	$a = [];
+	$a .= "foo";
+} catch (Throwable $e) { var_dump($a); }
+
+try {
+	$a = "foo";
+	$a .= [];
+} catch (Throwable $e) { var_dump($a); }
+
+$x = new stdClass;
+try { $x += 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x += new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x -= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x -= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x *= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x *= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x /= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x /= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x %= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x %= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x **= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x **= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x ^= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x ^= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x &= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x &= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x |= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x |= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x <<= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x <<= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x >>= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x >>= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+?>
+--EXPECTF--
+int(1)
+int(1)
+int(1)
+array(0) {
+}
+string(3) "foo"
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
@@ -2,51 +2,37 @@
 Concatenating many small strings should not slowdown allocations
 --SKIPIF--
 <?php if (PHP_DEBUG) { die ("skip debug version is slow"); } ?>
--INI--
-memory_limit=256m
 --FILE--
 <?php

-/* To note is that memory usage can vary depending on whether opcache is on. The actual
-  measuring that matters is timing here. */
-
 $time = microtime(TRUE);

 /* This might vary on Linux/Windows, so the worst case and also count in slow machines. */
-$t0_max = 0.1;
-$t1_max = 0.4;
-
-$datas = [];
-for ($i = 0; $i < 220000; $i++)
-{
-    $datas[] = [
-        '000.000.000.000',
-        '000.255.255.255',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-    ];
-}
-
-$t0 = microtime(TRUE) - $time;
-var_dump($t0 < $t0_max);
+$t_max = 1.0;

+$datas = array_fill(0, 220000, [
+    '000.000.000.000',
+    '000.255.255.255',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+]);

+$time = microtime(TRUE);
 $texts = '';
 foreach ($datas AS $data)
 {
    $texts .= implode("\t", $data) . "\r\n";
 }

-$t1 = microtime(TRUE) - $time;
-var_dump($t1 < $t1_max);
+$t = microtime(TRUE) - $time;
+var_dump($t < $t_max);

 ?>
 +++DONE+++
 --EXPECT--
 bool(true)
-bool(true)
 +++DONE+++
@@ -0,0 +1,15 @@
+--TEST--
+Constexpr arrays should be able to handle resource keys
+--FILE--
+<?php
+
+const FOO = [STDIN => 42];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Notice: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -1,5 +1,7 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php

@@ -0,0 +1,24 @@
+--TEST--
+Calling generator through magic __call()
+--FILE--
+<?php
+class A {
+    public function __call($name, $args) {
+        for ($i = 0; $i < 5; $i++) {
+            yield $i;
+        }
+    }
+}
+
+$a = new A();
+foreach ($a->gen() as $n) {
+    var_dump($n);
+}
+$a->gen();
+?>
+--EXPECT--
+int(0)
+int(1)
+int(2)
+int(3)
+int(4)
@@ -3,7 +3,7 @@ Test get_defined_functions() function : error conditions
 --FILE--
 <?php

-/* Prototype  : array get_defined_functions  ( void  )
+/* Prototype  : array get_defined_functions  ( $exclude_disabled = false )
 * Description: Gets an array of all defined functions.
 * Source code: Zend/zend_builtin_functions.c
 */
@@ -14,7 +14,8 @@ echo "*** Testing get_defined_functions() : error conditions ***\n";

 echo "\n-- Testing get_defined_functions() function with more than expected no. of arguments --\n";
 $extra_arg = 10;
-var_dump( get_defined_functions($extra_arg) );
+$extra_arg2 = 20;
+var_dump( get_defined_functions($extra_arg, $extra_arg2) );

 ?> 
 ===Done===
@@ -23,7 +24,7 @@ var_dump( get_defined_functions($extra_arg) );

 -- Testing get_defined_functions() function with more than expected no. of arguments --

-Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
+Warning: get_defined_functions() expects at most 1 parameter, 2 given in %s on line %d
 NULL
 
 ===Done===
@@ -6,6 +6,8 @@ ANDing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);

 $s &= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 &= 33;
 var_dump($s2);

+$s3 &= " ";
+var_dump($s3);
+
+$s4 &= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--	
 int(18)
 int(0)
 int(33)
+string(1) " "
+string(2) "  "
 Done
@@ -6,6 +6,8 @@ ORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);

 $s |= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 |= 33;
 var_dump($s2);

+$s3 |= " ";
+var_dump($s3);
+
+$s4 |= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(127)
 int(11)
 int(45345)
+string(1) "f"
+string(2) "ff"
 Done
@@ -6,6 +6,8 @@ XORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);

 $s ^= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 ^= 33;
 var_dump($s2);

+$s3 ^= " ";
+var_dump($s3);
+
+$s4 ^= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(109)
 int(11)
 int(45312)
+string(1) "F"
+string(2) "FF"
 Done
@@ -0,0 +1,20 @@
+--TEST--
+Bug #69579 (Internal trait double-free)
+--SKIPIF--
+<?php
+if (!PHP_DEBUG) die("skip only run in debug version");
+?>
+--FILE--
+<?php
+
+class Bar{
+  use _ZendTestTrait;
+}
+
+$bar = new Bar();
+var_dump($bar->testMethod());
+// destruction causes a double-free and explodes
+
+?>
+--EXPECT--
+bool(true)
@@ -12,8 +12,8 @@ final class e { }
 var_dump(get_declared_traits());

 ?>
--EXPECT--
-array(1) {
-  [0]=>
+--EXPECTF--
+array(%d) {%A
+  [%d]=>
  string(1) "c"
 }
@@ -13,8 +13,8 @@ namespace test {
 }

 ?>
--EXPECT--
-array(1) {
-  [0]=>
+--EXPECTF--
+array(%d) {%A
+  [%d]=>
  string(6) "test\c"
 }
@@ -13,13 +13,15 @@ var_dump(get_declared_traits());

