This commit was manufactured by cvs2svn to create tag 'php_5_2_1'.

5.2.1
Fixed Bug #40274 (Sessions fail with numeric root keys).
2026-11-12 03:30:50 +00:00 · 2007-02-07 00:45:05 +00:00 · 2007-02-07 00:45:04 +00:00 · 2007-02-06 00:01:18 +00:00 · 2007-02-05 17:57:51 +00:00 · 2007-02-05 05:15:16 +00:00
1232 changed files with 46558 additions and 33767 deletions
@@ -67,7 +67,7 @@ php_lcov.info: lcov-test

 lcov-html: php_lcov.info
 	@echo "Generating lcov HTML"
-	@$(LTP_GENHTML) --legend --output-directory lcov_html/ --title "PHP Code Coverage" --show-details php_lcov.info
+	@$(LTP_GENHTML) --legend --output-directory lcov_html/ --title "PHP Code Coverage" php_lcov.info

 lcov-clean:
 	rm -f php_lcov.info
@@ -1,5 +1,369 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+08 Feb 2007, PHP 5.2.1
+- Added read-timeout context option "timeout" for HTTP streams. (Hannes, Ilia). 
+- Added CURLOPT_TCP_NODELAY constant to Curl extension. (Sara)
+- Added support for hex numbers of any size. (Matt)
+- Added function stream_socket_shutdown(). It is a wrapper for system 
+  shutdown() function, that shut downs part of a full-duplex connection. 
+  (Dmitry)
+- Added internal heap protection (Dmitry)
+  . memory-limit is always enabled (--enable-memory-limit removed)
+  . default value if memory-limit is set to 128M
+  . safe unlinking
+  . cookies
+  . canary protection (debug build only)
+  . random generation of cookies and canaries
+- Added forward support for 'b' prefix in front of string literals. (Andrei)
+- Added three new functions to ext/xmlwriter (Rob, Ilia)
+  . xmlwriter_start_dtd_entity()
+  . xmlwriter_end_dtd_entity()
+  . xmlwriter_write_dtd_entity()
+- Added a meta tag to phpinfo() output to prevent search engines from indexing 
+  the page. (Ilia)
+- Added new function, sys_get_temp_dir(). (Hartmut)
+- Added missing object support to file_put_contents(). (Ilia)
+- Added support for md2, ripemd256 and ripemd320 algos to hash(). (Sara)
+- Added forward support for (binary) cast. (Derick)
+- Added optimization for imageline with horizontal and vertical lines (Pierre)
+
+- Removed dependency from SHELL32.DLL. (Dmitry)
+- Removed double "wrong parameter count" warnings in various functions. 
+  (Hannes)
+- Moved extensions to PECL:
+  . ext/informix (Derick, Tony)
+
+- Changed double-to-string utilities to use BSD implementation. (Dmitry, Tony)
+- Updated bundled libcURL to version 7.16.0 in the Windows distro. (Edin)
+- Updated timezone database to version 2006.16. (Derick)
+- cgi.* and fastcgi.* directives are moved to INI subsystem. The new directive 
+  cgi.check_shebang_line can be used to omitting check for "#! /usr/bin/php" 
+  line. (Dmitry).
+- Improved proc_open(). Now on Windows it can run external commands not 
+  through CMD.EXE. (Dmitry)
+- VCWD_REALPATH() is improved to use realpath cache without VIRTUAL_DIR.
+  (Dmitry)
+- ext/bcmath initialization code is moved from request startup to module 
+  startup. (Dmitry)
+- Zend Memory Manager Improvements (Dmitry)
+  . use HeapAlloc() instead of VirtualAlloc()
+  . use "win32" storage manager (instead of "malloc") on Windows by default
+- Zip Extension Improvements (Pierre)
+  . Fixed leak in statName and stateIndex
+  . Fixed return setComment (Hannes)
+  . Added addEmptyDir method
+- Filter Extension Improvements (Ilia, Pierre)
+  . Fixed a bug when callback function returns a non-modified value.
+  . Added filter support for $_SERVER in cgi/apache2 sapis.
+  . Make sure PHP_SELF is filtered in Apache 1 sapi.
+  . Fixed bug #39358 (INSTALL_HEADERS contains incorrect reference to 
+    php_filter.h).
+  . Added "default" option that allows a default value to be set for an 
+    invalid or missing value.
+  . Invalid filters fails instead of returning unsafe value
+  . Fixed possible double encoding problem with sanitizing filters
+  . Make use of space-strict strip_tags() function
+  . Fixed whitespace trimming
+  . Added support for FastCGI environment variables. (Dmitry)
+- PDO_MySQL Extension Improvements (Ilia)
+  . Enabled buffered queries by default.
+  . Enabled prepared statement emulation by default.
+
+- Small optimization of the date() function. (Matt,Ilia)
+- Optimized the internal is_numeric_string() function. (Matt,Ilia)
+- Optimized array functions utilizing php_splice(). (Ilia)
+- Windows related optimizations (Dmitry, Stas)
+  . COM initialization/deinitialization are done only if necessary
+  . removed unnecessary checks for ISREG file and corresponding stat() calls
+  . opendir() is reimplementation using GetFistFile/GetNextFile those are 
+    faster then _findfirst/_findnext
+  . implemented registry cache that prevent registry lookup on each request. 
+    In case of modification of corresponding registry-tree PHP will reload it 
+    automatic
+  . start timeout thread only if necessary
+  . stat() is reimplementation using GetFileAttributesEx(). The new 
+    implementation is faster then implementation in MS VC CRT, but it doesn't
+    support Windows 95.
+- Streams optimization (Dmitry)
+  . removed unnecessary ftell() calls (one call for each included PHP file)
+  . disabled calls to read() after EOF
+
+- Fixed incorrect function names on FreeBSD where inet_pton() was named 
+  __inet_pton() and inet_ntop() was named __inet_ntop(). (Hannes)
+- Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry)
+- Fixed wrong signature initialization in imagepng (Takeshi Abe)
+- Fixed ftruncate() with negative size on FreeBSD. (Hannes)
+- Fixed segfault in RegexIterator when given invalid regex. (Hannes)
+- Fixed segfault in SplFileObject->openFile()->getPathname(). (Hannes)
+- Fixed segfault in ZTS mode when OCI8 statements containing sub-statements 
+  are destroyed in wrong order. (Tony)
+- Fixed the validate email filter so that the letter "v" can also be used in
+  the user part of the email address. (Derick)
+- Fixed bug #40297 (compile failure in ZTS mode when collections support is 
+  missing). (Tony)
+- Fixed bug #40285 (The PDO prepare parser goes into an infinite loop in
+  some instances). (Ilia)
+- Fixed Bug #40274 (Sessions fail with numeric root keys). (Ilia)
+- Fixed bug #40259 (ob_start call many times - memory error). (Dmitry)
+- Fixed bug #40231 (file_exists incorrectly reports false). (Dmitry)
+- Fixed bug #40228 (ZipArchive::extractTo does create empty directories 
+  recursively). (Pierre)
+- Fixed bug #40200 (The FastCgi version has different realpath results than 
+  thread safe version). (Dmitry)
+- Fixed bug #40191 (use of array_unique() with objects triggers segfault). 
+  (Tony)
+- Fixed bug #40189 (possible endless loop in zlib.inflate stream filter).
+  (Greg, Tony)
+- Fixed bug #40169 (CURLOPT_TCP_NODELAY only available in curl >= 7.11.2). 
+  (Tony)
+- Fixed bug #40129 (iconv extension doesn't compile with CodeWarrior on 
+  Netware). (gk at gknw dot de, Tony)
+- Fixed bug #40127 (apache2handler doesn't compile on Netware). 
+  (gk at gknw dot de)
+- Fixed bug #40121 (PDO_DBLIB driver wont free statements). (Ilia)
+- Fixed bug #40098 (php_fopen_primary_script() not thread safe). (Ilia)
+- Fixed bug #40092 (chroot() doesn't clear realpath cache). (Dmitry)
+- Fixed bug #40091 (spl_autoload_register with 2 instances of the same class).
+  (Ilia)
+- Fixed bug #40083 (milter SAPI functions always return false/null). (Tony)
+- Fixed bug #40079 (php_get_current_user() not thread safe).
+  (Ilia, wharmby at uk dot ibm dot com)
+- Fixed bug #40078 (ORA-01405 when fetching NULL values using
+  oci_bind_array_by_name()). (Tony)
+- Fixed bug #40076 (zend_alloc.c: Value of enumeration constant must be in 
+  range of signed integer). (Dmitry)
+- Fixed bug #40073 (exif_read_data dies on certain images). (Tony, Marcus)
+- Fixed bug #40036 (empty() does not work correctly with ArrayObject when 
+  using ARRAY_AS_PROPS). (Ilia)
+- Fixed bug #40012 (php_date.c doesn't compile on Netware).
+  (gk at gknw dot de, Derick)
+- Fixed bug #40009 (http_build_query(array()) returns NULL). (Ilia)
+- Fixed bug #40002 (Try/Catch performs poorly). (Dmitry)
+- Fixed bug #39993 (tr_TR.UTF-8 locale has problems with PHP). (Ilia)
+- Fixed bug #39990 (Cannot "foreach" over overloaded properties). (Dmitry)
+- Fixed bug #39988 (type argument of oci_define_by_name() is ignored).
+  (Chris Jones, Tony)
+- Fixed bug #39984 (redirect response code in header() could be ignored 
+  in CGI sapi). (Ilia)
+- Fixed bug #39979 (PGSQL_CONNECT_FORCE_NEW will causes next connect to 
+  establish a new connection). (Ilia)
+- Fixed bug #39971 (pg_insert/pg_update do not allow now() to be used 
+  for timestamp fields). (Ilia)
+- Fixed bug #39969 (ini setting short_open_tag has no effect when using 
+  --enable-maintainer-zts). (Dmitry)
+- Fixed bug #39952 (zip ignoring --with-libdir on zlib checks)
+  (judas dot iscariote at gmail dot com)
+- Fixed bug #39944 (References broken). (Dmitry)
+- Fixed bug #39935 (Extensions tidy,mcrypt,mhash,pdo_sqlite ignores 
+  --with-libdir). (judas dot iscariote at gmail dot com, Derick)
+- Fixed bug #39903 (Notice message when executing __halt_compiler() more than
+  once). (Tony)
+- Fixed bug #39898 (FILTER_VALIDATE_URL validates \r\n\t etc). (Ilia)
+- Fixed bug #39890 (using autoconf 2.6x and --with-layout=GNU breaks PEAR
+  install path). (Tony)
+- Fixed bug #39884 (ReflectionParameter::getClass() throws exception for 
+  type hint self). (thekid at php dot net)
+- Fixed bug #39878 (CURL doesn't compile on Sun Studio Pro). (Ilia)
+- Fixed bug #39873 (number_format() breaks with locale & decimal points).
+  (Ilia)
+- Fixed bug #39869 (safe_read does not initialize errno).
+  (michiel at boland dot org, Dmitry)
+- Fixed bug #39850 (SplFileObject throws contradictory/wrong error messages
+  when trying to open "php://wrong"). (Tony)
+- Fixed bug #39846 (Invalid IPv4 treated as valid). (Ilia)
+- Fixed bug #39845 (Persistent connections generate a warning in pdo_pgsql).
+  (Ilia)
+- Fixed bug #39832 (SOAP Server: parameter not matching the WSDL specified 
+  type are set to 0). (Dmitry)
+- Fixed bug #39825 (foreach produces memory error). (Dmitry)
+- Fixed bug #39816 (apxs2filter ignores httpd.conf & .htaccess php config 
+  settings). (Ilia)
+- Fixed bug #39815 (SOAP double encoding is not locale-independent). (Dmitry)
+- Fixed bug #39797 (virtual() does not reset changed INI settings). (Ilia) 
+- Fixed bug #39795 (build fails on AIX because crypt_r() uses different 
+  data struct). (Tony)
+- Fixed bug #39791 (Crash in strtotime() on overly long relative date 
+  multipliers). (Ilia)
+- Fixed bug #39787 (PHP doesn't work with Apache 2.3).
+  (mv at binarysec dot com).
+- Fixed bug #39782 (setTime() on a DateTime constructed with a Weekday 
+  yields incorrect results). (Ilia)
+- Fixed bug #39780 (PNG image with CRC/data error raises fatal error) (Pierre)
+- Fixed bug #39779 (Enable AUTH PLAIN mechanism in underlying libc-client).
+  (michael dot heimpold at s2000 dot tu-chemnitz dot de, Ilia)
+- Fixed bug #39775 ("Indirect modification ..." message is not shown).
+  (Dmitry)
+- Fixed bug #39763 (magic quotes are applied twice by ext/filter in 
+  parse_str()). (Ilia) 
+- Fixed bug #39760 (cloning fails on nested SimpleXML-Object). (Rob)
+- Fixed bug #39759 (Can't use stored procedures fetching multiple result 
+  sets in pdo_mysql). (Ilia)
+- Fixed bug #39754 (Some POSIX extension functions not thread safe).
+  (Ilia, wharmby at uk dot ibm dot com)
+- Fixed bug #39751 (putenv crash on Windows). (KevinJohnHoffman at gmail.com)
+- Fixed bug #39732 (oci_bind_array_by_name doesn't work on Solaris 64bit).
+  (Tony)
+- Fixed bug #39724 (Broken build due to spl/filter usage of pcre extension).
+  (Tony, Ilia)
+- Fixed bug #39718 (possible crash if assert.callback is set in ini). (Ilia)
+- Fixed bug #39702 (php crashes in the allocator on linux-m68k). (Dmitry)
+- Fixed bug #39685 (iconv() - undefined function). (Hannes)
+- Fixed bug #39673 (file_get_contents causes bus error on certain offsets).
+  (Tony)
+- Fixed bug #39663 (Memory leak in pg_get_notify() and a possible memory 
+  corruption on Windows in pgsql and pdo_pgsql extensions).
+  (Ilia, matteo at beccati dot com)
+- Fixed bug #39662 (Segfault when calling asXML() of a cloned 
+  SimpleXMLElement). (Rob, Tony)
+- Fixed bug #39656 (crash when calling fetch() on a PDO statment object after
+  closeCursor()). (Ilia, Tony)
+- Fixed bug #39653 (ext/dba doesn't check for db-4.5 and db-4.4 when db4
+  support is enabled). (Tony)
+- Fixed bug #39652 (Wrong negative results from memory_get_usage()). (Dmitry)
+- Fixed bug #39648 (Implementation of PHP functions chown() and chgrp() are 
+  not thread safe). (Ilia, wharmby at uk dot ibm dot com)
+- Fixed bug #39640 (Segfault with "Allowed memory size exhausted"). (Dmitry)
+- Fixed bug #39625 (Apache crashes on importStylesheet call). (Rob)
+- Fixed bug #39623 (thread safety fixes on *nix for putenv() & mime_magic).
+  (Ilia, wharmby at uk dot ibm dot com)
+- Fixed bug #39621 (str_replace() is not binary safe on strings with equal
+  length). (Tony)
+- Fixed bug #39613 (Possible segfault in imap initialization due to missing
+  module dependency). (wharmby at uk dot ibm dot com, Tony)
+- Fixed bug #39606 (Use of com.typelib_file in PHP.ini STILL causes A/V). (Rob)
+- Fixed bug #39602 (Invalid session.save_handler crashes PHP). (Dmitry)
+- Fixed bug #39596 (Creating Variant of type VT_ARRAY). (Rob)
+- Fixed bug #39583 (ftp_put() does not change transfer mode to ASCII). (Tony)
+- Fixed bug #39576 (array_walk() doesn't separate user data zval). (Tony)
+- Fixed bug #39575 (move_uploaded_file() no longer working (safe mode 
+  related)). (Tony)
+- Fixed bug #39571 (timeout ssl:// connections). (Ilia)
+- Fixed bug #39564 (PDO::errorInfo() returns inconsistent information when 
+  sqlite3_step() fails). (Tony)
+- Fixed bug #39548 (ZMSG_LOG_SCRIPT_NAME not routed to OutputDebugString()
+  on Windows). (Dmitry)
+- Fixed bug #39538 (fgetcsv can't handle starting newlines and trailing odd
+  number of backslashes). (David Soria Parra, Pierre)
+- Fixed bug #39534 (Error in maths to calculate of 
+  ZEND_MM_ALIGNED_MIN_HEADER_SIZE). (wharmby at uk dot ibm dot com, Dmitry)
+- Fixed bug #39527 (Failure to retrieve results when multiple unbuffered,
+  prepared statements are used in pdo_mysql). (Ilia)
+- Fixed bug #39508 (imagefill crashes with small images 3 pixels or less).
+  (Pierre)
+- Fixed bug #39506 (Archive corrupt with ZipArchive::addFile method). (Pierre)
+- Fixed bug #39504 (xmlwriter_write_dtd_entity() creates Attlist tag, not 
+  entity). (Hannes)
+- Fixed bug #39483 (Problem with handling of \ char in prepared statements).
+  (Ilia, suhachov at gmail dot com)
+- Fixed bug #39458 (ftp_nlist() returns false on empty dirs). (Nuno)
+- Fixed bug #39454 (Returning a SOAP array segfaults PHP). (Dmitry)
+- Fixed bug #39450 (getenv() fills other super-globals). (Ilia, Tony)
+- Fixed bug #39449 (Overloaded array properties do not work correctly).
+  (Dmitry)
+- Fixed bug #39445 (Calling debug_backtrace() in the __toString()
+  function produces a crash). (Dmitry)
+- Fixed bug #39438 (Fatal error: Out of memory). (Dmitry)
+- Fixed bug #39435 ('foo' instanceof bar gives invalid opcode error). (Sara)
+- Fixed bug #39414 (Syntax error while compiling with Sun Workshop Complier).
+  (Johannes)
+- Fixed bug #39398 (Booleans are not automatically translated to integers).
+  (Ilia)
+- Fixed bug #39394 (Missing check for older variants of openssl). (Ilia)
+- Fixed bug #39367 (clearstatcache() doesn't clear realpath cache).
+  (j at pureftpd dot org, Dmitry)
+- Fixed bug #39366 (imagerotate does not use alpha with angle > 45 degrees)
+  (Pierre)
+- Fixed bug #39364 (Removed warning on empty haystack inside mb_strstr()).
+  (Ilia)
+- Fixed bug #39362 (Added an option to imap_open/imap_reopen to control the
+  number of connection retries). (Ilia)
+- Fixed bugs #39361 & #39400 (mbstring function overloading problem). (Seiji)
+- Fixed bug #39354 (Allow building of curl extension against libcurl
+  7.16.0). (Ilia) 
+- Fixed bug #39350 (crash with implode("\n", array(false))). (Ilia)
+- Fixed bug #39344 (Unnecessary calls to OnModify callback routine for
+  an extension INI directive). (wharmby at uk dot ibm dot com, Dmitry)
+- Fixed bug #39320 (ZEND_HASH_APPLY_STOP causes deletion). (Marcus)
+- Fixed bug #39313 (spl_autoload triggers Fatal error). (Marcus)
+- Fixed bug #39300 (make install fails if wget is not available). (Tony)
+- Fixed bug #39297 (Memory corruption because of indirect modification of
+  overloaded array). (Dmitry)
+- Fixed bug #39286 (misleading error message when invalid dimensions are
+  given) (Pierre)
+- Fixed bug #39273 (imagecopyresized may ignore alpha channel) (Pierre)
+- Fixed bug #39265 (Fixed path handling inside mod_files.sh).
+  (michal dot taborsky at gmail dot com, Ilia)
+- Fixed bug #39217 (serialNumber might be -1 when the value is too large).
+  (Pierre, Tony)
+- Fixed bug #39215 (Inappropriate close of stdin/stdout/stderr). (Wez, Ilia)
+- Fixed bug #39201 (Possible crash in Apache 2 with 413 ErrorHandler). (Ilia)
+- Fixed bug #39151 (Parse error in recursiveiteratoriterator.php). (Marcus)
+- Fixed bug #39121 (Incorrect return array handling in non-wsdl soap client).
+  (Dmitry)
+- Fixed bug #39090 (DirectoryFilterDots doxygen docs and example is wrong).
+  (Marcus)
+- Fixed bug #38852 (XML-RPC Breaks iconv). (Hannes)
+- Fixed bug #38770 (unpack() broken with longs on 64 bit machines).
+  (Ilia, David Soria Parra).
+- Fixed bug #38698 (for some keys cdbmake creates corrupted db and cdb can't
+  read valid db). (Marcus)
+- Fixed bug #38680 (Added missing handling of basic types in json_decode).
+  (Ilia)
+- Fixed bug #38604 (Fixed request time leak inside foreach() when iterating
+  through virtual properties). (Dmitry)
+- Fixed bug #38602 (header( "HTTP/1.0 ..." ) does not change proto version).
+  (Ilia)
+- Fixed bug #38542 (proc_get_status() returns wrong PID on windows). (Nuno)
+- Fixed bug #38536 (SOAP returns an array of values instead of an object).
+  (Dmitry)
+- Fixed bug #38456 (Apache2 segfaults when virtual() is called in .php 
+  ErrorDocument). (Ilia)
+- Fixed bug #38325 (spl_autoload_register() gives wrong line for "class not
+  found"). (Ilia)
+- Fixed bug #38319 (Remove bogus warnings from persistent PDO connections).
+  (Ilia)
+- Fixed bug #38274 (Memlimit fatal error sent to "wrong" stderr when using
+  fastcgi). (Dmitry)
+- Fixed bug #38252 (Incorrect PDO error message on invalid default fetch
+  mode). (Ilia)
+- Fixed bug #37927 (Prevent trap when COM extension processes argument of
+  type VT_DISPATCH|VT_REF) (Andy)
+- Fixed bug #37773 (iconv_substr() gives "Unknown error" when string
+  length = 1"). (Ilia)
+- Fixed bug #37627 (session save_path check checks the parent directory).
+  (Ilia)
+- Fixed bug #37619 (proc_open() closes stdin on fork() failure).
+  (jdolecek at NetBSD dot org, Nuno)
+- Fixed bug #37588 (COM Property propputref converts to PHP function
+  and can't be accesed). (Rob)
+- Fixed bug #36975 (natcasesort() causes array_pop() to misbehave).
+  (Hannes)
+- Fixed bug #36812 (pg_execute() modifies input array). (Ilia)
+- Fixed bug #36798 (Error parsing named parameters with queries containing
+  high-ascii chars). (Ilia)
+- Fixed bug #36644 (possible crash in variant_date_from_timestamp()). (Ilia)
+- Fixed bug #36427 (proc_open() / proc_close() leak handles on windows).
+  (jdolecek at NetBSD dot org, Nuno)
+- Fixed bug #36392 (wrong number of decimal digits with %e specifier in
+  sprintf). (Matt,Ilia)
+- Fixed bug #36214 (__get method works properly only when conditional
+  operator is used). (Dmitry)
+- Fixed bug #35634 (Erroneous "Class declarations may not be nested"
+  error raised). (Carl P. Corliss, Dmitry)
+- Fixed bug #35106 (nested foreach fails when array variable has a
+  reference). (Dmitry)
+- Fixed bug #34564 (COM extension not returning modified "out" argument) (Andy)
+- Fixed bug #33734 (Something strange with COM Object). (Rob)
+- Fixed bug #33386 (ScriptControl only sees last function of class). (Rob)
+- Fixed bug #33282 (Re-assignment by reference does not clear the is_ref
+  flag) (Ilia, Dmitry, Matt Wilmas)
+- Fixed bug #30074 (apparent symbol table error with 
+  extract($blah, EXTR_REFS)) (Brian)
+- Fixed bug #29840 (is_executable() does not honor safe_mode_exec_dir 
+  setting). (Ilia)
+- Fixed PECL bug #7295 (ORA-01405: fetched column value is NULL on LOB
+  fields). (Tony)
+
 02 Nov 2006, PHP 5.2.0
 - Updated bundled OpenSSL to version 0.9.8d in the Windows distro. (Edin)
 - Updated Postgresql client libraries to 8.1.4 in the Windows distro. (Edin)
@@ -167,6 +531,7 @@ PHP                                                                        NEWS
  being applied when RAW filter is used. (Ilia)
 - Fixed memory leaks in openssl streams context options. (Pierre)
 - Fixed handling of extremely long paths inside tempnam() function. (Ilia)
+- Fixed bug #39721 (Runtime inheritance causes data corruption). (Dmitry)
 - Fixed bug #39304 (Segmentation fault with list unpacking of string offset).
  (Dmitry)
 - Fixed bug #39192 (Not including nsapi.h properly with SJSWS 7). This will
@@ -51,8 +51,8 @@ Type specifiers
 	    passed to it.
 	/ - use SEPARATE_ZVAL_IF_NOT_REF() on the parameter it follows
 	! - the parameter it follows can be of specified type or NULL (only applies
-	    to 'a', 'o', 'O', 'r', and 'z'). If NULL is passed, the results
-	    pointer is set to NULL as well.
+		to 's', 'a', 'o', 'O', 'r', 'h', 'C', 'z', and 'Z'). If NULL is passed,
+	 	the results pointer is set to NULL as well.