 ?>
 --EXPECTF--
-%astring(1) "a"
+array(%d) {%A
+  [%d]=>
+  string(1) "a"
  [%d]=>
  string(1) "d"
  [%d]=>
  string(1) "e"
 }
-array(1) {
-  [0]=>
+array(%d) {%A
+  [%d]=>
  string(1) "c"
 }
@@ -0,0 +1,15 @@
+--TEST--
+"use function" should not conflict with class names
+--FILE--
+<?php
+
+namespace Foo;
+
+class Bar {}
+
+use function bar;
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,12 @@
+--TEST--
+Use conflicts should not occur across files
+--FILE--
+<?php
+
+require __DIR__ . '/use_no_file_conflict_1.inc';
+require __DIR__ . '/use_no_file_conflict_2.inc';
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,4 @@
+<?php
+
+namespace Foo;
+class A {}
@@ -0,0 +1,4 @@
+<?php
+
+namespace Foo;
+use A;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -152,11 +152,12 @@ ZEND_TSRMLS_CACHE_DEFINE()
 #endif

 ZEND_API zend_utility_values zend_uv;
+ZEND_API zend_bool zend_dtrace_enabled;

 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2016 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2017 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4

 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object) /* {{{ */
@@ -312,6 +313,9 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			ZEND_PUTS(")");
 			break;
 		}
+		case IS_REFERENCE:
+			zend_print_flat_zval_r(Z_REFVAL_P(expr));
+			break;
 		default:
 			zend_print_variable(expr);
 			break;
@@ -678,9 +682,20 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /

 #if HAVE_DTRACE
 /* build with dtrace support */
-	zend_compile_file = dtrace_compile_file;
-	zend_execute_ex = dtrace_execute_ex;
-	zend_execute_internal = dtrace_execute_internal;
+	{
+		char *tmp = getenv("USE_ZEND_DTRACE");
+
+		if (tmp && zend_atoi(tmp, 0)) {
+			zend_dtrace_enabled = 1;
+			zend_compile_file = dtrace_compile_file;
+			zend_execute_ex = dtrace_execute_ex;
+			zend_execute_internal = dtrace_execute_internal;
+		} else {
+			zend_compile_file = compile_file;
+			zend_execute_ex = execute_ex;
+			zend_execute_internal = NULL;
+		}
+	}
 #else
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -299,6 +299,8 @@ extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
 extern ZEND_API zval zval_used_for_init;

+/* If DTrace is available and enabled */
+extern ZEND_API zend_bool zend_dtrace_enabled;
 END_EXTERN_C()

 #define ZEND_UV(name) (zend_uv.name)
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -197,7 +197,6 @@ ZEND_API char *zend_zval_type_name(const zval *arg) /* {{{ */
 }
 /* }}} */

-#ifdef FAST_ZPP
 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_paramers_count_error(int num_args, int min_num_args, int max_num_args) /* {{{ */
 {
 	zend_function *active_function = EG(current_execute_data)->func;
@@ -291,7 +290,6 @@ ZEND_API int ZEND_FASTCALL zend_parse_arg_class(zval *arg, zend_class_entry **pc
 	return 1;
 }
 /* }}} */
-#endif

 ZEND_API int ZEND_FASTCALL zend_parse_arg_bool_weak(zval *arg, zend_bool *dest) /* {{{ */
 {
@@ -1861,7 +1859,7 @@ static int zend_startup_module_zval(zval *zv) /* {{{ */
 {
 	zend_module_entry *module = Z_PTR_P(zv);

-	return zend_startup_module_ex(module);
+	return (zend_startup_module_ex(module) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
 /* }}} */

@@ -3849,6 +3847,24 @@ ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, c
 }
 /* }}} */

+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length) /* {{{ */
+{
+	zval property;
+	zend_class_entry *old_scope = EG(scope);
+
+	EG(scope) = scope;
+
+	if (!Z_OBJ_HT_P(object)->unset_property) {
+		zend_error_noreturn(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, ZSTR_VAL(Z_OBJCE_P(object)->name));
+	}
+	ZVAL_STRINGL(&property, name, name_length);
+	Z_OBJ_HT_P(object)->unset_property(object, &property, 0);
+	zval_ptr_dtor(&property);
+
+	EG(scope) = old_scope;
+}
+/* }}} */
+
 ZEND_API void zend_update_property_bool(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_long value) /* {{{ */
 {
 	zval tmp;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -343,6 +343,7 @@ ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object,
 ZEND_API void zend_update_property_str(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_string *value);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value, size_t value_length);
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, size_t name_length, zval *value);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, size_t name_length);
@@ -665,13 +666,11 @@ END_EXTERN_C()

 /* Fast parameter parsing API */

-/* This API should be used only for really often used functions.
- * (Keep the original parsing code and wrap usage with #ifndef FAST_ZPP)
+/* Fast ZPP is always enabled now; this define is left in for compatibility
+ * with any existing conditional compilation blocks.
 */
 #define FAST_ZPP 1

-#ifdef FAST_ZPP
-
 #define Z_EXPECTED_TYPES(_) \
 	_(Z_EXPECTED_LONG,		"integer") \
 	_(Z_EXPECTED_BOOL,		"boolean") \
@@ -1034,8 +1033,6 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 #define Z_PARAM_VARIADIC(spec, dest, dest_num) \
 	Z_PARAM_VARIADIC_EX(spec, dest, dest_num, 0)

-#endif /* FAST_ZPP */
-
 /* End of new parameter parsing API */

 /* Inlined implementations shared by new and old parameter parsing APIs */
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -897,6 +897,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, int pages_count ZEND_FILE_L
 {
 	zend_mm_chunk *chunk = heap->main_chunk;
 	int page_num, len;
+	int steps = 0;

 	while (1) {
 		if (UNEXPECTED(chunk->free_pages < pages_count)) {
@@ -1073,10 +1074,20 @@ get_chunk:
 			goto found;
 		} else {
 			chunk = chunk->next;
+			steps++;
 		}
 	}

 found:
+	if (steps > 2 && pages_count < 8) {
+		/* move chunk into the head of the linked-list */
+		chunk->prev->next = chunk->next;
+		chunk->next->prev = chunk->prev;
+		chunk->next = heap->main_chunk->next;
+		chunk->prev = heap->main_chunk;
+		chunk->prev->next = chunk;
+		chunk->next->prev = chunk;
+	}
 	/* mark run as allocated */
 	chunk->free_pages -= pages_count;
 	zend_mm_bitset_set_range(chunk->free_map, page_num, pages_count);
@@ -1472,7 +1483,7 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 #endif
 #ifdef ZEND_WIN32
 			/* On Windows we don't have ability to extend huge blocks in-place.
-			 * We allocate them with 2MB size granularity, to avoid many 
+			 * We allocate them with 2MB size granularity, to avoid many
 			 * reallocations when they are extended by small pieces
 			 */
 			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -1740,7 +1751,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 {
 #ifdef ZEND_WIN32
 	/* On Windows we don't have ability to extend huge blocks in-place.
-	 * We allocate them with 2MB size granularity, to avoid many 
+	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
 	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -2332,7 +2343,7 @@ ZEND_API int is_zend_mm(void)
 #endif
 }

-#if !ZEND_DEBUG && (!defined(_WIN32) || defined(__clang__))
+#if !ZEND_DEBUG && defined(HAVE_BUILTIN_CONSTANT_P)
 #undef _emalloc

 #if ZEND_MM_CUSTOM
@@ -2500,37 +2511,24 @@ ZEND_API size_t ZEND_FASTCALL _zend_mem_block_size(void *ptr ZEND_FILE_LINE_DC Z
 	return zend_mm_size(AG(mm_heap), ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 }

-static zend_always_inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
-{
-	int overflow;
-	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
-
-	if (UNEXPECTED(overflow)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
-		return 0;
-	}
-	return ret;
-}
-
-
 ZEND_API void* ZEND_FASTCALL _safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return emalloc_rel(safe_address(nmemb, size, offset));
+	return emalloc_rel(zend_safe_address_guarded(nmemb, size, offset));
 }

 ZEND_API void* ZEND_FASTCALL _safe_malloc(size_t nmemb, size_t size, size_t offset)
 {
-	return pemalloc(safe_address(nmemb, size, offset), 1);
+	return pemalloc(zend_safe_address_guarded(nmemb, size, offset), 1);
 }

 ZEND_API void* ZEND_FASTCALL _safe_erealloc(void *ptr, size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return erealloc_rel(ptr, safe_address(nmemb, size, offset));
+	return erealloc_rel(ptr, zend_safe_address_guarded(nmemb, size, offset));
 }

 ZEND_API void* ZEND_FASTCALL _safe_realloc(void *ptr, size_t nmemb, size_t size, size_t offset)
 {
-	return perealloc(ptr, safe_address(nmemb, size, offset), 1);
+	return perealloc(ptr, zend_safe_address_guarded(nmemb, size, offset), 1);
 }


@@ -2646,9 +2644,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(zend_mm_heap));
 		alloc_globals->mm_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
-		alloc_globals->mm_heap->custom_heap.std._malloc = malloc;
+		alloc_globals->mm_heap->custom_heap.std._malloc = __zend_malloc;
 		alloc_globals->mm_heap->custom_heap.std._free = free;
-		alloc_globals->mm_heap->custom_heap.std._realloc = realloc;
+		alloc_globals->mm_heap->custom_heap.std._realloc = __zend_realloc;
 		return;
 	}
 #endif
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -181,7 +181,11 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 {
 	switch (Z_TYPE_P(offset)) {
 		case IS_UNDEF:
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), expr);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), expr)) {
+				zend_error(E_WARNING,
+					"Cannot add element to the array as the next element is already occupied");
+				zval_ptr_dtor(expr);
+			}
 			break;
 		case IS_STRING:
 			zend_symtable_update(Z_ARRVAL_P(result), Z_STR_P(offset), expr);
@@ -202,6 +206,10 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 		case IS_DOUBLE:
 			zend_hash_index_update(Z_ARRVAL_P(result), zend_dval_to_lval(Z_DVAL_P(offset)), expr);
 			break;
+		case IS_RESOURCE:
+			zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(offset), Z_RES_HANDLE_P(offset));
+			zend_hash_index_update(Z_ARRVAL_P(result), Z_RES_HANDLE_P(offset), expr);
+			break;
 		default:
 			zend_throw_error(NULL, "Illegal offset type");
 			return FAILURE;
@@ -1336,7 +1344,7 @@ simple_list:
 				case ZEND_ASSIGN_BW_OR:  BINARY_OP(" |= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_AND: BINARY_OP(" &= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_XOR: BINARY_OP(" ^= ",  90, 91, 90);
-				case ZEND_POW:           BINARY_OP(" **= ", 90, 91, 90);
+				case ZEND_ASSIGN_POW:    BINARY_OP(" **= ", 90, 91, 90);
 				EMPTY_SWITCH_DEFAULT_CASE();
 			}
 			break;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -31,6 +31,10 @@

 #undef ZEND_TEST_EXCEPTIONS

+#if ZEND_DEBUG
+static zend_class_entry *zend_test_trait;
+#endif
+
 static ZEND_FUNCTION(zend_version);
 static ZEND_FUNCTION(func_num_args);
 static ZEND_FUNCTION(func_get_arg);
@@ -257,6 +261,18 @@ ZEND_END_ARG_INFO()

 /* }}} */

+#if ZEND_DEBUG
+static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
+	RETURN_TRUE;
+}
+/* }}} */
+
+static zend_function_entry zend_test_trait_methods[] = {
+    ZEND_ME(_ZendTestTrait, testMethod, arginfo_zend__void, ZEND_ACC_PUBLIC)
+    ZEND_FE_END
+};
+#endif
+
 static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(zend_version,		arginfo_zend__void)
 	ZEND_FE(func_num_args,		arginfo_zend__void)
@@ -339,6 +355,13 @@ ZEND_MINIT_FUNCTION(core) { /* {{{ */

 	zend_register_default_classes();