 Examples
 --------
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Thread Safe Resource Manager                                         |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1999-2006, Andi Gutmans, Sascha Schumann, Zeev Suraski |
+   | Copyright (c) 1999-2007, Andi Gutmans, Sascha Schumann, Zeev Suraski |
   | This source file is subject to the TSRM license, that is bundled     |
   | with this package in the file LICENSE                                |
   +----------------------------------------------------------------------+
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Thread Safe Resource Manager                                         |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1999-2006, Andi Gutmans, Sascha Schumann, Zeev Suraski |
+   | Copyright (c) 1999-2007, Andi Gutmans, Sascha Schumann, Zeev Suraski |
   | This source file is subject to the TSRM license, that is bundled     |
   | with this package in the file LICENSE                                |
   +----------------------------------------------------------------------+
@@ -7,11 +7,15 @@
 * on Windows 95/NT.
 */

+#define _WIN32_WINNT 0x0400
+
+#include <windows.h>
+
 #include <io.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/types.h>
-
+#include <direct.h>

 /* struct dirent - same as Unix */

@@ -25,10 +29,10 @@ struct dirent {

 /* typedef DIR - not the same as Unix */
 typedef struct {
-	long handle;				/* _findfirst/_findnext handle */
+	HANDLE handle;				/* _findfirst/_findnext handle */
 	short offset;				/* offset into directory */
 	short finished;				/* 1 if there are not more files */
-	struct _finddata_t fileinfo;	/* from _findfirst/_findnext */
+	WIN32_FIND_DATA fileinfo;	/* from _findfirst/_findnext */
 	char *dir;					/* the dir we are reading */
 	struct dirent dent;			/* the dirent to return */
 } DIR;
@@ -38,7 +42,6 @@ DIR *opendir(const char *);
 struct dirent *readdir(DIR *);
 int readdir_r(DIR *, struct dirent *, struct dirent **);
 int closedir(DIR *);
-void rewinddir(DIR *);
-
+int rewinddir(DIR *);

 #endif /* READDIR_H */
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -35,11 +35,6 @@
 #ifdef TSRM_WIN32
 #include <io.h>
 #include "tsrm_win32.h"
-# if HAVE_NEWAPIS_H
-#  define WANT_GETLONGPATHNAME_WRAPPER
-#  define COMPILE_NEWAPIS_STUBS
-#  include <NewAPIs.h>
-# endif
 #endif

 #ifdef NETWARE
@@ -140,11 +135,93 @@ static int php_check_dots(const char *element, int n)
 #define CWD_STATE_FREE(s)			\
 	free((s)->cwd);
 	
+#ifdef TSRM_WIN32
+CWD_API int php_sys_stat(const char *path, struct stat *buf)
+{
+	WIN32_FILE_ATTRIBUTE_DATA data;
+	__int64 t;
+
+	if (!GetFileAttributesEx(path, GetFileExInfoStandard, &data)) {
+		return stat(path, buf);
+	}
+
+	if (path[1] == ':') {
+		if (path[0] >= 'A' && path[0] <= 'Z') {
+			buf->st_dev = buf->st_rdev = path[0] - 'A';
+		} else {
+			buf->st_dev = buf->st_rdev = path[0] - 'a';
+		}
+	} else {
+		char  cur_path[MAXPATHLEN+1];
+		DWORD len = sizeof(cur_path);
+		char *tmp = cur_path;
+
+		while(1) {
+			DWORD r = GetCurrentDirectory(len, tmp);
+			if (r < len) {
+				if (tmp[1] == ':') {
+					if (path[0] >= 'A' && path[0] <= 'Z') {
+						buf->st_dev = buf->st_rdev = path[0] - 'A';
+					} else {
+						buf->st_dev = buf->st_rdev = path[0] - 'a';
+					}
+				} else {
+					buf->st_dev = buf->st_rdev = -1;
+				}
+				break;
+			} else if (!r) {
+				buf->st_dev = buf->st_rdev = -1;
+				break;
+			} else {
+				len = r+1;
+				tmp = (char*)malloc(len);
+			}
+		}
+		if (tmp != cur_path) {
+			free(tmp);
+		}		    	
+	}
+	buf->st_uid = buf->st_gid = buf->st_ino = 0;
+	buf->st_mode = (data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) ? (S_IFDIR|S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6)) : S_IFREG;
+	buf->st_mode |= (data.dwFileAttributes & FILE_ATTRIBUTE_READONLY) ? (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)) : (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)|S_IWRITE|(S_IWRITE>>3)|(S_IWRITE>>6));
+	if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
+		int len = strlen(path);
+
+		if (path[len-4] == '.') {
+			if (_memicmp(path+len-3, "exe", 3) == 0 ||
+			    _memicmp(path+len-3, "com", 3) == 0 ||
+			    _memicmp(path+len-3, "bat", 3) == 0 ||
+			    _memicmp(path+len-3, "cmd", 3) == 0) {
+				buf->st_mode  |= (S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6));
+			}
+		}
+	}			
+    buf->st_nlink = 1;
+	t = data.nFileSizeHigh;
+	t = t << 32;
+	t |= data.nFileSizeLow;
+	buf->st_size = t;
+	t = data.ftLastAccessTime.dwHighDateTime;
+	t = t << 32;
+	t |= data.ftLastAccessTime.dwLowDateTime;
+	buf->st_atime = (unsigned long)((t / 10000000) - 11644473600);
+	t = data.ftCreationTime.dwHighDateTime;
+	t = t << 32;
+	t |= data.ftCreationTime.dwLowDateTime;
+	buf->st_ctime = (unsigned long)((t / 10000000) - 11644473600);
+	t = data.ftLastWriteTime.dwHighDateTime;
+	t = t << 32;
+	t |= data.ftLastWriteTime.dwLowDateTime;
+	buf->st_mtime = (unsigned long)((t / 10000000) - 11644473600);
+	return 0;
+}
+#endif
+
 static int php_is_dir_ok(const cwd_state *state) 
 {
 	struct stat buf;

-	if (stat(state->cwd, &buf) == 0 && S_ISDIR(buf.st_mode))
+	if (php_sys_stat(state->cwd, &buf) == 0 && S_ISDIR(buf.st_mode))
 		return (0);

 	return (1);
@@ -154,7 +231,7 @@ static int php_is_file_ok(const cwd_state *state)
 {
 	struct stat buf;

-	if (stat(state->cwd, &buf) == 0 && S_ISREG(buf.st_mode))
+	if (php_sys_stat(state->cwd, &buf) == 0 && S_ISREG(buf.st_mode))
 		return (0);

 	return (1);
@@ -172,18 +249,7 @@ static void cwd_globals_ctor(virtual_cwd_globals *cwd_globals TSRMLS_DC)
 static void cwd_globals_dtor(virtual_cwd_globals *cwd_globals TSRMLS_DC)
 {
 	CWD_STATE_FREE(&cwd_globals->cwd);
-	{
-		int i;
-
-		for (i = 0; i < sizeof(cwd_globals->realpath_cache)/sizeof(cwd_globals->realpath_cache[0]); i++) {
-			realpath_cache_bucket *p = cwd_globals->realpath_cache[i];
-			while (p != NULL) {
-				realpath_cache_bucket *r = p;
-				p = p->next;
-				free(r);
-			}
-		}
-	}
+	realpath_cache_clean(TSRMLS_C);
 }

 static char *tsrm_strndup(const char *s, size_t length)
@@ -306,14 +372,51 @@ CWD_API char *virtual_getcwd(char *buf, size_t size TSRMLS_DC)

 static inline unsigned long realpath_cache_key(const char *path, int path_len)
 {
-  register unsigned long h;
+	register unsigned long h;
+	const char *e = path + path_len;

-  const char *e = path + path_len;
-  for (h = 2166136261U; path < e; ) {
-    h *= 16777619;
-    h ^= *path++;
-  }
-  return h;
+	for (h = 2166136261U; path < e;) {
+		h *= 16777619;
+		h ^= *path++;
+	}
+
+	return h;
+}
+
+CWD_API void realpath_cache_clean(TSRMLS_D)
+{
+	int i;
+
+	for (i = 0; i < sizeof(CWDG(realpath_cache))/sizeof(CWDG(realpath_cache)[0]); i++) {
+		realpath_cache_bucket *p = CWDG(realpath_cache)[i];
+		while (p != NULL) {
+			realpath_cache_bucket *r = p;
+			p = p->next;
+			free(r);
+		}
+		CWDG(realpath_cache)[i] = NULL;
+	}
+	CWDG(realpath_cache_size) = 0;
+}
+
+CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC)
+{
+	unsigned long key = realpath_cache_key(path, path_len);
+	unsigned long n = key % (sizeof(CWDG(realpath_cache)) / sizeof(CWDG(realpath_cache)[0]));
+	realpath_cache_bucket **bucket = &CWDG(realpath_cache)[n];
+
+	while (*bucket != NULL) {
+		if (key == (*bucket)->key && path_len == (*bucket)->path_len &&
+		           memcmp(path, (*bucket)->path, path_len) == 0) {
+			realpath_cache_bucket *r = *bucket;
+			*bucket = (*bucket)->next;
+			CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
+			free(r);
+			return;
+		} else {
+			bucket = &(*bucket)->next;
+		}
+	}
 }

 static inline void realpath_cache_add(const char *path, int path_len, const char *realpath, int realpath_len, time_t t TSRMLS_DC)
@@ -334,7 +437,7 @@ static inline void realpath_cache_add(const char *path, int path_len, const char
 		n = bucket->key % (sizeof(CWDG(realpath_cache)) / sizeof(CWDG(realpath_cache)[0]));
 		bucket->next = CWDG(realpath_cache)[n];
 		CWDG(realpath_cache)[n] = bucket;
-	  CWDG(realpath_cache_size) += size;
+		CWDG(realpath_cache_size) += size;
 	}
 }

@@ -405,7 +508,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 		path_length = orig_path_len; 
 	}

-	if (use_realpath && CWDG(realpath_cache_size_limit)) {
+	if (use_realpath != CWD_EXPAND && CWDG(realpath_cache_size_limit)) {
 		t = CWDG(realpath_cache_ttl)?time(NULL):0;
 		if ((bucket = realpath_cache_find(path, path_length, t TSRMLS_CC)) != NULL) {		
 			int len = bucket->realpath_len;
@@ -425,11 +528,14 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 		}
 	}

-	if (use_realpath) {
+	if (use_realpath != CWD_EXPAND) {
 #if !defined(TSRM_WIN32) && !defined(NETWARE)
 		char resolved_path[MAXPATHLEN];

 		if (!realpath(path, resolved_path)) {  /* Note: Not threadsafe on older *BSD's */
+			if (use_realpath == CWD_REALPATH) {
+				return 1;
+			}
 			goto no_realpath;
 		}
 		CWD_STATE_COPY(&old_state, state);
@@ -444,6 +550,9 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 		char *ptr, *path_copy, *free_path;
 		char *tok = NULL;
 		int ptr_length;
+#ifdef TSRM_WIN32
+		int is_unc = 0;
+#endif

 no_realpath:

@@ -464,6 +573,7 @@ no_realpath:
 			state->cwd[1] = '\0';
 			state->cwd_length = 1;
 			path_copy += 2;
+			is_unc = 2;
 		} else {
 #endif
 			state->cwd = (char *) realloc(state->cwd, 1);
@@ -529,7 +639,7 @@ no_realpath:
 				memcpy(&state->cwd[state->cwd_length], ptr, ptr_length+1);

 #ifdef TSRM_WIN32
-				if (use_realpath) {
+				if (use_realpath != CWD_EXPAND) {
 					WIN32_FIND_DATA data;
 					HANDLE hFind;

@@ -542,6 +652,15 @@ no_realpath:
 						memcpy(&state->cwd[state->cwd_length], data.cFileName, length+1);
 						ptr_length = length;
 						FindClose(hFind);
+					} else if (use_realpath == CWD_REALPATH) {
+						if (is_unc) {
+							is_unc--;
+						} else {
+							free(free_path);
+							CWD_STATE_FREE(state);
+							*state = old_state;					
+							return 1;
+						}
 					}
 				}
 #endif
@@ -561,7 +680,7 @@ no_realpath:
 		}
 	}

-	if (use_realpath && CWDG(realpath_cache_size_limit)) {
+	if (use_realpath != CWD_EXPAND && CWDG(realpath_cache_size_limit)) {
 		realpath_cache_add(path, path_length, state->cwd, state->cwd_length, t TSRMLS_CC);
 	}