+#if ZEND_DEBUG
+	INIT_CLASS_ENTRY(class_entry, "_ZendTestTrait", zend_test_trait_methods);
+	zend_test_trait = zend_register_internal_class(&class_entry);
+	zend_test_trait->ce_flags |= ZEND_ACC_TRAIT;
+	zend_declare_property_null(zend_test_trait, "testProp", sizeof("testProp")-1, ZEND_ACC_PUBLIC);
+#endif
+
 	return SUCCESS;
 }
 /* }}} */
@@ -544,15 +567,9 @@ ZEND_FUNCTION(strlen)
 {
 	zend_string *s;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &s) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(s)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	RETVAL_LONG(ZSTR_LEN(s));
 }
@@ -692,16 +709,10 @@ ZEND_FUNCTION(error_reporting)
 	zval *err;
 	int old_error_reporting;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|z", &err) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(0, 1)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_ZVAL(err)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	old_error_reporting = EG(error_reporting);
 	if (ZEND_NUM_ARGS() != 0) {
@@ -797,9 +808,6 @@ static void copy_constant_array(zval *dst, zval *src) /* {{{ */
 			}
 		} else if (Z_REFCOUNTED_P(val)) {
 			Z_ADDREF_P(val);
-			if (UNEXPECTED(Z_TYPE_INFO_P(val) == IS_RESOURCE_EX)) {
-				Z_TYPE_INFO_P(new_val) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
-			}
 		}
 	} ZEND_HASH_FOREACH_END();
 }
@@ -815,18 +823,12 @@ ZEND_FUNCTION(define)
 	int case_sensitive = CONST_CS;
 	zend_constant c;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sz|b", &name, &val, &non_cs) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_STR(name)
 		Z_PARAM_ZVAL(val)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(non_cs)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (non_cs) {
 		case_sensitive = 0;
@@ -848,12 +850,7 @@ repeat:
 		case IS_FALSE:
 		case IS_TRUE:
 		case IS_NULL:
-			break;
 		case IS_RESOURCE:
-			ZVAL_COPY(&val_free, val);
-			/* TODO: better solution than this tricky disable dtor on resource? */
-			Z_TYPE_INFO(val_free) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
-			val = &val_free;
 			break;
 		case IS_ARRAY:
 			if (!Z_IMMUTABLE_P(val)) {
@@ -907,15 +904,9 @@ ZEND_FUNCTION(defined)
 {
 	zend_string *name;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (zend_get_constant_ex(name, NULL, ZEND_FETCH_CLASS_SILENT)) {
 		RETURN_TRUE;
@@ -1011,18 +1002,12 @@ static void is_a_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool only_subclass) /*
 	zend_bool allow_string = only_subclass;
 	zend_bool retval;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS|b", &obj, &class_name, &allow_string) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_ZVAL(obj)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(allow_string)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 	/*
 	 * allow_string - is_a default is no, is_subclass_of is yes.
 	 *   if it's allowed, then the autoloader will be called if the class does not exist.
@@ -1162,15 +1147,9 @@ ZEND_FUNCTION(get_object_vars)
 	zend_string *key;
 	zend_object *zobj;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "o", &obj) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (Z_OBJ_HT_P(obj)->get_properties == NULL) {
 		RETURN_FALSE;
@@ -1306,16 +1285,11 @@ ZEND_FUNCTION(method_exists)
 	zend_string *lcname;
 	zend_class_entry * ce;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS", &klass, &method_name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 2)
 		Z_PARAM_ZVAL(klass)
 		Z_PARAM_STR(method_name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
+	
 	if (Z_TYPE_P(klass) == IS_OBJECT) {
 		ce = Z_OBJCE_P(klass);
 	} else if (Z_TYPE_P(klass) == IS_STRING) {
@@ -1411,17 +1385,11 @@ ZEND_FUNCTION(class_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &class_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(class_name)[0] == '\\') {
@@ -1454,17 +1422,11 @@ ZEND_FUNCTION(interface_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &iface_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(iface_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(iface_name)[0] == '\\') {
@@ -1496,17 +1458,11 @@ ZEND_FUNCTION(trait_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &trait_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(trait_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(trait_name)[0] == '\\') {
@@ -1539,15 +1495,9 @@ ZEND_FUNCTION(function_exists)
 	zend_function *func;
 	zend_string *lcname;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Ignore leading "\" */
@@ -1910,13 +1860,22 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 	zend_function *func = Z_PTR_P(zv);
 	zval *internal_ar = va_arg(args, zval *),
 	     *user_ar     = va_arg(args, zval *);
+	zend_bool *exclude_disabled = va_arg(args, zend_bool *);

 	if (hash_key->key == NULL || ZSTR_VAL(hash_key->key)[0] == 0) {
 		return 0;
 	}

 	if (func->type == ZEND_INTERNAL_FUNCTION) {
-		add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+		char *disable_functions = INI_STR("disable_functions");
+
+		if ((*exclude_disabled == 1) && (disable_functions != NULL)) {
+			if (strstr(disable_functions, func->common.function_name->val) == NULL) {
+				add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+			}
+		} else {
+			add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+		}
 	} else if (func->type == ZEND_USER_FUNCTION) {
 		add_next_index_str(user_ar, zend_string_copy(hash_key->key));
 	}
@@ -1930,8 +1889,9 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 ZEND_FUNCTION(get_defined_functions)
 {
 	zval internal, user;
+	zend_bool exclude_disabled = 0;

-	if (zend_parse_parameters_none() == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|b", &exclude_disabled) == FAILURE) {
 		return;
 	}

@@ -1939,7 +1899,7 @@ ZEND_FUNCTION(get_defined_functions)
 	array_init(&user);
 	array_init(return_value);

-	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 2, &internal, &user);
+	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 3, &internal, &user, &exclude_disabled);

 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "internal", sizeof("internal")-1, &internal);
 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "user", sizeof("user")-1, &user);
@@ -2253,9 +2213,33 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(arg_array)) {
 			if (call->func->type == ZEND_USER_FUNCTION) {
-				uint32_t first_extra_arg = call->func->op_array.num_args;
+				uint32_t first_extra_arg = MIN(num_args, call->func->op_array.num_args);

-				if (ZEND_CALL_NUM_ARGS(call) > first_extra_arg) {
+				if (UNEXPECTED(call->symbol_table)) {
+					/* In case of attached symbol_table, values on stack may be invalid
+					 * and we have to access them through symbol_table
+					 * See: https://bugs.php.net/bug.php?id=73156
+					 */
+					zend_string *arg_name;
+					zval *arg;
+
+					while (i < first_extra_arg) {
+						arg_name = call->func->op_array.vars[i];
+						arg = zend_hash_find_ind(call->symbol_table, arg_name);
+						if (arg) {
+							if (Z_OPT_REFCOUNTED_P(arg)) {
+								Z_ADDREF_P(arg);
+							}
+							n++;
+							ZEND_HASH_FILL_ADD(arg);
+						} else {
+							zval tmp;
+							ZVAL_UNDEF(&tmp);
+							ZEND_HASH_FILL_ADD(&tmp);
+						}
+						i++;
+					}
+				} else {
 					while (i < first_extra_arg) {
 						if (EXPECTED(Z_TYPE_INFO_P(p) != IS_UNDEF)) {
 							if (Z_OPT_REFCOUNTED_P(p)) {
@@ -2267,8 +2251,8 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 						p++;
 						i++;
 					}
-					p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 				}
+				p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 			}

 			while (i < num_args) {
@@ -2372,13 +2356,19 @@ ZEND_FUNCTION(debug_print_backtrace)
 		object = Z_OBJ(call->This);

 		if (call->func) {
+			zend_string *zend_function_name;
+
 			func = call->func;
-			function_name = (func->common.scope &&
-			                 func->common.scope->trait_aliases) ?
-				ZSTR_VAL(zend_resolve_method_name(
-					(object ? object->ce : func->common.scope), func)) :
-				(func->common.function_name ?
-					ZSTR_VAL(func->common.function_name) : NULL);
+            if (func->common.scope && func->common.scope->trait_aliases) {
+                zend_function_name = zend_resolve_method_name(object ? object->ce : func->common.scope, func);
+            } else {
+                zend_function_name = func->common.function_name;
+            }
+            if (zend_function_name != NULL) {
+                function_name = ZSTR_VAL(zend_function_name);
+            } else {
+                function_name = NULL;
+            }
 		} else {
 			func = NULL;
 			function_name = NULL;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -1002,10 +1002,8 @@ ZEND_API zend_class_entry *do_bind_class(const zend_op_array* op_array, const ze
 		op1 = RT_CONSTANT(op_array, opline->op1);
 		op2 = RT_CONSTANT(op_array, opline->op2);
 	}
-	if ((ce = zend_hash_find_ptr(class_table, Z_STR_P(op1))) == NULL) {
-		zend_error_noreturn(E_COMPILE_ERROR, "Internal Zend error - Missing class information for %s", Z_STRVAL_P(op1));
-		return NULL;
-	}
+	ce = zend_hash_find_ptr(class_table, Z_STR_P(op1));
+	ZEND_ASSERT(ce);
 	ce->refcount++;
 	if (zend_hash_add_ptr(class_table, Z_STR_P(op2), ce) == NULL) {
 		ce->refcount--;
@@ -2783,12 +2781,21 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
 			}
 		} else {
 			zend_compile_expr(&arg_node, arg);
-			ZEND_ASSERT(arg_node.op_type != IS_CV);
 			if (arg_node.op_type == IS_VAR) {
 				opcode = ZEND_SEND_VAR_NO_REF;
 				if (fbc && ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
 					flags |= ZEND_ARG_SEND_BY_REF;
 				}
+			} else if (arg_node.op_type == IS_CV) {
+				if (fbc) {
+					if (ARG_SHOULD_BE_SENT_BY_REF(fbc, arg_num)) {
+						opcode = ZEND_SEND_REF;
+					} else {
+						opcode = ZEND_SEND_VAR;
+					}
+				} else {
+					opcode = ZEND_SEND_VAR_EX;
+				}
 			} else {
 				if (fbc) {
 					opcode = ZEND_SEND_VAL;
@@ -5499,6 +5506,41 @@ static void zend_check_already_in_use(uint32_t type, zend_string *old_name, zend
 }
 /* }}} */

+static void zend_check_use_conflict(
+		uint32_t type, zend_string *old_name, zend_string *new_name, zend_string *lookup_name) {
+	switch (type) {
+		case T_CLASS:
+		{
+			zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
+			if (ce && ce->type == ZEND_USER_CLASS
+				&& ce->info.user.filename == CG(compiled_filename)
+			) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		case T_FUNCTION:
+		{
+			zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
+			if (fn && fn->type == ZEND_USER_FUNCTION
+				&& fn->op_array.filename == CG(compiled_filename)
+			) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		case T_CONST:
+		{
+			zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
+			if (filename && filename == CG(compiled_filename)) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		EMPTY_SWITCH_DEFAULT_CASE()
+	}
+}
+
 void zend_compile_use(zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
@@ -5555,43 +5597,11 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
 			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));

-			if (zend_hash_exists(CG(class_table), ns_name)) {
-				zend_check_already_in_use(type, old_name, new_name, ns_name);
-			}
+			zend_check_use_conflict(type, old_name, new_name, ns_name);

 			zend_string_free(ns_name);
 		} else {
-			switch (type) {
-				case T_CLASS:
-				{
-					zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
-					if (ce && ce->type == ZEND_USER_CLASS
-						&& ce->info.user.filename == CG(compiled_filename)
-					) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				case T_FUNCTION:
-				{
-					zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
-					if (fn && fn->type == ZEND_USER_FUNCTION
-						&& fn->op_array.filename == CG(compiled_filename)
-					) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				case T_CONST:
-				{
-					zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
-					if (filename && filename == CG(compiled_filename)) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				EMPTY_SWITCH_DEFAULT_CASE()
-			}
+			zend_check_use_conflict(type, old_name, new_name, lookup_name);
 		}

 		zend_string_addref(old_name);
@@ -5950,7 +5960,11 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 					break;
 			}
 		} else {
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), value);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), value)) {
+				zval_ptr_dtor_nogc(value);
+				zval_ptr_dtor(result);
+				return 0;
+			}
 		}
 	}