@@ -582,7 +701,7 @@ no_realpath:

 CWD_API int virtual_chdir(const char *path TSRMLS_DC)
 {
-	return virtual_file_ex(&CWDG(cwd), path, php_is_dir_ok, 1)?-1:0;
+	return virtual_file_ex(&CWDG(cwd), path, php_is_dir_ok, CWD_REALPATH)?-1:0;
 }

 CWD_API int virtual_chdir_file(const char *path, int (*p_chdir)(const char *path TSRMLS_DC) TSRMLS_DC)
@@ -624,7 +743,7 @@ CWD_API char *virtual_realpath(const char *path, char *real_path TSRMLS_DC)

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
 	
-	if (virtual_file_ex(&new_state, path, NULL, 1)==0) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)==0) {
 		int len = new_state.cwd_length>MAXPATHLEN-1?MAXPATHLEN-1:new_state.cwd_length;

 		memcpy(real_path, new_state.cwd, len);
@@ -645,7 +764,7 @@ CWD_API int virtual_filepath_ex(const char *path, char **filepath, verify_path_f
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	retval = virtual_file_ex(&new_state, path, verify_path, 1);
+	retval = virtual_file_ex(&new_state, path, verify_path, CWD_FILEPATH);

 	*filepath = new_state.cwd;

@@ -668,7 +787,8 @@ CWD_API FILE *virtual_fopen(const char *path, const char *mode TSRMLS_DC)
 	}

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 1)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_FILEPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return NULL;
 	}

@@ -684,7 +804,8 @@ CWD_API int virtual_access(const char *pathname, int mode TSRMLS_DC)
 	int ret;
 	
 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, pathname, NULL, 1)) {
+	if (virtual_file_ex(&new_state, pathname, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -707,7 +828,8 @@ CWD_API int virtual_utime(const char *filename, struct utimbuf *buf TSRMLS_DC)
 	int ret;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, filename, NULL, 0)) {
+	if (virtual_file_ex(&new_state, filename, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -724,7 +846,8 @@ CWD_API int virtual_chmod(const char *filename, mode_t mode TSRMLS_DC)
 	int ret;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, filename, NULL, 1)) {
+	if (virtual_file_ex(&new_state, filename, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -741,7 +864,8 @@ CWD_API int virtual_chown(const char *filename, uid_t owner, gid_t group, int li
 	int ret;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, filename, NULL, 0)) {
+	if (virtual_file_ex(&new_state, filename, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -766,7 +890,8 @@ CWD_API int virtual_open(const char *path TSRMLS_DC, int flags, ...)
 	int f;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 1)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_FILEPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -792,7 +917,8 @@ CWD_API int virtual_creat(const char *path, mode_t mode TSRMLS_DC)
 	int f;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 1)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_FILEPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -809,13 +935,16 @@ CWD_API int virtual_rename(char *oldname, char *newname TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&old_state, &CWDG(cwd));
-	if (virtual_file_ex(&old_state, oldname, NULL, 0)) {
+	if (virtual_file_ex(&old_state, oldname, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&old_state);
 		return -1;
 	}
 	oldname = old_state.cwd;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, newname, NULL, 0)) {
+	if (virtual_file_ex(&new_state, newname, NULL, CWD_FILEPATH)) {
+		CWD_STATE_FREE(&old_state);
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}
 	newname = new_state.cwd;
@@ -834,11 +963,12 @@ CWD_API int virtual_stat(const char *path, struct stat *buf TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 1)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

-	retval = stat(new_state.cwd, buf);
+	retval = php_sys_stat(new_state.cwd, buf);

 	CWD_STATE_FREE(&new_state);
 	return retval;
@@ -851,7 +981,8 @@ CWD_API int virtual_lstat(const char *path, struct stat *buf TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 0)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -868,7 +999,8 @@ CWD_API int virtual_unlink(const char *path TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, path, NULL, 0)) {
+	if (virtual_file_ex(&new_state, path, NULL, CWD_EXPAND)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -884,7 +1016,8 @@ CWD_API int virtual_mkdir(const char *pathname, mode_t mode TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, pathname, NULL, 1)) {
+	if (virtual_file_ex(&new_state, pathname, NULL, CWD_FILEPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -903,7 +1036,8 @@ CWD_API int virtual_rmdir(const char *pathname TSRMLS_DC)
 	int retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, pathname, NULL, 0)) {
+	if (virtual_file_ex(&new_state, pathname, NULL, CWD_EXPAND)) {
+		CWD_STATE_FREE(&new_state);
 		return -1;
 	}

@@ -923,7 +1057,8 @@ CWD_API DIR *virtual_opendir(const char *pathname TSRMLS_DC)
 	DIR *retval;

 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
-	if (virtual_file_ex(&new_state, pathname, NULL, 1)) {
+	if (virtual_file_ex(&new_state, pathname, NULL, CWD_REALPATH)) {
+		CWD_STATE_FREE(&new_state);
 		return NULL;
 	}

@@ -1033,25 +1168,36 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC)

 #endif

-/* On AIX & Tru64 when a file does not exist realpath() returns
- * NULL, and sets errno to ENOENT. Unlike in other libc implementations
- * the destination is not filled and remains undefined. Therefor, we
- * must populate it manually using strcpy as done on systems with no
- * realpath() function.
- */
-#if defined(__osf__) || defined(_AIX)
-char *php_realpath_hack(const char *src, char *dest)
+CWD_API char *tsrm_realpath(const char *path, char *real_path TSRMLS_DC)
 {
-	char *ret;
+	cwd_state new_state;
+	char cwd[MAXPATHLEN];

-	if ((ret = realpath(src, dest)) == NULL && errno == ENOENT) {
-		return strcpy(dest, src);
+	if (!IS_ABSOLUTE_PATH(path, strlen(path)) &&
+	    VCWD_GETCWD(cwd, MAXPATHLEN)) {
+		new_state.cwd = strdup(cwd);
+		new_state.cwd_length = strlen(cwd);
 	} else {
-		return ret;
+		new_state.cwd = (char*)malloc(1);
+		new_state.cwd[0] = '\0';
+		new_state.cwd_length = 0;		
+	}
+
+	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)) {
+		free(new_state.cwd);
+		return NULL;
+	}
+
+	if (real_path) {
+		int copy_len = new_state.cwd_length>MAXPATHLEN-1 ? MAXPATHLEN-1 : new_state.cwd_length;
+		memcpy(real_path, new_state.cwd, copy_len);
+		real_path[copy_len] = '\0';
+		free(new_state.cwd);
+		return real_path;
+	} else {
+		return new_state.cwd;
 	}
 }
-#endif
-


 /*
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -126,6 +126,12 @@ typedef unsigned short mode_t;
 #define CWD_API
 #endif

+#ifdef TSRM_WIN32
+CWD_API int php_sys_stat(const char *path, struct stat *buf);
+#else
+# define php_sys_stat stat
+#endif
+
 typedef struct _cwd_state {
 	char *cwd;
 	int cwd_length;
@@ -172,10 +178,6 @@ CWD_API int virtual_access(const char *pathname, int mode TSRMLS_DC);
 #endif
 #endif

-#if defined(__osf__) || defined(_AIX)
-char *php_realpath_hack(const char *src, char *dest);
-#endif
-
 #if HAVE_UTIME
 CWD_API int virtual_utime(const char *filename, struct utimbuf *buf TSRMLS_DC);
 #endif
@@ -184,8 +186,17 @@ CWD_API int virtual_chmod(const char *filename, mode_t mode TSRMLS_DC);
 CWD_API int virtual_chown(const char *filename, uid_t owner, gid_t group, int link TSRMLS_DC);
 #endif

+/* One of the following constants must be used as the last argument 
+   in virtual_file_ex() call. */
+
+#define CWD_EXPAND   0 /* expand "." and ".." but dont resolve symlinks      */
+#define CWD_FILEPATH 1 /* resolve symlinks if file is exist otherwise expand */
+#define CWD_REALPATH 2 /* call realpath(), resolve symlinks. File must exist */
+
 CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath);

+CWD_API char *tsrm_realpath(const char *path, char *real_path TSRMLS_DC);
+
 #define REALPATH_CACHE_TTL  (2*60) /* 2 minutes */
 #define REALPATH_CACHE_SIZE 0      /* disabled while php.ini isn't loaded */

@@ -215,6 +226,9 @@ extern virtual_cwd_globals cwd_globals;
 # define CWDG(v) (cwd_globals.v)
 #endif

+CWD_API void realpath_cache_clean(TSRMLS_D);
+CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC);
+
 /* The actual macros to be used in programs using TSRM
 * If the program defines VIRTUAL_DIR it will use the
 * virtual_* functions 
@@ -265,7 +279,7 @@ extern virtual_cwd_globals cwd_globals;
 #define VCWD_CHDIR(path) chdir(path)
 #define VCWD_CHDIR_FILE(path) virtual_chdir_file(path, chdir)
 #define VCWD_GETWD(buf) getwd(buf)
-#define VCWD_STAT(path, buff) stat(path, buff)
+#define VCWD_STAT(path, buff) php_sys_stat(path, buff)
 #define VCWD_LSTAT(path, buff) lstat(path, buff)
 #define VCWD_UNLINK(path) unlink(path)
 #define VCWD_MKDIR(pathname, mode) mkdir(pathname, mode)
@@ -278,15 +292,7 @@ extern virtual_cwd_globals cwd_globals;
 #define VCWD_ACCESS(pathname, mode) access(pathname, mode)
 #endif

-#ifdef HAVE_REALPATH
-#if defined(__osf__) || defined(_AIX)
-#define VCWD_REALPATH(path, real_path) php_realpath_hack(path, real_path)
-#else
-#define VCWD_REALPATH(path, real_path) realpath(path, real_path)
-#endif
-#else
-#define VCWD_REALPATH(path, real_path) strcpy(real_path, path)
-#endif
+#define VCWD_REALPATH(path, real_path) tsrm_realpath(path, real_path TSRMLS_CC)

 #if HAVE_UTIME
 #define VCWD_UTIME(path, time) utime(path, time)
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -86,11 +86,19 @@ TSRM_API void tsrm_win32_shutdown(void)

 TSRM_API int tsrm_win32_access(const char *pathname, int mode)
 {
-	SHFILEINFO sfi;
-
 	if (mode == 1 /*X_OK*/) {
+#if 1
+		/* This code is not supported by Windows 98, 
+		 * but we don't support it anymore */
+		DWORD type;
+
+		return GetBinaryType(pathname, &type)?0:-1;
+#else
+		SHFILEINFO sfi;
+
 		return access(pathname, 0) == 0 && 
 			SHGetFileInfo(pathname, 0, &sfi, sizeof(SHFILEINFO), SHGFI_EXETYPE) != 0 ? 0 : -1;
+#endif
 	} else {
 		return access(pathname, mode);
 	}
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -14,7 +14,7 @@ libZend_la_SOURCES=\
 	zend_variables.c zend.c zend_API.c zend_extensions.c zend_hash.c \
 	zend_list.c zend_indent.c zend_builtin_functions.c zend_sprintf.c \
 	zend_ini.c zend_qsort.c zend_objects.c zend_object_handlers.c \
-	zend_objects_API.c zend_ts_hash.c zend_stream.c zend_mm.c \
+	zend_objects_API.c zend_ts_hash.c zend_stream.c \
 	zend_default_classes.c \
 	zend_iterators.c zend_interfaces.c zend_exceptions.c \
 	zend_strtod.c zend_multibyte.c
@@ -195,10 +195,6 @@ SOURCE=.\zend_llist.c
 # End Source File
 # Begin Source File

-SOURCE=.\zend_mm.c
-# End Source File
-# Begin Source File
-
 SOURCE=.\zend_object_handlers.c
 # End Source File
 # Begin Source File
@@ -371,10 +367,6 @@ SOURCE=.\zend_llist.h
 # End Source File
 # Begin Source File

-SOURCE=.\zend_mm.h
-# End Source File
-# Begin Source File
-
 SOURCE=.\zend_modules.h
 # End Source File
 # Begin Source File
@@ -129,13 +129,6 @@ AC_ARG_WITH(zend-vm,
  PHP_ZEND_VM=CALL
 ])

-AC_ARG_ENABLE(malloc-mm,
-[  --enable-malloc-mm      Use environment variable for run-time malloc/emalloc
-                          selection - FOR DEVELOPERS ONLY!!],
-[
-  ZEND_USE_MALLOC_MM=$enableval
-])
-
 AC_ARG_ENABLE(maintainer-zts,
 [  --enable-maintainer-zts Enable thread safety - for code maintainers only!!],[
  ZEND_MAINTAINER_ZTS=$enableval
@@ -151,13 +144,6 @@ AC_ARG_ENABLE(inline-optimization,
  ZEND_INLINE_OPTIMIZATION=yes
 ])

-AC_ARG_ENABLE(memory-limit,
-[  --enable-memory-limit   Compile with memory limit support], [
-  ZEND_MEMORY_LIMIT=$enableval
-],[
-  ZEND_MEMORY_LIMIT=no
-])
-
 AC_ARG_ENABLE(zend-multibyte,
 [  --enable-zend-multibyte Compile with zend multibyte support], [
  ZEND_MULTIBYTE=$enableval
@@ -174,9 +160,6 @@ AC_MSG_RESULT($ZEND_MAINTAINER_ZTS)
 AC_MSG_CHECKING(whether to enable inline optimization for GCC)
 AC_MSG_RESULT($ZEND_INLINE_OPTIMIZATION)

-AC_MSG_CHECKING(whether to enable a memory limit)
-AC_MSG_RESULT($ZEND_MEMORY_LIMIT)
-
 AC_MSG_CHECKING(whether to enable Zend debugging)
 AC_MSG_RESULT($ZEND_DEBUG)

@@ -217,12 +200,6 @@ if test "$ZEND_MAINTAINER_ZTS" = "yes"; then
  LIBZEND_CPLUSPLUS_CHECKS
 fi  

-if test "$ZEND_MEMORY_LIMIT" = "yes"; then
-  AC_DEFINE(MEMORY_LIMIT, 1, [Memory limit])
-else
-  AC_DEFINE(MEMORY_LIMIT, 0, [Memory limit])
-fi
-
 if test "$ZEND_MULTIBYTE" = "yes"; then
  AC_DEFINE(ZEND_MULTIBYTE, 1, [ ])
 fi
@@ -404,3 +381,10 @@ AC_DEFUN([LIBZEND_CPLUSPLUS_CHECKS],[

 ])

+AC_MSG_CHECKING(whether /dev/urandom exists) 
+if test -r "/dev/urandom" && test -c "/dev/urandom"; then 
+  AC_DEFINE([HAVE_DEV_URANDOM], 1, [Define if the target system has /dev/urandom device])
+  AC_MSG_RESULT(yes) 
+else 
+  AC_MSG_RESULT(no) 
+fi 
@@ -229,10 +229,6 @@ SOURCE=.\zend_llist.c
 # End Source File
 # Begin Source File

-SOURCE=.\zend_mm.c
-# End Source File
-# Begin Source File
-
 SOURCE=.\zend_object_handlers.c
 # End Source File
 # Begin Source File
@@ -409,10 +405,6 @@ SOURCE=.\zend_llist.h
 # End Source File
 # Begin Source File

-SOURCE=.\zend_mm.h
-# End Source File
-# Begin Source File
-
 SOURCE=.\zend_modules.h
 # End Source File
 # Begin Source File
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -1,4 +1,5 @@
 <?php
+date_default_timezone_set("UTC");

 function simple() {
  $a = 0;
@@ -0,0 +1,82 @@
+--TEST--
+builtin functions tests
+--FILE--
+<?php
+
+var_dump(get_resource_type());
+var_dump(get_resource_type(""));
+$fp = fopen(__FILE__, "r");
+var_dump(get_resource_type($fp));
+fclose($fp);
+var_dump(get_resource_type($fp));
+
+var_dump(get_loaded_extensions(true));
+var_dump(gettype(get_loaded_extensions()));
+var_dump(count(get_loaded_extensions()));
+
+define("USER_CONSTANT", "test");
+
+var_dump(get_defined_constants(true, true));
+var_dump(gettype(get_defined_constants(true)));
+var_dump(gettype(get_defined_constants()));
+var_dump(count(get_defined_constants()));
+
+function test () {
+}
+
+var_dump(get_defined_functions(true));
+var_dump(gettype(get_defined_functions()));
+var_dump(count(get_defined_functions()));
+
+var_dump(get_declared_interfaces(true));
+var_dump(gettype(get_declared_interfaces()));
+var_dump(count(get_declared_interfaces()));
+
+var_dump(get_extension_funcs());
+var_dump(get_extension_funcs(true));
+var_dump(gettype(get_extension_funcs("standard")));
+var_dump(count(get_extension_funcs("standard")));
+var_dump(gettype(get_extension_funcs("zend")));
+var_dump(count(get_extension_funcs("zend")));
+
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Warning: Wrong parameter count for get_resource_type() in %s on line %d
+NULL
+
+Warning: Supplied argument is not a valid resource handle in %s on line %d
+bool(false)
+string(6) "stream"
+string(7) "Unknown"
+
+Warning: Wrong parameter count for get_loaded_extensions() in %s on line %d
+NULL
+string(5) "array"
+int(%d)
+
+Warning: Wrong parameter count for get_defined_constants() in %s on line %d
+NULL
+string(5) "array"
+string(5) "array"
+int(%d)
+
+Warning: Wrong parameter count for get_defined_functions() in %s on line %d
+NULL
+string(5) "array"
+int(%d)
+
+Warning: Wrong parameter count for get_declared_interfaces() in %s on line %d
+NULL
+string(5) "array"
+int(%d)
+
+Warning: Wrong parameter count for get_extension_funcs() in %s on line %d
+NULL
+bool(false)
+string(5) "array"
+int(%d)
+string(5) "array"
+int(%d)
+Done
@@ -0,0 +1,19 @@
+--TEST--
+Bug #33282 (Re-assignment by reference does not clear the is_ref flag)
+--FILE--
+<?php
+	$a = array(1, 2, 3);
+	$r = &$a[0];
+	$r = &$a[1];
+	$r = &$a[2];
+	var_dump($a);
+?>
+--EXPECT--	
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  &int(3)
+}
@@ -1,7 +1,7 @@
 --TEST--
 Bug #34617 (zend_deactivate: objects_store used after zend_objects_store_destroy is called) 
 --SKIPIF--
-<?php if (!extension_loaded("xml")) print "skip"; ?>
+<?php if (!extension_loaded("xml")) print "skip the xml extension not available"; ?>
 --FILE--
 <?php
 class Thing {}
@@ -15,4 +15,4 @@ function boom()
 boom();
 ?>
 --EXPECT--
-ok
+ok
@@ -0,0 +1,14 @@
+--TEST--
+Bug #35106 (nested foreach fails when array variable has a reference)
+--FILE--
+<?php
+$a=array("1","2");
+$b=&$a;
+foreach($a as $i){
+    echo $i;
+    foreach($a as $p);
+}
+echo "\n";
+?>
+--EXPECT--
+12
@@ -0,0 +1,36 @@
+--TEST--
+Bug #35634 (Erroneous "Class declarations may not be nested" error raised)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+if (defined("pass3")) {
+
+  class ErrorClass {
+  }
+
+} else if (defined("pass2")) {
+
+  class TestClass {
+    function __construct() {
+    }
+    function TestClass() {
+      $this->__construct();
+    }
+  }
+
+} else {
+
+  function errorHandler($errorNumber, $errorMessage, $fileName, $lineNumber) {
+    define("pass3", 1);
+    include(__FILE__);
+    die("Error: $errorMessage ($fileName:$lineNumber)\n");
+  }
+
+  set_error_handler('errorHandler');
+  define("pass2", 1);
+  include(__FILE__);
+}
+?>
+--EXPECTF--
+Error: Redefining already defined constructor for class TestClass (%sbug35634.php:12)
@@ -0,0 +1,54 @@
+--TEST--
+Bug #36214 (__get method works properly only when conditional operator is used)
+--SKIPIF--
+<?php if (!extension_loaded("spl")) die("skip SPL is no available"); ?>
+--FILE--
+<?php
+class context {
+  public $stack = array();
+
+  public function __set($name,$var) {
+    $this->stack[$name] = $var;return;
+  }
+
+  public function &__get($name) {
+    return $this->stack[$name];
+  }
+}
+
+$ctx = new context;
+$ctx->comment_preview = array();
+$ctx->comment_preview[0] = 1;
+$ctx->comment_preview[1] = 2;
+var_dump($ctx->comment_preview);
+
+$comment_preview = array();
+$comment_preview[0] = 1;
+$comment_preview[1] = 2;
+$ctx->comment_preview = $comment_preview;
+var_dump($ctx->comment_preview);
+
+$ctx->comment_preview = new ArrayObject();
+$ctx->comment_preview[0] = 1;
+$ctx->comment_preview[1] = 2;
+var_dump($ctx->comment_preview);
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+object(ArrayObject)#2 (2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
@@ -0,0 +1,45 @@
+--TEST--
+Bug #39297 (Memory corryption because of indirect modification of overloaded array)
+--FILE--
+<?php
+function compareByRef(&$first, &$second) {
+    return $first === $second;
+}
+
+class MyTree implements ArrayAccess {
+    public $parent;
+    public $children = array();
+
+    public function offsetExists($offset) {
+    }
+
+    public function offsetUnset($offset) {
+    }
+
+    public function offsetSet($offset, $value) {
+    	echo "offsetSet()\n";
+        $cannonicalName = strtolower($offset);
+        $this->children[$cannonicalName] = $value;
+        $value->parent = $this;
+    }    
+    
+    public function offsetGet($offset) {
+    	echo "offsetGet()\n";
+        $cannonicalName = strtolower($offset);
+        return $this->children[$cannonicalName];
+    }
+
+}
+
+$id = 'Test';
+
+$root = new MyTree();
+$child = new MyTree();
+$root[$id] = $child;
+
+var_dump(compareByRef($root[$id], $child));
+?>
+--EXPECT--
+offsetSet()
+offsetGet()
+bool(true)
@@ -0,0 +1,45 @@
+--TEST--
+Bug #39438 (Fatal error: Out of memory)
+--INI--
+memory_limit=16M
+--FILE--
+<?php
+$i=0;
+$test2=array(
+   'a1_teasermenu' => array(
+   		'downloadcounter' => 2777,
+        'versions' => array(
+        	'0.1.0' => array (
+        		'title' => 'A1 Teasermenu',
+        	    'description' => 'Displays a teaser for advanced subpages or a selection of advanced pages',
+        	    'state' => 'stable',
+        	    'reviewstate' => 0,
+        	    'category' => 'plugin',
+        	    'downloadcounter' => 2787,
+        	    'lastuploaddate' => 1088427240,
+        	    'dependencies' => array (
+        	          'depends' => array(
+        	                  'typo3' =>'', 
+        	                  'php' =>'', 
+        	                  'cms' => ''
+        	           ),        	
+        	          'conflicts' => array('' =>'')        	
+        	    ),        	
+        	  	'authorname' => 'Mirko Balluff',
+        	  	'authoremail' => 'balluff@amt1.de',
+        	  	'ownerusername' => 'amt1',
+        	  	't3xfilemd5' => '3a4ec198b6ea8d0bc2d69d9b7400398f',
+      		)
+  		)
+  	)
+);
+$test=array();
+while($i<1200) {	
+	$test[]=$test2;
+	$i++;
+}
+$out=serialize($test);
+echo "ok\n";
+?>
+--EXPECT--
+ok
@@ -0,0 +1,16 @@
+--TEST--
+Bug #39445 (Calling debug_backtrace() in the __toString() function produces a crash)
+--FILE--
+<?php
+class test {
+	public function __toString() {
+		debug_backtrace();
+		return 'lowercase';
+	}
+}
+
+	$test = new test();
+	echo strtoupper($test);
+?>
+--EXPECT--
+LOWERCASE
@@ -0,0 +1,40 @@
+--TEST--
+Bug #39449 (Overloaded array properties do not work correctly)
+--FILE--
+<?php
+class A {
+  private $keys = array();
+  public function & __get($val) {
+    return $this->keys[$val];
+  }
+  public function __set($k, $v) {
+    $this->keys[$k] = $v;
+  }
+}
+
+$a =new A();
+$a->arr = array('a','b','c');
+
+$b = &$a->arr;
+$b[]= 'd';
+
+foreach ($a->arr as $k => $v) {
+  echo "$k => $v\n";
+}
+
+$a->arr[]='d';
+
+foreach ($a->arr as $k => $v) {
+  echo "$k => $v\n";
+}
+?>
+--EXPECT--
+0 => a
+1 => b
+2 => c
+3 => d
+0 => a
+1 => b
+2 => c
+3 => d
+4 => d
@@ -0,0 +1,15 @@
+--TEST--
+Bug #39602 (Invalid session.save_handler crashes PHP)
+--SKIPIF--
+<?php if (!extension_loaded("session")) die("skip"); ?>
+--INI--
+session.save_handler=qwerty
+--FILE--
+<?php
+ini_set("session.save_handler","files");
+$x = new stdClass();
+echo "ok";
+?>
+--EXPECT--
+ok
+Fatal error: Unknown: Cannot find save handler qwerty in Unknown on line 0
@@ -0,0 +1,30 @@
+--TEST--
+Bug #39721 (Runtime inheritance causes data corruption)
+--FILE--
+<?php
+class test2 {
+	private static $instances = 0;
+	public $instance;
+	
+	public function __construct() {
+		$this->instance = ++self::$instances;
+	}
+	 
+}
+
+$foo = new test2();
+
+if (is_object($foo)) {
+	class test2_child extends test2 {
+	 
+	}
+}
+
+$child = new test2_child();
+
+echo $foo->instance . "\n";
+echo $child->instance . "\n";
+?>
+--EXPECT--
+1
+2
@@ -0,0 +1,20 @@
+--TEST--
+Bug #39775 ("Indirect modification ..." message is not shown)
+--FILE--
+<?php
+class test {
+	var $array = array();
+	function __get($var) {
+		$v =& $this->array;
+		return $this->array;
+	}
+}
+$t = new test;
+$t->anything[] = 'bar';
+print_r($t->anything);
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded property test::$anything has no effect in %sbug39775.php on line 10
+Array
+(
+)
@@ -0,0 +1,13 @@
+--TEST--
+Bug #39825 (foreach produces memory error)
+--FILE--
+<?php 
+$array = array(1 => 2, "foo" => "bar");
+$obj = (object)$array;
+foreach ($obj as $name => $value)  {
+	echo "$name -> $value\n";
+}
+?>
+--EXPECT--
+1 -> 2
+foo -> bar
@@ -0,0 +1,88 @@
+--TEST--
+Bug #39944 (References broken)
+--FILE--
+<?php
+$intTheValue = 0;
+
+function &getValue() {
+    global $intTheValue;
+    return $intTheValue;
+}
+
+function setValue(&$int, $iNewValue) {
+    $int = $iNewValue;
+}
+
+setValue(getValue(), 10);
+echo "intTheValue = {$intTheValue}\n";
+
+$b = &$intTheValue;
+
+setValue(getValue(), 10);
+echo "intTheValue = {$intTheValue}\n";
+
+/****/
+
+$arrTheArray = array();
+
+function &getArray() {
+	global $arrTheArray;
+	return $arrTheArray;
+}
+
+function addToArray(&$arr, $strToAdd) {
+	$arr[] = $strToAdd;
+}
+
+addToArray(getArray(), "xx1");
+$a = getArray();	
+addToArray($a, "xx2");
+$b = &$arrTheArray;
+addToArray($b, "xx3");
+addToArray(getArray(), "xx4");
+$a = getArray();	
+addToArray($a, "xx5");
+echo "arrTheArray = " . print_r($arrTheArray, 1);
+
+/****/
+
+class RefTest {
+	protected $arr;
+
+	function Add($strToAdd) {
+		$this->addToArray($this->getArray(), $strToAdd);
+	}	
+
+	function &getArray() {
+		if (!$this->arr)
+			$this->arr = array();
+		return $this->arr;
+	}
+
+	private function addToArray(&$arr, $strToAdd) {
+		$arr[] = $strToAdd;
+	}
+}
+
+$objRefTest = new RefTest();
+$objRefTest->Add("xx1");
+$objRefTest->Add("xx2");
+$objRefTest->Add("xx3");
+
+echo "objRefTest->getArray() = " . print_r($objRefTest->getArray(), 1);
+?>
+--EXPECT--
+intTheValue = 10
+intTheValue = 10
+arrTheArray = Array
+(
+    [0] => xx1
+    [1] => xx3
+    [2] => xx4
+)
+objRefTest->getArray() = Array
+(
+    [0] => xx1
+    [1] => xx2
+    [2] => xx3
+)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #39990 (Cannot "foreach" over overloaded properties)
+--FILE--
+<?php
+  class Foo {
+    public function __get($name) {
+      return array('Hello', 'World');    
+    }
+  }
+  
+  $obj=new Foo();
+  foreach($obj->arr as $value)
+    echo "$value\n";
+?>
+--EXPECT--
+Hello
+World
@@ -11,6 +11,5 @@ echo "ok\n";
 ?>
 --EXPECTF--
 ok
-
-Notice: Undefined variable: b in %sunset_cv08.php on line %d
+ok
 ok
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -101,7 +101,7 @@ ZEND_API zval zval_used_for_init; /* True global variable */
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2006 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2007 Zend Technologies\n"


 #define PRINT_ZVAL_INDENT 4
@@ -131,9 +131,9 @@ static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent,
 				if (is_object) {
 					char *prop_name, *class_name;

-					zend_unmangle_property_name(string_key, str_len-1, &class_name, &prop_name);
+					int mangled = zend_unmangle_property_name(string_key, str_len-1, &class_name, &prop_name);
 					ZEND_PUTS_EX(prop_name);
-					if (class_name) {
+					if (class_name && mangled == SUCCESS) {
 						if (class_name[0]=='*') {
 							ZEND_PUTS_EX(":protected");
 						} else {
@@ -214,7 +214,7 @@ ZEND_API void zend_make_printable_zval(zval *expr, zval *expr_copy, int *use_cop
 			}
 			break;
 		case IS_RESOURCE:
-			expr_copy->value.str.val = (char *) emalloc(sizeof("Resource id #")-1 + MAX_LENGTH_OF_LONG);
+			expr_copy->value.str.val = (char *) emalloc(sizeof("Resource id #") + MAX_LENGTH_OF_LONG);
 			expr_copy->value.str.len = sprintf(expr_copy->value.str.val, "Resource id #%ld", expr->value.lval);
 			break;
 		case IS_ARRAY:
@@ -426,13 +426,25 @@ static void register_standard_class(TSRMLS_D)
 	zend_hash_add(CG(class_table), "stdclass", sizeof("stdclass"), &zend_standard_class_def, sizeof(zend_class_entry *), NULL);
 }

+#ifdef ZTS
+static zend_bool asp_tags_default      = 0;
+static zend_bool short_tags_default    = 1;
+static zend_bool ct_pass_ref_default   = 1;
+static zend_bool extended_info_default = 0;
+#else
+# define asp_tags_default      0
+# define short_tags_default    1
+# define ct_pass_ref_default   1
+# define extended_info_default 0
+#endif
+
 static void zend_set_default_compile_time_values(TSRMLS_D)
 {
 	/* default compile-time values */
-	CG(asp_tags) = 0;
-	CG(short_tags) = 1;
-	CG(allow_call_time_pass_reference) = 1;
-	CG(extended_info) = 0;
+	CG(asp_tags) = asp_tags_default;
+	CG(short_tags) = short_tags_default;
+	CG(allow_call_time_pass_reference) = ct_pass_ref_default;
+	CG(extended_info) = extended_info_default;
 }


@@ -522,8 +534,9 @@ static void executor_globals_dtor(zend_executor_globals *executor_globals TSRMLS

 static void zend_new_thread_end_handler(THREAD_T thread_id TSRMLS_DC)
 {
-	zend_copy_ini_directives(TSRMLS_C);
-	zend_ini_refresh_caches(ZEND_INI_STAGE_STARTUP TSRMLS_CC);
+	if (zend_copy_ini_directives(TSRMLS_C) == SUCCESS) {
+		zend_ini_refresh_caches(ZEND_INI_STAGE_STARTUP TSRMLS_CC);
+	}
 }
 #endif

@@ -570,6 +583,7 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions, i
 	fpsetmask(0);
 #endif

+	zend_startup_strtod();
 	zend_startup_extensions_mechanism();

 	/* Set up utility functions and values */
@@ -693,6 +707,12 @@ void zend_post_startup(TSRMLS_D)
 	*GLOBAL_FUNCTION_TABLE = *compiler_globals->function_table;
 	*GLOBAL_CLASS_TABLE = *compiler_globals->class_table;
 	*GLOBAL_CONSTANTS_TABLE = *executor_globals->zend_constants;
+
+	asp_tags_default = CG(asp_tags);
+	short_tags_default = CG(short_tags);
+	ct_pass_ref_default = CG(allow_call_time_pass_reference);
+	extended_info_default = CG(extended_info);
+	
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
 	free(compiler_globals->function_table);
 	free(compiler_globals->class_table);
@@ -700,7 +720,7 @@ void zend_post_startup(TSRMLS_D)
 	free(EG(zend_constants));
 	executor_globals_ctor(executor_globals, tsrm_ls);
 	global_persistent_list = &EG(persistent_list);
-	zend_new_thread_end_handler(tsrm_thread_id() TSRMLS_CC);
+	zend_copy_ini_directives(TSRMLS_C);
 }
 #endif

@@ -728,6 +748,7 @@ void zend_shutdown(TSRMLS_D)
 	zend_hash_destroy(GLOBAL_CONSTANTS_TABLE);
 	free(GLOBAL_CONSTANTS_TABLE);

+	zend_shutdown_strtod();
 #ifdef ZTS
 	GLOBAL_FUNCTION_TABLE = NULL;
 	GLOBAL_CLASS_TABLE = NULL;
@@ -897,6 +918,8 @@ ZEND_API void zend_error(int type, const char *format, ...)
 	char *error_filename;
 	uint error_lineno;
 	zval *orig_user_error_handler;
+	zend_bool in_compilation;
+	zend_class_entry *saved_class_entry;
 	TSRMLS_FETCH();

 	/* Obtain relevant filename and lineno */
@@ -1004,7 +1027,18 @@ ZEND_API void zend_error(int type, const char *format, ...)

 			orig_user_error_handler = EG(user_error_handler);
 			EG(user_error_handler) = NULL;
-	    
+	                
+			/* User error handler may include() additinal PHP files.
+			 * If an error was generated during comilation PHP will compile
+			 * such scripts recursivly, but some CG() variables may be 
+			 * inconsistent. */ 
+
+			in_compilation = zend_is_compiling(TSRMLS_C);
+			if (in_compilation) {
+				saved_class_entry = CG(active_class_entry);
+				CG(active_class_entry) = NULL;
+			}
+
 			if (call_user_function_ex(CG(function_table), NULL, orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
 				if (retval) {
 					if (Z_TYPE_P(retval) == IS_BOOL && Z_LVAL_P(retval) == 0) {
@@ -1017,6 +1051,10 @@ ZEND_API void zend_error(int type, const char *format, ...)
 				zend_error_cb(type, error_filename, error_lineno, format, args);
 			}

+			if (in_compilation) {
+				CG(active_class_entry) = saved_class_entry;
+			}
+
 			if (!EG(user_error_handler)) {
 				EG(user_error_handler) = orig_user_error_handler;
 			} 
@@ -1096,15 +1134,6 @@ ZEND_API int zend_execute_scripts(int type TSRMLS_DC, zval **retval, int file_co
 			EG(return_value_ptr_ptr) = retval ? retval : &local_retval;
 			zend_execute(EG(active_op_array) TSRMLS_CC);
 			if (EG(exception)) {
-				char ex_class_name[128];
-
-				EG(opline_ptr) = NULL;
-				if (Z_TYPE_P(EG(exception)) == IS_OBJECT) {
-					strncpy(ex_class_name, Z_OBJ_CLASS_NAME_P(EG(exception)), 127);
-					ex_class_name[127] = '\0';
-				} else {
-					strcpy(ex_class_name, "Unknown Exception");
-				}
 				if (EG(user_exception_handler)) {
 					zval *orig_user_exception_handler;
 					zval ***params, *retval2, *old_exception;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2095,18 +2095,17 @@ static zend_function_entry disabled_class_new[] =  {

 ZEND_API int zend_disable_class(char *class_name, uint class_name_length TSRMLS_DC)
 {
-	zend_class_entry *disabled_class;
-	disabled_class = (zend_class_entry *) emalloc(sizeof(zend_class_entry));
+	zend_class_entry disabled_class;

 	zend_str_tolower(class_name, class_name_length);
 	if (zend_hash_del(CG(class_table), class_name, class_name_length+1)==FAILURE) {
 		return FAILURE;
 	}
-	INIT_CLASS_ENTRY((*disabled_class), class_name, disabled_class_new);
-	disabled_class->create_object = display_disabled_class;
-	disabled_class->name_length = class_name_length;
-	zend_register_internal_class(disabled_class TSRMLS_CC);
-	return 1;
+	INIT_CLASS_ENTRY(disabled_class, class_name, disabled_class_new);
+	disabled_class.create_object = display_disabled_class;
+	disabled_class.name_length = class_name_length;
+	zend_register_internal_class(&disabled_class TSRMLS_CC);
+	return SUCCESS;
 }

 static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, zend_class_entry *ce_org, zval *callable, zend_class_entry **ce_ptr, zend_function **fptr_ptr TSRMLS_DC)
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -48,6 +48,9 @@ typedef struct _zend_function_entry {