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -186,7 +186,9 @@ ZEND_API void zend_clear_exception(void) /* {{{ */
 	}
 	OBJ_RELEASE(EG(exception));
 	EG(exception) = NULL;
-	EG(current_execute_data)->opline = EG(opline_before_exception);
+	if (EG(current_execute_data)) {
+		EG(current_execute_data)->opline = EG(opline_before_exception);
+	}
 #if ZEND_DEBUG
 	EG(opline_before_exception) = NULL;
 #endif
@@ -293,10 +295,7 @@ ZEND_METHOD(exception, __construct)
 #define CHECK_EXC_TYPE(name, type) \
 	pvalue = zend_read_property(i_get_exception_base(object), (object), name, sizeof(name) - 1, 1, &value); \
 	if (Z_TYPE_P(pvalue) != IS_NULL && Z_TYPE_P(pvalue) != type) { \
-		zval tmp; \
-		ZVAL_STRINGL(&tmp, name, sizeof(name) - 1); \
-		Z_OBJ_HANDLER_P(object, unset_property)(object, &tmp, NULL); \
-		zval_ptr_dtor(&tmp); \
+		zend_unset_property(i_get_exception_base(object), object, name, sizeof(name)-1); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -309,7 +308,12 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	CHECK_EXC_TYPE("previous", IS_OBJECT);
+	pvalue = zend_read_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1, 1, &value);
+	if (pvalue && Z_TYPE_P(pvalue) != IS_NULL && (Z_TYPE_P(pvalue) != IS_OBJECT ||
+			!instanceof_function(Z_OBJCE_P(pvalue), i_get_exception_base(object)) ||
+			pvalue == object)) {
+		zend_unset_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1);
+	}
 }
 /* }}} */

@@ -771,10 +775,25 @@ ZEND_METHOD(exception, __toString)
 		zend_string_release(file);
 		zval_ptr_dtor(&trace);

+		Z_OBJPROP_P(exception)->u.v.nApplyCount++;
 		exception = GET_PROPERTY(exception, "previous");
+		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->u.v.nApplyCount > 0) {
+			break;
+		}
 	}
 	zval_dtor(&fname);

+	exception = getThis();
+	/* Reset apply counts */
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && (base_ce = i_get_exception_base(exception)) && instanceof_function(Z_OBJCE_P(exception), base_ce)) {
+		if (Z_OBJPROP_P(exception)->u.v.nApplyCount) {
+			Z_OBJPROP_P(exception)->u.v.nApplyCount--;
+		} else {
+			break;
+		}
+		exception = GET_PROPERTY(exception, "previous");
+	}
+
 	exception = getThis();
 	base_ce = i_get_exception_base(exception);

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -576,7 +576,6 @@ static inline zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, zend_execu
 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
 {
 	zend_reference *ref;
-	zval garbage;

 	if (EXPECTED(!Z_ISREF_P(value_ptr))) {
 		ZVAL_NEW_REF(value_ptr, value_ptr);
@@ -586,9 +585,18 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v

 	ref = Z_REF_P(value_ptr);
 	GC_REFCOUNT(ref)++;
-	ZVAL_COPY_VALUE(&garbage, variable_ptr);
+	if (Z_REFCOUNTED_P(variable_ptr)) {
+		zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
+
+		if (--GC_REFCOUNT(garbage) == 0) {
+			ZVAL_REF(variable_ptr, ref);
+			zval_dtor_func_for_ptr(garbage);
+			return;
+		} else {
+			GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr);
+		}
+	}
 	ZVAL_REF(variable_ptr, ref);
-	zval_ptr_dtor(&garbage);
 }

 /* this should modify object only if it's empty */
@@ -1404,11 +1412,11 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 	zval rv;

 	if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-		zval *z, obj;
+		zval *z, *zptr, obj;
 				
 		ZVAL_OBJ(&obj, Z_OBJ_P(object));
 		Z_ADDREF(obj);
-		z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
+		zptr = z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
 		if (UNEXPECTED(EG(exception))) {
 			OBJ_RELEASE(Z_OBJ(obj));
 			return;
@@ -1435,7 +1443,7 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 		}
 		Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
 		OBJ_RELEASE(Z_OBJ(obj));
-		zval_ptr_dtor(z);
+		zval_ptr_dtor(zptr);
 	} else {
 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
 		if (UNEXPECTED(result)) {
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -343,6 +343,10 @@ void shutdown_executor(void) /* {{{ */
 		zend_llist_destroy(&CG(open_files));
 	} zend_end_try();

+	zend_try {
+		clean_non_persistent_constants();
+    } zend_end_try();
+
 	zend_try {
 		zend_close_rsrc_list(&EG(regular_list));
 	} zend_end_try();
@@ -374,10 +378,6 @@ void shutdown_executor(void) /* {{{ */
 		}
 	} zend_end_try();