 #define ZEND_FENTRY(zend_name, name, arg_info, flags)	{ #zend_name, name, arg_info, (zend_uint) (sizeof(arg_info)/sizeof(struct _zend_arg_info)-1), flags },

+#define ZEND_RAW_FENTRY(zend_name, name, arg_info, flags)   { zend_name, name, arg_info, (zend_uint) (sizeof(arg_info)/sizeof(struct _zend_arg_info)-1), flags },
+#define ZEND_RAW_NAMED_FE(zend_name, name, arg_info) ZEND_RAW_FENTRY(#zend_name, name, arg_info, 0)
+
 #define ZEND_NAMED_FE(zend_name, name, arg_info)	ZEND_FENTRY(zend_name, name, arg_info, 0)
 #define ZEND_FE(name, arg_info)						ZEND_FENTRY(name, ZEND_FN(name), arg_info, 0)
 #define ZEND_DEP_FE(name, arg_info)                 ZEND_FENTRY(name, ZEND_FN(name), arg_info, ZEND_ACC_DEPRECATED)
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -201,7 +201,7 @@ ZEND_FUNCTION(func_get_arg)
 		RETURN_FALSE;
 	}
 	convert_to_long_ex(z_requested_offset);
-	requested_offset = (*z_requested_offset)->value.lval;
+	requested_offset = Z_LVAL_PP(z_requested_offset);

 	if (requested_offset < 0) {
 		zend_error(E_WARNING, "func_get_arg():  The argument number should be >= 0");
@@ -281,7 +281,7 @@ ZEND_NAMED_FUNCTION(zend_if_strlen)
 		ZEND_WRONG_PARAM_COUNT();
 	}
 	convert_to_string_ex(str);
-	RETVAL_LONG((*str)->value.str.len);
+	RETVAL_LONG(Z_STRLEN_PP(str));
 }
 /* }}} */

@@ -517,8 +517,8 @@ repeat:
 		zval_ptr_dtor(&val_free);
 	}
 	c.flags = case_sensitive; /* non persistent */
-	c.name = zend_strndup((*var)->value.str.val, (*var)->value.str.len);
-	c.name_len = (*var)->value.str.len+1;
+	c.name = zend_strndup(Z_STRVAL_PP(var), Z_STRLEN_PP(var));
+	c.name_len = Z_STRLEN_PP(var)+1;
 	c.module_number = PHP_USER_CONSTANT;
 	if (zend_register_constant(&c TSRMLS_CC) == SUCCESS) {
 		RETURN_TRUE;
@@ -541,7 +541,7 @@ ZEND_FUNCTION(defined)
 	}
 	
 	convert_to_string_ex(var);
-	if (zend_get_constant((*var)->value.str.val, (*var)->value.str.len, &c TSRMLS_CC)) {
+	if (zend_get_constant(Z_STRVAL_PP(var), Z_STRLEN_PP(var), &c TSRMLS_CC)) {
 		zval_dtor(&c);
 		RETURN_TRUE;
 	} else {
@@ -1085,9 +1085,9 @@ ZEND_FUNCTION(function_exists)
 		ZEND_WRONG_PARAM_COUNT();
 	}
 	convert_to_string_ex(function_name);
-	lcname = zend_str_tolower_dup((*function_name)->value.str.val, (*function_name)->value.str.len);
+	lcname = zend_str_tolower_dup(Z_STRVAL_PP(function_name), Z_STRLEN_PP(function_name));

-	retval = (zend_hash_find(EG(function_table), lcname, (*function_name)->value.str.len+1, (void **)&func) == SUCCESS);
+	retval = (zend_hash_find(EG(function_table), lcname, Z_STRLEN_PP(function_name)+1, (void **)&func) == SUCCESS);
 	
 	efree(lcname);

@@ -1115,7 +1115,7 @@ ZEND_FUNCTION(leak)
 	if (ZEND_NUM_ARGS()>=1) {
 		if (zend_get_parameters_ex(1, &leak)==SUCCESS) {
 			convert_to_long_ex(leak);
-			leakbytes = (*leak)->value.lval;
+			leakbytes = Z_LVAL_PP(leak);
 		}
 	}

@@ -1172,7 +1172,7 @@ ZEND_FUNCTION(trigger_error)
 				ZEND_WRONG_PARAM_COUNT();
 			}
 			convert_to_long_ex(z_error_type);
-			error_type = (*z_error_type)->value.lval;
+			error_type = Z_LVAL_PP(z_error_type);
 			switch (error_type) {
 				case E_USER_ERROR:
 				case E_USER_WARNING:
@@ -1188,7 +1188,7 @@ ZEND_FUNCTION(trigger_error)
 			ZEND_WRONG_PARAM_COUNT();	
 	}
 	convert_to_string_ex(z_error_message);
-	zend_error(error_type, "%s", (*z_error_message)->value.str.val);
+	zend_error(error_type, "%s", Z_STRVAL_PP(z_error_message));
 	RETURN_TRUE;
 }
 /* }}} */
@@ -1416,11 +1416,16 @@ ZEND_FUNCTION(get_defined_functions)
 	zend_hash_apply_with_arguments(EG(function_table), (apply_func_args_t) copy_function_name, 2, internal, user);

 	if (zend_hash_add(Z_ARRVAL_P(return_value), "internal", sizeof("internal"), (void **)&internal, sizeof(zval *), NULL) == FAILURE) {
+		zval_ptr_dtor(&internal);
+		zval_ptr_dtor(&user);
+		zval_dtor(return_value);
 		zend_error(E_WARNING, "Cannot add internal functions to return value from get_defined_functions()");
 		RETURN_FALSE;
 	}

 	if (zend_hash_add(Z_ARRVAL_P(return_value), "user", sizeof("user"), (void **)&user, sizeof(zval *), NULL) == FAILURE) {
+		zval_ptr_dtor(&user);
+		zval_dtor(return_value);
 		zend_error(E_WARNING, "Cannot add user functions to return value from get_defined_functions()");
 		RETURN_FALSE;
 	}
@@ -1577,7 +1582,7 @@ ZEND_FUNCTION(get_loaded_extensions)
 /* }}} */


-/* {{{ proto array get_defined_constants(void)
+/* {{{ proto array get_defined_constants([mixed categorize])
   Return an array containing the names and values of all defined constants */
 ZEND_FUNCTION(get_defined_constants)
 {
@@ -1661,7 +1666,9 @@ static zval *debug_backtrace_get_args(void ***curpos TSRMLS_DC)
 	while (--arg_count >= 0) {
 		arg = (zval **) p++;
 		if (*arg) {
-			SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+			if (Z_TYPE_PP(arg) != IS_OBJECT) {
+				SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+			}
 			(*arg)->refcount++;
 			add_next_index_zval(arg_array, *arg);
 		} else {
@@ -1924,7 +1931,7 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 	}

 	/* skip debug_backtrace() */
-	if (skip_last--) {
+	if (skip_last-- && ptr) {
 		int arg_count = *((ulong*)(cur_arg_pos - 2));
 		cur_arg_pos -= (arg_count + 2);
 		frames_on_stack--;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -1535,11 +1535,10 @@ void zend_do_pass_param(znode *param, zend_uchar op, int offset TSRMLS_DC)
 	if (original_op==ZEND_SEND_REF
 		&& !CG(allow_call_time_pass_reference)) {
 		zend_error(E_COMPILE_WARNING,
-					"Call-time pass-by-reference has been deprecated - argument passed by value;  "
+					"Call-time pass-by-reference has been deprecated;  "
 					"If you would like to pass it by reference, modify the declaration of %s().  "
 					"If you would like to enable call-time pass-by-reference, you can set "
-					"allow_call_time_pass_reference to true in your INI file.  "
-					"However, future versions may not support this any longer. ",
+					"allow_call_time_pass_reference to true in your INI file.  ",
 					(function_ptr?function_ptr->common.function_name:"[runtime function name]"));
 	}

@@ -1686,19 +1685,15 @@ void zend_do_return(znode *expr, int do_end_vparse TSRMLS_DC)

 	if (expr) {
 		opline->op1 = *expr;
+
+		if (do_end_vparse && zend_is_function_or_method_call(expr)) {
+			opline->extended_value = ZEND_RETURNS_FUNCTION;
+		}
 	} else {
 		opline->op1.op_type = IS_CONST;
 		INIT_ZVAL(opline->op1.u.constant);
 	}

-	if (do_end_vparse) {
-		if (zend_is_function_or_method_call(expr)) {
-			opline->extended_value = ZEND_RETURNS_FUNCTION;
-		} else {
-			opline->extended_value = 0;
-		}
-	}
-
 	SET_UNUSED(opline->op2);
 }

@@ -1726,16 +1721,35 @@ void zend_do_first_catch(znode *open_parentheses TSRMLS_DC)

 void zend_initialize_try_catch_element(znode *try_token TSRMLS_DC)
 {
+	int jmp_op_number = get_next_op_number(CG(active_op_array));
+	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	zend_llist jmp_list;
+	zend_llist *jmp_list_ptr;
+
+	opline->opcode = ZEND_JMP;
+	SET_UNUSED(opline->op1);
+	SET_UNUSED(opline->op2);
+	/* save for backpatching */
+
+	zend_llist_init(&jmp_list, sizeof(int), NULL, 0);
+	zend_stack_push(&CG(bp_stack), (void *) &jmp_list, sizeof(zend_llist));
+	zend_stack_top(&CG(bp_stack), (void **) &jmp_list_ptr);
+	zend_llist_add_element(jmp_list_ptr, &jmp_op_number);
+
 	zend_add_catch_element(try_token->u.opline_num, get_next_op_number(CG(active_op_array)) TSRMLS_CC);
 }


 void zend_do_mark_last_catch(znode *first_catch, znode *last_additional_catch TSRMLS_DC)
 {
+	CG(active_op_array)->last--;
+	zend_do_if_end(TSRMLS_C);
 	if (last_additional_catch->u.opline_num == -1) {
 		CG(active_op_array)->opcodes[first_catch->u.opline_num].op1.u.EA.type = 1;
+		CG(active_op_array)->opcodes[first_catch->u.opline_num].extended_value = get_next_op_number(CG(active_op_array));
 	} else {
 		CG(active_op_array)->opcodes[last_additional_catch->u.opline_num].op1.u.EA.type = 1;
+		CG(active_op_array)->opcodes[last_additional_catch->u.opline_num].extended_value = get_next_op_number(CG(active_op_array));
 	}
 	DEC_BPC(CG(active_op_array));
 }
@@ -1772,6 +1786,18 @@ void zend_do_begin_catch(znode *try_token, znode *catch_class, znode *catch_var,

 void zend_do_end_catch(znode *try_token TSRMLS_DC)
 {
+	int jmp_op_number = get_next_op_number(CG(active_op_array));
+	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	zend_llist *jmp_list_ptr;
+
+	opline->opcode = ZEND_JMP;
+	SET_UNUSED(opline->op1);
+	SET_UNUSED(opline->op2);
+	/* save for backpatching */
+
+	zend_stack_top(&CG(bp_stack), (void **) &jmp_list_ptr);
+	zend_llist_add_element(jmp_list_ptr, &jmp_op_number);
+
 	CG(active_op_array)->opcodes[try_token->u.opline_num].extended_value = get_next_op_number(CG(active_op_array));
 }

@@ -2189,13 +2215,18 @@ ZEND_API void zend_do_inherit_interfaces(zend_class_entry *ce, zend_class_entry
 	}
 }

-
-static void inherit_static_prop(zval **p)
+static int inherit_static_prop(zval **p, int num_args, va_list args, zend_hash_key *key)
 {
-	(*p)->refcount++;
-	(*p)->is_ref = 1;
-}
+	HashTable *target = va_arg(args, HashTable*);

+	if (!zend_hash_quick_exists(target, key->arKey, key->nKeyLength, key->h)) {
+		SEPARATE_ZVAL_TO_MAKE_IS_REF(p);
+		if (zend_hash_quick_add(target, key->arKey, key->nKeyLength, key->h, p, sizeof(zval*), NULL) == SUCCESS) {
+			(*p)->refcount++;
+		}
+	}
+	return ZEND_HASH_APPLY_KEEP;
+}

 ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent_ce TSRMLS_DC)
 {
@@ -2216,9 +2247,9 @@ ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent
 	if (parent_ce->type != ce->type) {
 		/* User class extends internal class */
 		zend_update_class_constants(parent_ce  TSRMLS_CC);
-		zend_hash_merge(&ce->default_static_members, CE_STATIC_MEMBERS(parent_ce), (void (*)(void *)) inherit_static_prop, NULL, sizeof(zval *), 0);
+		zend_hash_apply_with_arguments(CE_STATIC_MEMBERS(parent_ce), (apply_func_args_t)inherit_static_prop, 1, &ce->default_static_members);
 	} else {
-		zend_hash_merge(&ce->default_static_members, &parent_ce->default_static_members, (void (*)(void *)) inherit_static_prop, NULL, sizeof(zval *), 0);
+		zend_hash_apply_with_arguments(&parent_ce->default_static_members, (apply_func_args_t)inherit_static_prop, 1, &ce->default_static_members TSRMLS_CC);
 	}
 	zend_hash_merge_ex(&ce->properties_info, &parent_ce->properties_info, (copy_ctor_func_t) (ce->type & ZEND_INTERNAL_CLASS ? zend_duplicate_property_info_internal : zend_duplicate_property_info), sizeof(zend_property_info), (merge_checker_func_t) do_inherit_property_access_check, ce);

@@ -2735,19 +2766,22 @@ void zend_do_begin_class_declaration(znode *class_token, znode *class_name, znod
 {
 	zend_op *opline;
 	int doing_inheritance = 0;
-	zend_class_entry *new_class_entry = emalloc(sizeof(zend_class_entry));
-	char *lcname = zend_str_tolower_dup(class_name->u.constant.value.str.val, class_name->u.constant.value.str.len);
+	zend_class_entry *new_class_entry;
+	char *lcname;

 	if (CG(active_class_entry)) {
 		zend_error(E_COMPILE_ERROR, "Class declarations may not be nested");
 		return;
 	}

+	lcname = zend_str_tolower_dup(class_name->u.constant.value.str.val, class_name->u.constant.value.str.len);
+
 	if (!(strcmp(lcname, "self") && strcmp(lcname, "parent"))) {
 		efree(lcname);
 		zend_error(E_COMPILE_ERROR, "Cannot use '%s' as class name as it is reserved", class_name->u.constant.value.str.val);
 	}

+	new_class_entry = emalloc(sizeof(zend_class_entry));
 	new_class_entry->type = ZEND_USER_CLASS;
 	new_class_entry->name = class_name->u.constant.value.str.val;
 	new_class_entry->name_length = class_name->u.constant.value.str.len;
@@ -3622,6 +3656,10 @@ void zend_do_instanceof(znode *result, znode *expr, znode *class_znode, int type
 		}
 	}

+	if (expr->op_type == IS_CONST) {
+		zend_error(E_COMPILE_ERROR, "instanceof expects an object instance, constant given");
+	}
+
 	opline = get_next_op(CG(active_op_array) TSRMLS_CC);
 	opline->opcode = ZEND_INSTANCEOF;
 	opline->result.op_type = IS_TMP_VAR;
@@ -3634,11 +3672,12 @@ void zend_do_instanceof(znode *result, znode *expr, znode *class_znode, int type
 }


-void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, znode *array, int variable TSRMLS_DC)
+void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, znode *array, znode *as_token, int variable TSRMLS_DC)
 {
 	zend_op *opline;
 	zend_bool is_variable;
 	zend_bool push_container = 0;
+	zend_op dummy_opline;

 	if (variable) {
 		if (zend_is_function_or_method_call(array)) {
@@ -3646,6 +3685,8 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
 		} else {
 			is_variable = 1;
 		}
+		/* save the location of FETCH_W instruction(s) */
+		open_brackets_token->u.opline_num = get_next_op_number(CG(active_op_array));
 		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 		if (CG(active_op_array)->last > 0 &&
 		    CG(active_op_array)->opcodes[CG(active_op_array)->last-1].opcode == ZEND_FETCH_OBJ_W) {
@@ -3657,6 +3698,7 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
 		}
 	} else {
 		is_variable = 0;
+		open_brackets_token->u.opline_num = get_next_op_number(CG(active_op_array));
 	}

 	/* save the location of FE_RESET */
@@ -3671,28 +3713,17 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
 	opline->op1 = *array;
 	SET_UNUSED(opline->op2);
 	opline->extended_value = is_variable ? ZEND_FE_RESET_VARIABLE : 0;
-	*open_brackets_token = opline->result;

-	{
-		zend_op dummy_opline;
+	dummy_opline.result = opline->result;
+	if (push_container) {
+		dummy_opline.op1 = CG(active_op_array)->opcodes[CG(active_op_array)->last-2].op1;
+	} else {
+		znode tmp;

-		dummy_opline.result = opline->result;
-		if (push_container) {
-			dummy_opline.op1 = CG(active_op_array)->opcodes[CG(active_op_array)->last-2].op1;
-		} else {
-			znode tmp;
-
-			tmp.op_type = IS_UNUSED;
-			dummy_opline.op1 = tmp;
-		}
-		zend_stack_push(&CG(foreach_copy_stack), (void *) &dummy_opline, sizeof(zend_op));
+		tmp.op_type = IS_UNUSED;
+		dummy_opline.op1 = tmp;
 	}
-}
-
-
-void zend_do_foreach_fetch(znode *foreach_token, znode *open_brackets_token, znode *as_token TSRMLS_DC)
-{
-	zend_op *opline;
+	zend_stack_push(&CG(foreach_copy_stack), (void *) &dummy_opline, sizeof(zend_op));

 	/* save the location of FE_FETCH */
 	as_token->u.opline_num = get_next_op_number(CG(active_op_array));
@@ -3701,7 +3732,7 @@ void zend_do_foreach_fetch(znode *foreach_token, znode *open_brackets_token, zno
 	opline->opcode = ZEND_FE_FETCH;
 	opline->result.op_type = IS_VAR;
 	opline->result.u.var = get_temporary_variable(CG(active_op_array));
-	opline->op1 = *open_brackets_token;
+	opline->op1 = dummy_opline.result;
 	opline->extended_value = 0;
 	SET_UNUSED(opline->op2);

@@ -3713,7 +3744,7 @@ void zend_do_foreach_fetch(znode *foreach_token, znode *open_brackets_token, zno
 }


-void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, znode *key TSRMLS_DC)
+void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znode *as_token, znode *value, znode *key TSRMLS_DC)
 {
 	zend_op *opline;
 	znode dummy, value_node;
@@ -3744,6 +3775,19 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
 		/* Mark extended_value for assign-by-reference */
 		opline->extended_value |= ZEND_FE_FETCH_BYREF;
 		CG(active_op_array)->opcodes[foreach_token->u.opline_num].extended_value |= ZEND_FE_RESET_REFERENCE;
+	} else {
+		zend_op *foreach_copy;
+		zend_op *fetch = &CG(active_op_array)->opcodes[foreach_token->u.opline_num];
+		zend_op	*end = &CG(active_op_array)->opcodes[open_brackets_token->u.opline_num];
+
+		/* Change "write context" into "read context" */
+		fetch->extended_value = 0;  /* reset ZEND_FE_RESET_VARIABLE */
+		while (fetch != end) {
+			(--fetch)->opcode -= 3; /* FETCH_W -> FETCH_R */
+		}
+		/* prevent double SWITCH_FREE */
+		zend_stack_top(&CG(foreach_copy_stack), (void **) &foreach_copy);
+		foreach_copy->op1.op_type = IS_UNUSED;
 	}

 	value_node = opline->result;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -476,9 +476,8 @@ void zend_do_isset_or_isempty(int type, znode *result, znode *variable TSRMLS_DC

 void zend_do_instanceof(znode *result, znode *expr, znode *class_znode, int type TSRMLS_DC);

-void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, znode *array, int variable TSRMLS_DC);
-void zend_do_foreach_fetch(znode *foreach_token, znode *open_brackets_token, znode *as_token TSRMLS_DC);
-void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, znode *key TSRMLS_DC);
+void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, znode *array, znode *as_token, int variable TSRMLS_DC);
+void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znode *as_token, znode *value, znode *key TSRMLS_DC);
 void zend_do_foreach_end(znode *foreach_token, znode *as_token TSRMLS_DC);

 void zend_do_declare_begin(TSRMLS_D);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -32,8 +32,7 @@ zend_class_entry *error_exception_ce;
 static zend_object_handlers default_exception_handlers;
 ZEND_API void (*zend_throw_exception_hook)(zval *ex TSRMLS_DC);

-
-void zend_throw_exception_internal(zval *exception TSRMLS_DC)
+void zend_throw_exception_internal(zval *exception TSRMLS_DC) /* {{{ */
 {
 	if (exception != NULL) {
 		if (EG(exception)) {
@@ -58,11 +57,9 @@ void zend_throw_exception_internal(zval *exception TSRMLS_DC)
 	EG(opline_before_exception) = EG(current_execute_data)->opline;
 	EG(current_execute_data)->opline = &EG(active_op_array)->opcodes[EG(active_op_array)->last-1-1];
 }
+/* }}} */

-
-
-
-ZEND_API void zend_clear_exception(TSRMLS_D)
+ZEND_API void zend_clear_exception(TSRMLS_D) /* {{{ */
 {
 	if (!EG(exception)) {
 		return;
@@ -74,8 +71,9 @@ ZEND_API void zend_clear_exception(TSRMLS_D)
 	EG(opline_before_exception) = NULL;
 #endif
 }
+/* }}} */

-static zend_object_value zend_default_exception_new_ex(zend_class_entry *class_type, int skip_top_traces TSRMLS_DC)
+static zend_object_value zend_default_exception_new_ex(zend_class_entry *class_type, int skip_top_traces TSRMLS_DC) /* {{{ */
 {
 	zval tmp, obj;
 	zend_object *object;
@@ -99,17 +97,19 @@ static zend_object_value zend_default_exception_new_ex(zend_class_entry *class_t

 	return Z_OBJVAL(obj);
 }
+/* }}} */

-static zend_object_value zend_default_exception_new(zend_class_entry *class_type TSRMLS_DC)
+static zend_object_value zend_default_exception_new(zend_class_entry *class_type TSRMLS_DC) /* {{{ */
 {
 	return zend_default_exception_new_ex(class_type, 0 TSRMLS_CC);
 }
+/* }}} */

-static zend_object_value zend_error_exception_new(zend_class_entry *class_type TSRMLS_DC)
+static zend_object_value zend_error_exception_new(zend_class_entry *class_type TSRMLS_DC) /* {{{ */
 {
 	return zend_default_exception_new_ex(class_type, 2 TSRMLS_CC);
 }
-
+/* }}} */

 /* {{{ proto Exception Exception::__clone()
   Clone the exception object */
@@ -120,7 +120,6 @@ ZEND_METHOD(exception, __clone)
 }
 /* }}} */

-
 /* {{{ proto Exception::__construct(string message, int code)
   Exception constructor */
 ZEND_METHOD(exception, __construct)
@@ -146,7 +145,6 @@ ZEND_METHOD(exception, __construct)
 }
 /* }}} */

-
 /* {{{ proto ErrorException::__construct(string message, int code, int severity [, string filename [, int lineno]])
   ErrorException constructor */
 ZEND_METHOD(error_exception, __construct)
@@ -187,7 +185,7 @@ ZEND_METHOD(error_exception, __construct)
 		ZEND_WRONG_PARAM_COUNT(); \
 	}

-static void _default_exception_get_entry(zval *object, char *name, int name_len, zval *return_value TSRMLS_DC)
+static void _default_exception_get_entry(zval *object, char *name, int name_len, zval *return_value TSRMLS_DC) /* {{{ */
 {
 	zval *value;

@@ -197,7 +195,7 @@ static void _default_exception_get_entry(zval *object, char *name, int name_len,
 	zval_copy_ctor(return_value);
 	INIT_PZVAL(return_value);
 }
-
+/* }}} */

 /* {{{ proto string Exception::getFile()
   Get the file in which the exception occurred */
@@ -209,7 +207,6 @@ ZEND_METHOD(exception, getFile)
 }
 /* }}} */

-
 /* {{{ proto int Exception::getLine()
   Get the line in which the exception occurred */
 ZEND_METHOD(exception, getLine)
@@ -220,7 +217,6 @@ ZEND_METHOD(exception, getLine)
 }
 /* }}} */

-
 /* {{{ proto string Exception::getMessage()
   Get the exception message */
 ZEND_METHOD(exception, getMessage)
@@ -231,7 +227,6 @@ ZEND_METHOD(exception, getMessage)
 }
 /* }}} */

-
 /* {{{ proto int Exception::getCode()
   Get the exception code */
 ZEND_METHOD(exception, getCode)
@@ -242,7 +237,6 @@ ZEND_METHOD(exception, getCode)
 }
 /* }}} */

-
 /* {{{ proto array Exception::getTrace()
   Get the stack trace for the location in which the exception occurred */
 ZEND_METHOD(exception, getTrace)
@@ -253,7 +247,6 @@ ZEND_METHOD(exception, getTrace)
 }
 /* }}} */

-
 /* {{{ proto int ErrorException::getSeverity()
   Get the exception severity */
 ZEND_METHOD(error_exception, getSeverity)
@@ -264,7 +257,7 @@ ZEND_METHOD(error_exception, getSeverity)
 }
 /* }}} */

-/* {{{ ZEND_METHOD(exception, gettraceasstring) */
+/* {{{ gettraceasstring() macros */
 #define TRACE_APPEND_CHR(chr)                                            \
 	*str = (char*)erealloc(*str, *len + 1 + 1);                          \
 	(*str)[(*len)++] = chr
@@ -285,7 +278,9 @@ ZEND_METHOD(error_exception, getSeverity)
 	    TRACE_APPEND_STRL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp));           \
 	}

-static int _build_trace_args(zval **arg, int num_args, va_list args, zend_hash_key *hash_key)
+/* }}} */
+
+static int _build_trace_args(zval **arg, int num_args, va_list args, zend_hash_key *hash_key) /* {{{ */
 {
 	char **str;
 	int *len;
@@ -381,8 +376,9 @@ static int _build_trace_args(zval **arg, int num_args, va_list args, zend_hash_k
 	}
 	return ZEND_HASH_APPLY_KEEP;
 }
+/* }}} */

-static int _build_trace_string(zval **frame, int num_args, va_list args, zend_hash_key *hash_key)
+static int _build_trace_string(zval **frame, int num_args, va_list args, zend_hash_key *hash_key) /* {{{ */
 {
 	char *s_tmp, **str;
 	int *len, *num;
@@ -404,7 +400,7 @@ static int _build_trace_string(zval **frame, int num_args, va_list args, zend_ha
 		} else {
 			line = 0;
 		}
-		s_tmp = emalloc(Z_STRLEN_PP(file) + MAX_LENGTH_OF_LONG + 2 + 1);
+		s_tmp = emalloc(Z_STRLEN_PP(file) + MAX_LENGTH_OF_LONG + 4 + 1);
 		sprintf(s_tmp, "%s(%ld): ", Z_STRVAL_PP(file), line);
 		TRACE_APPEND_STRL(s_tmp, strlen(s_tmp));
 		efree(s_tmp);
@@ -425,7 +421,7 @@ static int _build_trace_string(zval **frame, int num_args, va_list args, zend_ha
 	TRACE_APPEND_STR(")\n");
 	return ZEND_HASH_APPLY_KEEP;
 }
-
+/* }}} */

 /* {{{ proto string Exception::getTraceAsString()
   Obtain the backtrace for the exception as a string (instead of an array) */
@@ -448,7 +444,7 @@ ZEND_METHOD(exception, getTraceAsString)
 }
 /* }}} */

-int zend_spprintf(char **message, int max_len, char *format, ...)
+int zend_spprintf(char **message, int max_len, char *format, ...) /* {{{ */
 {
 	va_list arg;
 	int len;
@@ -458,7 +454,7 @@ int zend_spprintf(char **message, int max_len, char *format, ...)
 	va_end(arg);
 	return len;
 }
-
+/* }}} */

 /* {{{ proto string Exception::__toString()
   Obtain the string representation of the Exception object */
@@ -522,6 +518,7 @@ ZEND_METHOD(exception, __toString)
 }
 /* }}} */

+/* {{{ internal structs */
 /* All functions that may be used in uncaught exception handlers must be final
 * and must not throw exceptions. Otherwise we would need a facility to handle
 * such exceptions in that handler.
@@ -564,8 +561,9 @@ static zend_function_entry error_exception_functions[] = {
 	ZEND_ME(error_exception, getSeverity, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	{NULL, NULL, NULL}
 };
+/* }}} */

-void zend_register_default_exception(TSRMLS_D)
+void zend_register_default_exception(TSRMLS_D) /* {{{ */
 {
 	zend_class_entry ce;

@@ -587,19 +585,21 @@ void zend_register_default_exception(TSRMLS_D)
 	error_exception_ce->create_object = zend_error_exception_new;
 	zend_declare_property_long(error_exception_ce, "severity", sizeof("severity")-1, E_ERROR, ZEND_ACC_PROTECTED TSRMLS_CC);
 }
+/* }}} */

-ZEND_API zend_class_entry *zend_exception_get_default(TSRMLS_D)
+ZEND_API zend_class_entry *zend_exception_get_default(TSRMLS_D) /* {{{ */
 {
 	return default_exception_ce;
 }
+/* }}} */

-ZEND_API zend_class_entry *zend_get_error_exception(TSRMLS_D)
+ZEND_API zend_class_entry *zend_get_error_exception(TSRMLS_D) /* {{{ */
 {
 	return error_exception_ce;
 }
+/* }}} */

-
-ZEND_API zval * zend_throw_exception(zend_class_entry *exception_ce, char *message, long code TSRMLS_DC)
+ZEND_API zval * zend_throw_exception(zend_class_entry *exception_ce, char *message, long code TSRMLS_DC) /* {{{ */
 {
 	zval *ex;

@@ -625,9 +625,9 @@ ZEND_API zval * zend_throw_exception(zend_class_entry *exception_ce, char *messa
 	zend_throw_exception_internal(ex TSRMLS_CC);
 	return ex;
 }
+/* }}} */

-
-ZEND_API zval * zend_throw_exception_ex(zend_class_entry *exception_ce, long code TSRMLS_DC, char *format, ...)
+ZEND_API zval * zend_throw_exception_ex(zend_class_entry *exception_ce, long code TSRMLS_DC, char *format, ...) /* {{{ */
 {
 	va_list arg;
 	char *message;
@@ -640,16 +640,17 @@ ZEND_API zval * zend_throw_exception_ex(zend_class_entry *exception_ce, long cod
 	efree(message);
 	return zexception;
 }
+/* }}} */

-
-ZEND_API zval * zend_throw_error_exception(zend_class_entry *exception_ce, char *message, long code, int severity TSRMLS_DC)
+ZEND_API zval * zend_throw_error_exception(zend_class_entry *exception_ce, char *message, long code, int severity TSRMLS_DC) /* {{{ */
 {
 	zval *ex = zend_throw_exception(exception_ce, message, code TSRMLS_CC);
 	zend_update_property_long(default_exception_ce, ex, "severity", sizeof("severity")-1, severity TSRMLS_CC);
 	return ex;
 }
+/* }}} */

-static void zend_error_va(int type, const char *file, uint lineno, const char *format, ...)
+static void zend_error_va(int type, const char *file, uint lineno, const char *format, ...) /* {{{ */
 {
 	va_list args;

@@ -657,9 +658,10 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 	zend_error_cb(type, file, lineno, format, args);
 	va_end(args);
 }
+/* }}} */

 /* This function doesn't return as it calls E_ERROR */
-ZEND_API void zend_exception_error(zval *exception TSRMLS_DC)
+ZEND_API void zend_exception_error(zval *exception TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
@@ -698,9 +700,9 @@ ZEND_API void zend_exception_error(zval *exception TSRMLS_DC)
 		zend_error(E_ERROR, "Uncaught exception '%s'", ce_exception->name);
 	}
 }
+/* }}} */

-
-ZEND_API void zend_throw_exception_object(zval *exception TSRMLS_DC)
+ZEND_API void zend_throw_exception_object(zval *exception TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *exception_ce;

@@ -715,6 +717,7 @@ ZEND_API void zend_throw_exception_object(zval *exception TSRMLS_DC)
 	}
 	zend_throw_exception_internal(exception TSRMLS_CC);
 }
+/* }}} */

 /*
 * Local variables:
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -64,7 +64,7 @@ static void zend_extension_fcall_end_handler(zend_extension *extension, zend_op_

 #define TEMP_VAR_STACK_LIMIT 2000

-static inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free)
+static inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free, int unref)
 {
 	if (!--z->refcount) {
 		z->refcount = 1;
@@ -73,7 +73,7 @@ static inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free)
 /*		should_free->is_var = 1; */
 	} else {
 		should_free->var = 0;
-		if (z->is_ref && z->refcount == 1) {
+		if (unref && z->is_ref && z->refcount == 1) {
 			z->is_ref = 0;
 		}
 	}
@@ -87,7 +87,8 @@ static inline void zend_pzval_unlock_free_func(zval *z)
 	}
 }

-#define PZVAL_UNLOCK(z, f) zend_pzval_unlock_func(z, f)
+#define PZVAL_UNLOCK(z, f) zend_pzval_unlock_func(z, f, 1)
+#define PZVAL_UNLOCK_EX(z, f, u) zend_pzval_unlock_func(z, f, u)
 #define PZVAL_UNLOCK_FREE(z) zend_pzval_unlock_free_func(z)
 #define PZVAL_LOCK(z) (z)->refcount++
 #define RETURN_VALUE_UNUSED(pzn)	(((pzn)->u.EA.type & EXT_TYPE_UNUSED))
@@ -411,11 +412,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 		*variable_ptr_ptr = value_ptr;
 		value_ptr->refcount++;

-		variable_ptr->refcount--;
-		if (variable_ptr->refcount==0) {
-			zendi_zval_dtor(*variable_ptr);
-			FREE_ZVAL(variable_ptr);
-		}
+		zval_ptr_dtor(&variable_ptr);
 	} else if (!variable_ptr->is_ref) {
 		if (variable_ptr_ptr == value_ptr_ptr) {
 			SEPARATE_ZVAL(variable_ptr_ptr);
@@ -1166,16 +1163,22 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 				overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim, type TSRMLS_CC);

 				if (overloaded_result) {
-					switch (type) {
-						case BP_VAR_RW:
-						case BP_VAR_W:
-							if (Z_TYPE_P(overloaded_result) != IS_OBJECT
-								&& !overloaded_result->is_ref) {
-								zend_error_noreturn(E_ERROR, "Objects used as arrays in post/pre increment/decrement must return values by reference");
-							}
-							break;
-					}
+					if (!overloaded_result->is_ref &&
+					    (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
+						if (overloaded_result->refcount > 0) {
+							zval *tmp = overloaded_result;

+							ALLOC_ZVAL(overloaded_result);
+							*overloaded_result = *tmp;
+							zval_copy_ctor(overloaded_result);
+							overloaded_result->is_ref = 0;
+							overloaded_result->refcount = 0;
+						}
+						if (Z_TYPE_P(overloaded_result) != IS_OBJECT) {
+							zend_class_entry *ce = Z_OBJCE_P(container);
+							zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name);
+						}
+					}
 					retval = &overloaded_result;
 				} else {
 					retval = &EG(error_zval_ptr);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -41,6 +41,12 @@ typedef union _temp_variable {
 		zval *str;
 		zend_uint offset;
 	} str_offset;
+	struct {
+		zval **ptr_ptr;
+		zval *ptr;
+		zend_bool fcall_returned_reference;
+		HashPointer fe_pos;
+	} fe;
 	zend_class_entry *class_entry;
 } temp_variable;

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -870,6 +870,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 						zend_ptr_stack_n_push(&EG(argument_stack), 2, (void *) (long) i, NULL);
 						zend_ptr_stack_clear_multiple(TSRMLS_C);
 					}
+
+					if (call_via_handler) {
+						zval_ptr_dtor(&method_name);
+						zval_ptr_dtor(&params_array);
+					}
 					return FAILURE;
 				}
 				ALLOC_ZVAL(new_zval);
@@ -1113,11 +1118,14 @@ ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSR
 	int retval;

 	if (retval_ptr) {
-		pv.value.str.len = strlen(str)+sizeof("return  ;")-1;
-		pv.value.str.val = emalloc(pv.value.str.len+1);
-		strcpy(pv.value.str.val, "return ");
-		strcat(pv.value.str.val, str);
-		strcat(pv.value.str.val, " ;");
+		int l = strlen(str);
+		Z_STRLEN(pv) = l+sizeof("return  ;")-1;
+		Z_STRVAL(pv) = emalloc(Z_STRLEN(pv) + 1);
+		memcpy(Z_STRVAL(pv), "return ", sizeof("return ")-1);
+		memcpy(Z_STRVAL(pv) + sizeof("return ")-1, str, l);
+		Z_STRVAL(pv)[Z_STRLEN(pv)-2] = ' ';
+		Z_STRVAL(pv)[Z_STRLEN(pv)-1] = ';';
+		Z_STRVAL(pv)[Z_STRLEN(pv)] = '\0';
 	} else {
 		pv.value.str.len = strlen(str);
 		pv.value.str.val = estrndup(str, pv.value.str.len);
@@ -1381,6 +1389,9 @@ void zend_set_timeout(long seconds)
 	TSRMLS_FETCH();