-	zend_try {
-		clean_non_persistent_constants();
-	} zend_end_try();
-
 	zend_try {
 #if 0&&ZEND_DEBUG
 	signal(SIGSEGV, original_sigsegv_handler);
@@ -573,8 +573,6 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_bool inline_change, zend_clas
 				ZVAL_EMPTY_STRING(p);
 			}
 		} else if (UNEXPECTED((const_value = zend_get_constant_ex(Z_STR_P(p), scope, Z_CONST_FLAGS_P(p))) == NULL)) {
-			char *actual = Z_STRVAL_P(p);
-
 			if (UNEXPECTED(EG(exception))) {
 				RESET_CONSTANT_VISITED(p);
 				return FAILURE;
@@ -584,46 +582,38 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_bool inline_change, zend_clas
 				return FAILURE;
 			} else {
 				zend_string *save = Z_STR_P(p);
-				char *slash;
-				size_t actual_len = Z_STRLEN_P(p);
-				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) && (slash = (char *)zend_memrchr(actual, '\\', actual_len))) {
-					actual = slash + 1;
-					actual_len -= (actual - Z_STRVAL_P(p));
-					if (inline_change) {
-						zend_string *s = zend_string_init(actual, actual_len, 0);
-						Z_STR_P(p) = s;
-						Z_TYPE_FLAGS_P(p) = IS_TYPE_REFCOUNTED | IS_TYPE_COPYABLE;
-					}
-				}
-				if (actual[0] == '\\') {
-					if (inline_change) {
-						memmove(Z_STRVAL_P(p), Z_STRVAL_P(p)+1, Z_STRLEN_P(p));
-						--Z_STRLEN_P(p);
-					} else {
-						++actual;
-					}
-					--actual_len;
-				}
 				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) == 0) {
 					if (ZSTR_VAL(save)[0] == '\\') {
 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save) + 1);
 					} else {
 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save));
 					}
-					if (inline_change) {
-						zend_string_release(save);
-					}
 					RESET_CONSTANT_VISITED(p);
 					return FAILURE;
 				} else {
-					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'",  actual,  actual);
+					char *actual = Z_STRVAL_P(p);
+					size_t actual_len = Z_STRLEN_P(p);
+					char *slash = (char *) zend_memrchr(actual, '\\', actual_len);
+					if (slash) {
+						actual = slash + 1;
+						actual_len -= (actual - Z_STRVAL_P(p));
+					}
+
+					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
+					if (EG(exception)) {
+						RESET_CONSTANT_VISITED(p);
+						return FAILURE;
+					}
+
 					if (!inline_change) {
 						ZVAL_STRINGL(p, actual, actual_len);
 					} else {
-						Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
-							IS_STRING_EX : IS_INTERNED_STRING_EX;
-						if (save && ZSTR_VAL(save) != actual) {
+						if (slash) {
+							ZVAL_STRINGL(p, actual, actual_len);
 							zend_string_release(save);
+						} else {
+							Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
+								IS_STRING_EX : IS_INTERNED_STRING_EX;
 						}
 					}
 				}
@@ -862,8 +852,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 		EG(scope) = func->common.scope;
 		call->symbol_table = fci->symbol_table;
 		if (EXPECTED((func->op_array.fn_flags & ZEND_ACC_GENERATOR) == 0)) {
+			const zend_op *current_opline_before_exception = EG(opline_before_exception);
+
 			zend_init_execute_data(call, &func->op_array, fci->retval);
 			zend_execute_ex(call);
+			EG(opline_before_exception) = current_opline_before_exception;
 		} else {
 			zend_generator_create_zval(call, &func->op_array, fci->retval);
 		}
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -519,6 +519,7 @@ ZEND_API zend_generator *zend_generator_update_current(zend_generator *generator
 							generator->execute_fake.prev_execute_data = original_execute_data;
 						}

+						root->execute_data->opline--; /* ZEND_YIELD(_FROM) already advance, so decrement opline to throw from correct place */
 						zend_throw_exception(zend_ce_ClosedGeneratorException, "Generator yielded from aborted, no return value available", 0);

 						EG(current_execute_data) = original_execute_data;
@@ -872,15 +873,9 @@ ZEND_METHOD(Generator, send)
 	zval *value;
 	zend_generator *generator, *root;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &value) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(value)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	generator = (zend_generator *) Z_OBJ_P(getThis());

@@ -916,15 +911,9 @@ ZEND_METHOD(Generator, throw)
 	zval *exception, exception_copy;
 	zend_generator *generator;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &exception) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(exception)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	ZVAL_DUP(&exception_copy, exception);

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -175,7 +175,6 @@ ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_
 	GC_REFCOUNT(ht) = 1;
 	GC_TYPE_INFO(ht) = IS_ARRAY;
 	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
-	ht->nTableSize = zend_hash_check_size(nSize);
 	ht->nTableMask = HT_MIN_MASK;
 	HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 	ht->nNumUsed = 0;
@@ -183,6 +182,7 @@ ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_
 	ht->nInternalPointer = HT_INVALID_IDX;
 	ht->nNextFreeElement = 0;
 	ht->pDestructor = pDestructor;
+	ht->nTableSize = zend_hash_check_size(nSize);
 }

 static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
@@ -1447,13 +1447,17 @@ ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht)
 		} else if (ht->nNumUsed == ht->nNumOfElements) {
 			do {
 				i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-				zend_string_release(p->key);
+				if (EXPECTED(p->key)) {
+					zend_string_release(p->key);
+				}
 			} while (++p != end);
 		} else {
 			do {
 				if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF)) {
 					i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-					zend_string_release(p->key);
+					if (EXPECTED(p->key)) {
+						zend_string_release(p->key);
+					}
 				}
 			} while (++p != end);
 		}
@@ -1753,7 +1757,7 @@ static zend_always_inline void zend_array_dup_packed_elements(HashTable *source,

 static zend_always_inline uint32_t zend_array_dup_elements(HashTable *source, HashTable *target, int static_keys, int with_holes)
 {
-    uint32_t idx = 0;
+	uint32_t idx = 0;
 	Bucket *p = source->arData;
 	Bucket *q = target->arData;
 	Bucket *end = p + source->nNumUsed;
@@ -1781,7 +1785,7 @@ static zend_always_inline uint32_t zend_array_dup_elements(HashTable *source, Ha

 ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 {
-    uint32_t idx;
+	uint32_t idx;
 	HashTable *target;

 	IS_CONSISTENT(source);
@@ -1845,7 +1849,8 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 		target->u.flags = (source->u.flags & ~(HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION;
 		target->nTableMask = source->nTableMask;
 		target->nNextFreeElement = source->nNextFreeElement;
-		target->nInternalPointer = HT_INVALID_IDX;
+		target->nInternalPointer = source->nInternalPointer;
+
 		HT_SET_DATA_ADDR(target, emalloc(HT_SIZE(target)));
 		HT_HASH_RESET(target);

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -301,6 +301,16 @@ static zend_always_inline zval *zend_hash_str_find_ind(const HashTable *ht, cons
 }