 	EG(timeout_seconds) = seconds;
+	if(!seconds) {
+		return;
+	}
 #ifdef ZEND_WIN32
 	if (timeout_thread_initialized==0 && InterlockedIncrement(&timeout_thread_initialized)==1) {
 		/* We start up this process-wide thread here and not in zend_startup(), because if Zend
@@ -1419,7 +1430,9 @@ void zend_set_timeout(long seconds)
 void zend_unset_timeout(TSRMLS_D)
 {
 #ifdef ZEND_WIN32
-	PostThreadMessage(timeout_thread_id, WM_UNREGISTER_ZEND_TIMEOUT, (WPARAM) GetCurrentThreadId(), (LPARAM) 0);
+	if(timeout_thread_initialized) {
+		PostThreadMessage(timeout_thread_id, WM_UNREGISTER_ZEND_TIMEOUT, (WPARAM) GetCurrentThreadId(), (LPARAM) 0);
+	}
 #else
 #	ifdef HAVE_SETITIMER
 	{
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -141,11 +141,16 @@ ZEND_API int _zend_hash_init(HashTable *ht, uint nSize, hash_func_t pHashFunctio

 	SET_INCONSISTENT(HT_OK);

-	while ((1U << i) < nSize) {
-		i++;
+	if (nSize >= 0x80000000) {
+		/* prevent overflow */
+		ht->nTableSize = 0x80000000;
+	} else {
+		while ((1U << i) < nSize) {
+			i++;
+		}
+		ht->nTableSize = 1 << i;
 	}

-	ht->nTableSize = 1 << i;
 	ht->nTableMask = ht->nTableSize - 1;
 	ht->pDestructor = pDestructor;
 	ht->arBuckets = NULL;
@@ -647,12 +652,15 @@ ZEND_API void zend_hash_graceful_reverse_destroy(HashTable *ht)
 	SET_INCONSISTENT(HT_DESTROYED);
 }

-/* This is used to selectively delete certain entries from a hashtable.
- * destruct() receives the data and decides if the entry should be deleted 
- * or not
+/* This is used to recurse elements and selectively delete certain entries 
+ * from a hashtable. apply_func() receives the data and decides if the entry 
+ * should be deleted or recursion should be stopped. The following three 
+ * return codes are possible:
+ * ZEND_HASH_APPLY_KEEP   - continue
+ * ZEND_HASH_APPLY_STOP   - stop iteration
+ * ZEND_HASH_APPLY_REMOVE - delete the element, combineable with the former
 */

-
 ZEND_API void zend_hash_apply(HashTable *ht, apply_func_t apply_func TSRMLS_DC)
 {
 	Bucket *p;
@@ -662,11 +670,16 @@ ZEND_API void zend_hash_apply(HashTable *ht, apply_func_t apply_func TSRMLS_DC)
 	HASH_PROTECT_RECURSION(ht);
 	p = ht->pListHead;
 	while (p != NULL) {
-		if (apply_func(p->pData TSRMLS_CC)) {
+		int result = apply_func(p->pData TSRMLS_CC);
+		
+		if (result & ZEND_HASH_APPLY_REMOVE) {
 			p = zend_hash_apply_deleter(ht, p);
 		} else {
 			p = p->pListNext;
 		}
+		if (result & ZEND_HASH_APPLY_STOP) {
+			break;
+		}
 	}
 	HASH_UNPROTECT_RECURSION(ht);
 }
@@ -681,17 +694,22 @@ ZEND_API void zend_hash_apply_with_argument(HashTable *ht, apply_func_arg_t appl
 	HASH_PROTECT_RECURSION(ht);
 	p = ht->pListHead;
 	while (p != NULL) {
-		if (apply_func(p->pData, argument TSRMLS_CC)) {
+		int result = apply_func(p->pData, argument TSRMLS_CC);
+		
+		if (result & ZEND_HASH_APPLY_REMOVE) {
 			p = zend_hash_apply_deleter(ht, p);
 		} else {
 			p = p->pListNext;
 		}
+		if (result & ZEND_HASH_APPLY_STOP) {
+			break;
+		}
 	}
 	HASH_UNPROTECT_RECURSION(ht);
 }


-ZEND_API void zend_hash_apply_with_arguments(HashTable *ht, apply_func_args_t destruct, int num_args, ...)
+ZEND_API void zend_hash_apply_with_arguments(HashTable *ht, apply_func_args_t apply_func, int num_args, ...)
 {
 	Bucket *p;
 	va_list args;
@@ -703,15 +721,21 @@ ZEND_API void zend_hash_apply_with_arguments(HashTable *ht, apply_func_args_t de

 	p = ht->pListHead;
 	while (p != NULL) {
+		int result;
 		va_start(args, num_args);
 		hash_key.arKey = p->arKey;
 		hash_key.nKeyLength = p->nKeyLength;
 		hash_key.h = p->h;
-		if (destruct(p->pData, num_args, args, &hash_key)) {
+		result = apply_func(p->pData, num_args, args, &hash_key);
+
+		if (result & ZEND_HASH_APPLY_REMOVE) {
 			p = zend_hash_apply_deleter(ht, p);
 		} else {
 			p = p->pListNext;
 		}
+		if (result & ZEND_HASH_APPLY_STOP) {
+			break;
+		}
 		va_end(args);
 	}

@@ -754,7 +778,7 @@ ZEND_API void zend_hash_copy(HashTable *target, HashTable *source, copy_ctor_fun
 	p = source->pListHead;
 	while (p) {
 		if (p->nKeyLength) {
-			zend_hash_update(target, p->arKey, p->nKeyLength, p->pData, size, &new_entry);
+			zend_hash_quick_update(target, p->arKey, p->nKeyLength, p->h, p->pData, size, &new_entry);
 		} else {
 			zend_hash_index_update(target, p->h, p->pData, size, &new_entry);
 		}
@@ -779,7 +803,7 @@ ZEND_API void _zend_hash_merge(HashTable *target, HashTable *source, copy_ctor_f
 	p = source->pListHead;
 	while (p) {
 		if (p->nKeyLength>0) {
-			if (_zend_hash_add_or_update(target, p->arKey, p->nKeyLength, p->pData, size, &t, mode ZEND_FILE_LINE_RELAY_CC)==SUCCESS && pCopyConstructor) {
+			if (_zend_hash_quick_add_or_update(target, p->arKey, p->nKeyLength, p->h, p->pData, size, &t, mode ZEND_FILE_LINE_RELAY_CC)==SUCCESS && pCopyConstructor) {
 				pCopyConstructor(t);
 			}
 		} else {
@@ -987,6 +1011,37 @@ ZEND_API int zend_hash_num_elements(HashTable *ht)
 }


+ZEND_API int zend_hash_get_pointer(HashTable *ht, HashPointer *ptr)
+{
+	ptr->pos = ht->pInternalPointer;
+	if (ht->pInternalPointer) {
+		ptr->h = ht->pInternalPointer->h;
+		return 1;
+	} else {
+		ptr->h = 0;
+		return 0;
+	}
+}
+
+ZEND_API int zend_hash_set_pointer(HashTable *ht, const HashPointer *ptr)
+{
+	if (ht->pInternalPointer != ptr->pos) {
+		Bucket *p;
+
+		IS_CONSISTENT(ht);
+		p = ht->arBuckets[ptr->h & ht->nTableMask];
+		while (p != NULL) {
+			if (p == ptr->pos) {
+				ht->pInternalPointer = p;
+				return 1;
+			}
+			p = p->pNext;
+		}
+		return 0;
+	}
+	return 1;
+}
+
 ZEND_API void zend_hash_internal_pointer_reset_ex(HashTable *ht, HashPosition *pos)
 {
 	IS_CONSISTENT(ht);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -176,6 +176,14 @@ ZEND_API void zend_hash_internal_pointer_reset_ex(HashTable *ht, HashPosition *p
 ZEND_API void zend_hash_internal_pointer_end_ex(HashTable *ht, HashPosition *pos);
 ZEND_API int zend_hash_update_current_key_ex(HashTable *ht, int key_type, char *str_index, uint str_length, ulong num_index, HashPosition *pos);

+typedef struct _HashPointer {
+	HashPosition pos;
+	ulong h;
+} HashPointer;
+
+ZEND_API int zend_hash_get_pointer(HashTable *ht, HashPointer *ptr);
+ZEND_API int zend_hash_set_pointer(HashTable *ht, const HashPointer *ptr);
+
 #define zend_hash_has_more_elements(ht) \
 	zend_hash_has_more_elements_ex(ht, NULL)
 #define zend_hash_move_forward(ht) \
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -126,7 +126,6 @@ ZEND_API int zend_copy_ini_directives(TSRMLS_D)
 		return FAILURE;
 	}
 	zend_hash_copy(EG(ini_directives), registered_zend_ini_directives, NULL, &ini_entry, sizeof(zend_ini_entry));
-	zend_ini_refresh_caches(ZEND_INI_STAGE_STARTUP TSRMLS_CC);
 	return SUCCESS;
 }
 #endif
@@ -214,6 +213,7 @@ ZEND_API void zend_unregister_ini_entries(int module_number TSRMLS_DC)
 }


+#ifdef ZTS
 static int zend_ini_refresh_cache(zend_ini_entry *p, int stage TSRMLS_DC)
 {
 	if (p->on_modify) {
@@ -227,6 +227,7 @@ ZEND_API void zend_ini_refresh_caches(int stage TSRMLS_DC)
 {
 	zend_hash_apply_with_argument(EG(ini_directives), (apply_func_arg_t) zend_ini_refresh_cache, (void *)(long) stage TSRMLS_CC);
 }
+#endif


 ZEND_API int zend_alter_ini_entry(char *name, uint name_length, char *new_value, uint new_value_length, int modify_type, int stage)
@@ -529,6 +530,28 @@ ZEND_API ZEND_INI_MH(OnUpdateLong)
 	return SUCCESS;
 }

+ZEND_API ZEND_INI_MH(OnUpdateLongGEZero)
+{
+	long *p, tmp;
+#ifndef ZTS
+	char *base = (char *) mh_arg2;
+#else
+	char *base;
+
+	base = (char *) ts_resource(*((int *) mh_arg2));
+#endif
+
+	tmp = zend_atoi(new_value, new_value_length);
+	if (tmp < 0) {
+		return FAILURE;
+	}
+
+	p = (long *) (base+(size_t) mh_arg1);
+	*p = tmp;
+
+	return SUCCESS;
+}
+

 ZEND_API ZEND_INI_MH(OnUpdateReal)
 {
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -175,6 +175,7 @@ END_EXTERN_C()
 BEGIN_EXTERN_C()
 ZEND_API ZEND_INI_MH(OnUpdateBool);
 ZEND_API ZEND_INI_MH(OnUpdateLong);
+ZEND_API ZEND_INI_MH(OnUpdateLongGEZero);
 ZEND_API ZEND_INI_MH(OnUpdateReal);
 ZEND_API ZEND_INI_MH(OnUpdateString);
 ZEND_API ZEND_INI_MH(OnUpdateStringUnempty);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -162,7 +162,7 @@ top_statement:
 		statement
 	|	function_declaration_statement	{ zend_do_early_binding(TSRMLS_C); }
 	|	class_declaration_statement		{ zend_do_early_binding(TSRMLS_C); }
-	|	T_HALT_COMPILER '(' ')' ';'   { REGISTER_MAIN_LONG_CONSTANT("__COMPILER_HALT_OFFSET__", zend_get_scanned_file_offset(TSRMLS_C), CONST_CS); YYACCEPT; }
+	|	T_HALT_COMPILER '(' ')' ';'   { zval c; if (zend_get_constant("__COMPILER_HALT_OFFSET__", sizeof("__COMPILER_HALT_OFFSET__") - 1, &c TSRMLS_CC)) { zval_dtor(&c); zend_error(E_COMPILE_ERROR, "__HALT_COMPILER() can only be used once per request"); } else { REGISTER_MAIN_LONG_CONSTANT("__COMPILER_HALT_OFFSET__", zend_get_scanned_file_offset(TSRMLS_C), CONST_CS); } YYACCEPT; }
 ;


@@ -214,14 +214,14 @@ unticked_statement:
 	|	expr ';'				{ zend_do_free(&$1 TSRMLS_CC); }
 	|	T_USE use_filename ';'		{ zend_error(E_COMPILE_ERROR,"use: Not yet supported. Please use include_once() or require_once()");  zval_dtor(&$2.u.constant); }
 	|	T_UNSET '(' unset_variables ')' ';'
-	|	T_FOREACH '(' variable { zend_do_foreach_begin(&$1, &$2, &$3, 1 TSRMLS_CC); } T_AS
-		{ zend_do_foreach_fetch(&$1, &$2, &$5 TSRMLS_CC); }
-		foreach_variable foreach_optional_arg ')' { zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); }
-		foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
-	|	T_FOREACH '(' expr_without_variable { zend_do_foreach_begin(&$1, &$2, &$3, 0 TSRMLS_CC); } T_AS
-		{ zend_do_foreach_fetch(&$1, &$2, &$5 TSRMLS_CC); }
-		variable foreach_optional_arg ')' { zend_check_writable_variable(&$7); zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); }
-		foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
+	|	T_FOREACH '(' variable T_AS
+		{ zend_do_foreach_begin(&$1, &$2, &$3, &$4, 1 TSRMLS_CC); }
+		foreach_variable foreach_optional_arg ')' { zend_do_foreach_cont(&$1, &$2, &$4, &$6, &$7 TSRMLS_CC); }
+		foreach_statement { zend_do_foreach_end(&$1, &$4 TSRMLS_CC); }
+	|	T_FOREACH '(' expr_without_variable T_AS
+		{ zend_do_foreach_begin(&$1, &$2, &$3, &$4, 0 TSRMLS_CC); }
+		variable foreach_optional_arg ')' { zend_check_writable_variable(&$6); zend_do_foreach_cont(&$1, &$2, &$4, &$6, &$7 TSRMLS_CC); }
+		foreach_statement { zend_do_foreach_end(&$1, &$4 TSRMLS_CC); }
 	|	T_DECLARE { $1.u.opline_num = get_next_op_number(CG(active_op_array)); zend_do_declare_begin(TSRMLS_C); } '(' declare_list ')' declare_statement { zend_do_declare_end(&$1 TSRMLS_CC); }
 	|	';'		/* empty statement */
 	|	T_TRY { zend_do_try(&$1 TSRMLS_CC); } '{' inner_statement_list '}'
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -286,6 +286,11 @@ int zend_compare_file_handles(zend_file_handle *fh1, zend_file_handle *fh2)
 ZEND_API void zend_destroy_file_handle(zend_file_handle *file_handle TSRMLS_DC)
 {
 	zend_llist_del_element(&CG(open_files), file_handle, (int (*)(void *, void *)) zend_compare_file_handles);
+	/* zend_file_handle_dtor() operates on the copy, so we have to NULLify the original here */
+	file_handle->opened_path = NULL;
+	if (file_handle->free_filename) {
+		file_handle->filename = NULL;
+	}
 }


@@ -983,6 +988,10 @@ NEWLINE ("\r"|"\n"|"\r\n")
 	return T_STRING_CAST;
 }

+<ST_IN_SCRIPTING>"("{TABS_AND_SPACES}"binary"{TABS_AND_SPACES}")" {
+	return T_STRING_CAST;
+}
+
 <ST_IN_SCRIPTING>"("{TABS_AND_SPACES}"array"{TABS_AND_SPACES}")" {
 	return T_ARRAY_CAST;
 }
@@ -1227,38 +1236,43 @@ NEWLINE ("\r"|"\n"|"\r\n")


 <ST_IN_SCRIPTING>{LNUM} {
-	errno = 0;
-	zendlval->value.lval = strtol(yytext, NULL, 0);
-	if (errno == ERANGE) { /* overflow */
-		zendlval->value.dval = zend_strtod(yytext, NULL);
-		zendlval->type = IS_DOUBLE;
-		return T_DNUMBER;
+	if (yyleng < MAX_LENGTH_OF_LONG - 1) { /* Won't overflow */
+		zendlval->value.lval = strtol(yytext, NULL, 0);
 	} else {
-		zendlval->type = IS_LONG;
-		return T_LNUMBER;
-	}
-}
-
-<ST_IN_SCRIPTING>{HNUM} {
-	errno = 0;
-	zendlval->value.lval = strtoul(yytext, NULL, 16);
-	if (errno == ERANGE) { /* overflow */
-		/* not trying strtod - it returns trash on 0x-es */
-		zendlval->value.lval = LONG_MAX; /* maximal long */
-		zend_error(E_NOTICE,"Hex number is too big: %s", yytext);
-	} else {
-		if (zendlval->value.lval < 0) {
-			/* maintain consistency with the old way */
-			zendlval->value.dval = (unsigned long) zendlval->value.lval;
+		errno = 0;
+		zendlval->value.lval = strtol(yytext, NULL, 0);
+		if (errno == ERANGE) { /* Overflow */
+			zendlval->value.dval = zend_strtod(yytext, NULL);
 			zendlval->type = IS_DOUBLE;
 			return T_DNUMBER;
 		}
-		zendlval->type = IS_LONG;
 	}
+
 	zendlval->type = IS_LONG;
 	return T_LNUMBER;
 }

+<ST_IN_SCRIPTING>{HNUM} {
+	char *hex = yytext + 2; /* Skip "0x" */
+	int len = yyleng - 2;
+
+	/* Skip any leading 0s */
+	while (*hex == '0') {
+		hex++;
+		len--;
+	}
+
+	if (len < SIZEOF_LONG * 2 || (len == SIZEOF_LONG * 2 && *hex <= '7')) {
+		zendlval->value.lval = strtol(hex, NULL, 16);
+		zendlval->type = IS_LONG;
+		return T_LNUMBER;
+	} else {
+		zendlval->value.dval = zend_hex_strtod(hex, NULL);
+		zendlval->type = IS_DOUBLE;
+		return T_DNUMBER;
+	}
+}
+
 <ST_DOUBLE_QUOTES,ST_BACKQUOTE,ST_HEREDOC>{LNUM}|{HNUM} { /* treat numbers (almost) as strings inside encapsulated strings */
 	zendlval->value.str.val = (char *)estrndup(yytext, yyleng);
 	zendlval->value.str.len = yyleng;
@@ -1560,12 +1574,13 @@ NEWLINE ("\r"|"\n"|"\r\n")
 }


-<ST_IN_SCRIPTING>(["]([^$"\\]|("\\".))*["]) {
+<ST_IN_SCRIPTING>("b"?["]([^$"\\]|("\\".))*["]) {
 	register char *s, *t;
 	char *end;
+	int bprefix = (*yytext == 'b') ? 1 : 0;

-	zendlval->value.str.val = estrndup(yytext+1, yyleng-2);
-	zendlval->value.str.len = yyleng-2;
+	zendlval->value.str.val = estrndup(yytext+bprefix+1, yyleng-bprefix-2);
+	zendlval->value.str.len = yyleng-bprefix-2;
 	zendlval->type = IS_STRING;
 	HANDLE_NEWLINES(yytext, yyleng);

@@ -1650,12 +1665,13 @@ NEWLINE ("\r"|"\n"|"\r\n")
 }


-<ST_IN_SCRIPTING>([']([^'\\]|("\\".))*[']) {
+<ST_IN_SCRIPTING>("b"?[']([^'\\]|("\\".))*[']) {
 	register char *s, *t;
 	char *end;
+	int bprefix = (*yytext == 'b') ? 1 : 0;

-	zendlval->value.str.val = estrndup(yytext+1, yyleng-2);
-	zendlval->value.str.len = yyleng-2;
+	zendlval->value.str.val = estrndup(yytext+bprefix+1, yyleng-bprefix-2);
+	zendlval->value.str.len = yyleng-bprefix-2;
 	zendlval->type = IS_STRING;
 	HANDLE_NEWLINES(yytext, yyleng);

@@ -1698,17 +1714,19 @@ NEWLINE ("\r"|"\n"|"\r\n")
 }


-<ST_IN_SCRIPTING>["] {
+<ST_IN_SCRIPTING>b?["] {
 	BEGIN(ST_DOUBLE_QUOTES);
 	return '\"';
 }


-<ST_IN_SCRIPTING>"<<<"{TABS_AND_SPACES}{LABEL}{NEWLINE} {
+<ST_IN_SCRIPTING>"b"?"<<<"{TABS_AND_SPACES}{LABEL}{NEWLINE} {
 	char *s;
+	int bprefix = (*yytext == 'b') ? 1 : 0;
+
 	CG(zend_lineno)++;
-	CG(heredoc_len) = yyleng-3-1-(yytext[yyleng-2]=='\r'?1:0);
-	s = yytext+3;
+	CG(heredoc_len) = yyleng-bprefix-3-1-(yytext[yyleng-2]=='\r'?1:0);
+	s = yytext+bprefix+3;
 	while ((*s == ' ') || (*s == '\t')) {
 		s++;
 		CG(heredoc_len)--;
@@ -1725,7 +1743,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
 }


-<ST_IN_SCRIPTING>['] {
+<ST_IN_SCRIPTING>b?['] {
 	BEGIN(ST_SINGLE_QUOTE);
 	return '\'';
 }
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -1,475 +0,0 @@
-/*
-   +----------------------------------------------------------------------+
-   | Zend Engine                                                          |
-   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
-   +----------------------------------------------------------------------+
-   | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        |
-   | available through the world-wide-web at the following url:           |
-   | http://www.zend.com/license/2_00.txt.                                |
-   | If you did not receive a copy of the Zend license and are unable to  |
-   | obtain it through the world-wide-web, please send a note to          |
-   | license@zend.com so we can mail you a copy immediately.              |
-   +----------------------------------------------------------------------+
-   | Authors: Andi Gutmans <andi@zend.com>                                |
-   |          Zeev Suraski <zeev@zend.com>                                |
-   +----------------------------------------------------------------------+
-*/
-
-/* $Id$ */
-#if 0
-#include "zend.h"
-#include "zend_mm.h"
-
-#if WIN32|WINNT
-# ifndef inline
-#  define inline __inline
-# endif
-#endif
-
-#define ZEND_MM_FREE_BLOCK	0
-#define ZEND_MM_USED_BLOCK	1
-
-#ifndef MAX
-#define MAX(a, b) (((a)>(b))?(a):(b))
-#endif
-
-#ifndef ZEND_MM_ALIGNMENT
-#define ZEND_MM_ALIGNMENT 8
-#define ZEND_MM_ALIGNMENT_LOG2 3
-#endif
-
-#define ZEND_MM_ALIGNMENT_MASK ~(ZEND_MM_ALIGNMENT-1)
-
-#define ZEND_MM_BUCKET_INDEX(true_size) (true_size >> ZEND_MM_ALIGNMENT_LOG2)
-
-/* Aligned header size */
-#define ZEND_MM_ALIGNED_SIZE(size) ((size + ZEND_MM_ALIGNMENT - 1) & ZEND_MM_ALIGNMENT_MASK)
-#define ZEND_MM_ALIGNED_HEADER_SIZE	ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_block))
-#define ZEND_MM_ALIGNED_FREE_HEADER_SIZE ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_free_block))
-#define ZEND_MM_ALIGNED_SEGMENT_SIZE ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_segment))
-
-/* Memory calculations */
-#define ZEND_MM_BLOCK_AT(blk, offset)		((zend_mm_block *) (((char *) (blk))+(offset)))
-#define ZEND_MM_DATA_OF(p)				((void *) (((char *) (p))+ZEND_MM_ALIGNED_HEADER_SIZE))
-#define ZEND_MM_HEADER_OF(blk)			ZEND_MM_BLOCK_AT(blk, -(int)ZEND_MM_ALIGNED_HEADER_SIZE)
-
-/* Debug output */
-#define ZEND_MM_DEBUG(stmt)
-
-
-/* Start Heap Code */
-
-static int left_child[ZEND_HEAP_MAX_BUCKETS];
-static int left_child_of_right_brother[ZEND_HEAP_MAX_BUCKETS];
-
-static inline void zend_heap_init(zend_heap heap)
-{
-	int i;
-
-	for (i=0; i<ZEND_HEAP_MAX_BUCKETS; i++) {
-		left_child[i] = 2*i+1;
-		left_child_of_right_brother[i] = 2*i+3;
-	}
-
-	memset(heap, 0, sizeof(zend_heap));
-}
-
-static inline void zend_heap_activate_leaf(zend_heap heap, int node)
-{
-	int i = node + ZEND_HEAP_MAX_BUCKETS-1;
-
-	heap[i] = node;
-
-	do {
-		i = (i-1)>>1; /* (i-1)/2 */
-		if (heap[i] < node) {
-			heap[i] = node;
-		} else {
-			break;
-		}
-	} while (i > 0);
-}
-
-static inline void zend_heap_deactivate_leaf(zend_heap heap, int node)
-{
-	int i = node + ZEND_HEAP_MAX_BUCKETS-1;
-
-	heap[i] = 0;
-
-	do {
-		i = (i-1)>>1; /* (i-1)/2 */
-		if (heap[i] == node) {
-			heap[i] = MAX(heap[2*i+1], heap[2*i+2]);
-		} else {
-			break;
-		}
-	} while (i > 0);
-}
-
-static inline int zend_heap_search_leaf(zend_heap heap, int value)
-{
-	int i = 1;
-
-	if (heap[0] < value) {
-		return 0;
-	}
-
-
-	while (i < ZEND_HEAP_MAX_BUCKETS) {
-		if (heap[i] >= value) {
-			/* Go to left child */
-			i = left_child[i];
-		} else {
-			/* Go to left child of right brother */
-			i = left_child_of_right_brother[i];
-		}
-	}
-	if (heap[i] >= value) {
-		return heap[i];
-	} else {
-		return heap[i+1];
-	}
-}
-
-/* End Heap Code */
-
-static inline void zend_mm_add_to_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block)
-{
-	zend_mm_free_block **free_list_bucket;
-	size_t index = ZEND_MM_BUCKET_INDEX(mm_block->size);
-
-	if (index < ZEND_MM_NUM_BUCKETS) {
-		free_list_bucket = &heap->free_buckets[index];
-		if (*free_list_bucket == NULL) {
-			zend_heap_activate_leaf(heap->heap, index);
-		}
-	} else {
-		free_list_bucket = &heap->free_buckets[0];			
-	}
-	mm_block->next_free_block = *free_list_bucket;
-	if (*free_list_bucket != NULL) {
-		mm_block->next_free_block->prev_free_block = mm_block;
-	}
-	*free_list_bucket = mm_block;
-	mm_block->prev_free_block = NULL;
-}
-
-
-static inline void zend_mm_remove_from_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block)
-{
-	if (mm_block->prev_free_block) {
-		mm_block->prev_free_block->next_free_block = mm_block->next_free_block;
-	} else {
-		zend_mm_free_block **free_list_bucket;
-		size_t index = ZEND_MM_BUCKET_INDEX(mm_block->size);
-
-		if (index < ZEND_MM_NUM_BUCKETS) {
-			free_list_bucket = &heap->free_buckets[index];
-			*free_list_bucket = mm_block->next_free_block;
-			if (*free_list_bucket == NULL) {
-				zend_heap_deactivate_leaf(heap->heap, index);
-			}
-		} else {
-			free_list_bucket = &heap->free_buckets[0];
-			*free_list_bucket = mm_block->next_free_block;
-		}
-	}
-
-	if (mm_block->next_free_block) {
-		mm_block->next_free_block->prev_free_block = mm_block->prev_free_block;
-	}
-}
-
-static inline void zend_mm_create_new_free_block(zend_mm_heap *heap, zend_mm_block *mm_block, size_t true_size)
-{
-	int remaining_size;
-	zend_mm_free_block *new_free_block;
-
-	/* calculate sizes */
-	remaining_size = mm_block->size - true_size;
-
-	if (remaining_size < ZEND_MM_ALIGNED_FREE_HEADER_SIZE) {
-		/* keep best_fit->size as is, it'll include this extra space */
-		return;
-	}
-
-	/* prepare new free block */
-	mm_block->size = true_size;
-	new_free_block = (zend_mm_free_block *) ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-
-	new_free_block->type = ZEND_MM_FREE_BLOCK;
-	new_free_block->size = remaining_size;
-	new_free_block->prev_size = true_size;
-
-	/* update the next block's prev_size */
-	ZEND_MM_BLOCK_AT(new_free_block, new_free_block->size)->prev_size = new_free_block->size;
-
-	/* add the new free block to the free list */
-	zend_mm_add_to_free_list(heap, new_free_block);
-}
-
-zend_bool zend_mm_add_memory_block(zend_mm_heap *heap, size_t block_size)
-{
-	/* We need to make sure that block_size is big enough for the minimum segment size */
-	zend_mm_free_block *mm_block;
-	zend_mm_block *guard_block;
-	zend_mm_segment *segment;
-
-	/* align block size downwards */
-	block_size = block_size & ZEND_MM_ALIGNMENT_MASK;
-
-	segment = (zend_mm_segment *) malloc(block_size);
-	if (!segment) {
-		return 1;
-	}
-/*	fprintf(stderr, "Allocating segment %X\n", segment); */
-	segment->next_segment = heap->segments_list;
-	heap->segments_list = segment;
-
-	block_size -= ZEND_MM_ALIGNED_SEGMENT_SIZE;
-	mm_block = (zend_mm_free_block *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
-	
-	mm_block->size = block_size - ZEND_MM_ALIGNED_HEADER_SIZE; /* keep one guard block in the end */
-	mm_block->type = ZEND_MM_FREE_BLOCK;
-	mm_block->prev_size = 0; /* Size is always at least ZEND_MM_ALIGNED_HEADER_SIZE big (>0) so 0 is OK */
-	
-	/* setup guard block */
-	guard_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-	guard_block->type = ZEND_MM_USED_BLOCK;
-	guard_block->size = ZEND_MM_ALIGNED_HEADER_SIZE;
-	guard_block->guard_block = 1;
-	guard_block->prev_size = mm_block->size;
-	ZEND_MM_DEBUG(("Setup guard block at 0x%0.8X\n", guard_block));
-
-	zend_mm_add_to_free_list(heap, mm_block);
-
-	return 0;
-}
-
-/* Notes:
- * - This function may alter the block_sizes values to match platform alignment
- * - This function does *not* perform sanity checks on the arguments
- */
-zend_bool zend_mm_startup(zend_mm_heap *heap, size_t block_size)
-{
-	heap->block_size = block_size;
-	heap->segments_list = NULL;
-	memset(heap->free_buckets, 0, sizeof(heap->free_buckets));
-	zend_heap_init(heap->heap);
-	return zend_mm_add_memory_block(heap, block_size);
-}
-
-
-void zend_mm_shutdown(zend_mm_heap *heap)
-{
-	zend_mm_segment *segment = heap->segments_list;
-	zend_mm_segment *prev;
-
-	while (segment) {
-		prev = segment;
-		segment = segment->next_segment;
-/*		fprintf(stderr, "Freeing segment %X\n", prev);*/
-		free(prev);
-	}
-	heap->segments_list = NULL;
-}
-
-void *zend_mm_alloc(zend_mm_heap *heap, size_t size)
-{
-	size_t true_size;
-	zend_mm_free_block *p, *best_fit=NULL;
-	zend_mm_free_block **free_list_bucket;
-	size_t index;
-
-	/* The max() can probably be optimized with an if () which checks more specific cases */
-	true_size = MAX(ZEND_MM_ALIGNED_SIZE(size)+ZEND_MM_ALIGNED_HEADER_SIZE, ZEND_MM_ALIGNED_FREE_HEADER_SIZE);
-
-	index = ZEND_MM_BUCKET_INDEX(true_size);
-	
-	if (index < ZEND_MM_NUM_BUCKETS) {
-		free_list_bucket = &heap->free_buckets[index];
-		if (*free_list_bucket) {
-			best_fit = *free_list_bucket;
-			goto zend_mm_finished_searching_for_block;
-		} else {
-			int leaf;
-
-			leaf = zend_heap_search_leaf(heap->heap, index);
-			if (leaf != 0) {
-				best_fit = heap->free_buckets[leaf];
-				goto zend_mm_finished_searching_for_block;	
-			}
-		}
-	}
-
-	for (p = heap->free_buckets[0]; p; p = p->next_free_block) {
-		if (p->size == true_size) {
-			best_fit = p;
-			break;
-		}
-		if ((p->size > true_size) && (!best_fit || (best_fit->size > p->size))) {	/* better fit */
-			best_fit = p;
-		}
-	}
-
-zend_mm_finished_searching_for_block:
-	if (!best_fit) {
-		if (true_size > (heap->block_size - ZEND_MM_ALIGNED_SEGMENT_SIZE - ZEND_MM_ALIGNED_HEADER_SIZE)) {
-			/* Make sure we add a memory block which is big enough */
-			if (zend_mm_add_memory_block(heap, true_size + ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE)) {
-				zend_error(E_ERROR, "Out of memory: cannot allocate %zd bytes!", true_size);
-				return NULL;
-			}
-		} else {
-			if (zend_mm_add_memory_block(heap, heap->block_size)) {
-				zend_error(E_ERROR, "Out of memory: cannot allocate %zd bytes!", heap->block_size);
-				return NULL;
-			}
-		}
-		return zend_mm_alloc(heap, size);
-	}
-
-	/* mark as used */
-	best_fit->type = ZEND_MM_USED_BLOCK;
-	((zend_mm_block *) best_fit)->guard_block = 0;
-
-	/* remove from free list */
-	zend_mm_remove_from_free_list(heap, best_fit);
-
-	zend_mm_create_new_free_block(heap, (zend_mm_block *) best_fit, true_size);
-
-	return ZEND_MM_DATA_OF(best_fit);
-}
-
-
-void zend_mm_free(zend_mm_heap *heap, void *p)
-{
-	zend_mm_block *mm_block = ZEND_MM_HEADER_OF(p);
-	zend_mm_block *prev_block, *next_block;
-   
-	if (mm_block->type != ZEND_MM_USED_BLOCK) {
-		/* error */
-		return;
-	}
-
-	next_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-
-    /* merge with previous block if empty */
-	if (mm_block->prev_size != 0
-		&& (prev_block=ZEND_MM_BLOCK_AT(mm_block, -(int)mm_block->prev_size))->type == ZEND_MM_FREE_BLOCK) {
-		zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) prev_block);
-		prev_block->size += mm_block->size;
-		mm_block = prev_block;
-		next_block->prev_size = mm_block->size;
-	}
-
-	/* merge with the next block if empty */
-	if (next_block->type == ZEND_MM_FREE_BLOCK) {
-		mm_block->size += next_block->size;
-		zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) next_block);
-		next_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);	/* recalculate */
-		next_block->prev_size = mm_block->size;
-	}
-
-	mm_block->type = ZEND_MM_FREE_BLOCK;
-	zend_mm_add_to_free_list(heap, (zend_mm_free_block *) mm_block);
-}
-
-void *zend_mm_realloc(zend_mm_heap *heap, void *p, size_t size)
-{
-	zend_mm_block *mm_block = ZEND_MM_HEADER_OF(p);
-	zend_mm_block *next_block;
-	size_t true_size = MAX(ZEND_MM_ALIGNED_SIZE(size)+ZEND_MM_ALIGNED_HEADER_SIZE, ZEND_MM_ALIGNED_FREE_HEADER_SIZE);
-
-	next_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-
-	if (true_size <= mm_block->size) {
-		zend_mm_create_new_free_block(heap, mm_block, true_size);
-
-		if (next_block->type == ZEND_MM_FREE_BLOCK) {
-			zend_mm_block *new_next_block;
-
-			new_next_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-			if (new_next_block != next_block) { /* A new free block was created */
-				zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) new_next_block);
-				zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) next_block);
-				new_next_block->size += next_block->size;
-				/* update the next block's prev_size */
-				ZEND_MM_BLOCK_AT(new_next_block, new_next_block->size)->prev_size = new_next_block->size;
-				zend_mm_add_to_free_list(heap, (zend_mm_free_block *) new_next_block);
-			}
-		}
-		return p;
-	}
-
-	if ((mm_block->prev_size == 0) && (next_block->type == ZEND_MM_USED_BLOCK) &&
-		(next_block->guard_block)) {
-		zend_mm_segment *segment = (zend_mm_segment *) ((char *)mm_block - ZEND_MM_ALIGNED_SEGMENT_SIZE);
-		zend_mm_segment *segment_copy = segment;
-		zend_mm_block *guard_block;
-		size_t realloc_to_size;
-
-		/* segment size, size of block and size of guard block */
-		realloc_to_size = ZEND_MM_ALIGNED_SEGMENT_SIZE+true_size+ZEND_MM_ALIGNED_HEADER_SIZE;
-		segment = realloc(segment, realloc_to_size);
-		if (!segment) {
-			return NULL;
-		}
-
-		if (segment != segment_copy) {
-			if (heap->segments_list == segment_copy) {
-				heap->segments_list = segment;
-			} else {
-				zend_mm_segment *seg = heap->segments_list;
-
-				while (seg) {
-					if (seg->next_segment == segment_copy) {
-						seg->next_segment = segment;
-						break;
-					}
-					seg = seg->next