+static zend_always_inline int zend_hash_str_exists_ind(const HashTable *ht, const char *str, size_t len)
+{
+	zval *zv;
+
+	zv = zend_hash_str_find(ht, str, len);
+	return zv && (Z_TYPE_P(zv) != IS_INDIRECT ||
+			Z_TYPE_P(Z_INDIRECT_P(zv)) != IS_UNDEF);
+}
+
+
 static zend_always_inline zval *zend_symtable_update(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -1180,6 +1180,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
 	function_add_ref(fn);
 	new_fn = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
 	memcpy(new_fn, fn, sizeof(zend_op_array));
+	new_fn->common.fn_flags |= ZEND_ACC_ARENA_ALLOCATED;
 	fn = zend_hash_update_ptr(&ce->function_table, key, new_fn);
 	zend_add_magic_methods(ce, key, fn);
 }
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -3,7 +3,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -46,6 +46,8 @@ int ini_parse(void);
 #define YYFREE free
 #endif

+#define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
+
 /* {{{ zend_ini_do_op()
 */
 static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
@@ -86,7 +88,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	}

 	str_len = zend_sprintf(str_result, "%d", i_result);
-	ZVAL_PSTRINGL(result, str_result, str_len);
+	ZVAL_NEW_STR(result, zend_string_init(str_result, str_len, ZEND_SYSTEM_INI));
 }
 /* }}} */

@@ -94,7 +96,11 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 */
 static void zend_ini_init_string(zval *result)
 {
-	ZVAL_EMPTY_PSTRING(result);
+	if (ZEND_SYSTEM_INI) {
+		ZVAL_EMPTY_PSTRING(result);
+	} else {
+		ZVAL_EMPTY_STRING(result);
+	}
 }
 /* }}} */

@@ -107,8 +113,12 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 	if (Z_TYPE_P(op1) != IS_STRING) {
 		zend_string *str = zval_get_string(op1);
 		/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */
-		ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
-		zend_string_release(str);
+		if (ZEND_SYSTEM_INI) {
+			ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
+			zend_string_release(str);
+		} else {
+			ZVAL_STR(op1, str);
+		}
 	}
 	op1_len = (int)Z_STRLEN_P(op1);
 	
@@ -117,7 +127,7 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 	}
 	length = op1_len + (int)Z_STRLEN_P(op2);

-	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, 1));
+	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, ZEND_SYSTEM_INI));
 	memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
 }
 /* }}} */
@@ -140,7 +150,7 @@ static void zend_ini_get_constant(zval *result, zval *name)
 			convert_to_string(&tmp);
 			c = &tmp;
 		}
-		ZVAL_PSTRINGL(result, Z_STRVAL_P(c), Z_STRLEN_P(c));
+		ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(c), Z_STRLEN_P(c), ZEND_SYSTEM_INI));
 		if (c == &tmp) {
 			zend_string_release(Z_STR(tmp));
 		}
@@ -160,11 +170,11 @@ static void zend_ini_get_var(zval *result, zval *name)

 	/* Fetch configuration option value */
 	if ((curval = zend_get_configuration_directive(Z_STR_P(name))) != NULL) {
-		ZVAL_PSTRINGL(result, Z_STRVAL_P(curval), Z_STRLEN_P(curval));
+		ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(curval), Z_STRLEN_P(curval), ZEND_SYSTEM_INI));
 	/* ..or if not found, try ENV */
 	} else if ((envvar = zend_getenv(Z_STRVAL_P(name), Z_STRLEN_P(name))) != NULL ||
 			   (envvar = getenv(Z_STRVAL_P(name))) != NULL) {
-		ZVAL_PSTRING(result, envvar);
+		ZVAL_NEW_STR(result, zend_string_init(envvar, strlen(envvar), ZEND_SYSTEM_INI));
 	} else {
 		zend_ini_init_string(result);
 	}
@@ -282,6 +292,8 @@ ZEND_API int zend_parse_ini_string(char *str, zend_bool unbuffered_errors, int s
 %left '|' '&' '^'
 %right '~' '!'

+%destructor { zval_ptr_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL
+
 %%

 statement_list:
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -110,6 +110,8 @@ ZEND_API ts_rsrc_id ini_scanner_globals_id;
 ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 #endif

+#define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
+
 /* Eat leading whitespace */
 #define EAT_LEADING_WHITESPACE()                     \
 	while (yyleng) {                                 \
@@ -137,7 +139,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 #define EAT_TRAILING_WHITESPACE()	EAT_TRAILING_WHITESPACE_EX('X')

 #define zend_ini_copy_value(retval, str, len)	\
-	ZVAL_NEW_STR(retval, zend_string_init(str, len, 1))
+	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))


 #define RETURN_TOKEN(type, str, len) {                       \
@@ -406,9 +408,9 @@ SECTION_VALUE_CHARS ([^$\n\r;"'\]\\]|("\\"{ANY_CHAR})|{LITERAL_DOLLAR})
 <INITIAL>"[" { /* Section start */
 	/* Enter section data lookup state */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
-		yy_push_state(ST_SECTION_RAW);
+		BEGIN(ST_SECTION_RAW);
 	} else {
-		yy_push_state(ST_SECTION_VALUE);
+		BEGIN(ST_SECTION_VALUE);
 	}
 	return TC_SECTION;
 }
@@ -436,7 +438,7 @@ SECTION_VALUE_CHARS ([^$\n\r;"'\]\\]|("\\"{ANY_CHAR})|{LITERAL_DOLLAR})
 	EAT_TRAILING_WHITESPACE_EX('[');

 	/* Enter offset lookup state */
-	yy_push_state(ST_OFFSET);
+	BEGIN(ST_OFFSET);

 	RETURN_TOKEN(TC_OFFSET, yytext, yyleng);
 }
@@ -490,9 +492,9 @@ SECTION_VALUE_CHARS ([^$\n\r;"'\]\\]|("\\"{ANY_CHAR})|{LITERAL_DOLLAR})

 <INITIAL>{TABS_AND_SPACES}*[=]{TABS_AND_SPACES}* { /* Start option value */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
-		yy_push_state(ST_RAW);
+		BEGIN(ST_RAW);
 	} else {
-		yy_push_state(ST_VALUE);
+		BEGIN(ST_VALUE);
 	}
 	return '=';
 }
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.16 */
 #line 3 "Zend/zend_ini_scanner_defs.h"

 enum YYCONDTYPE {
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |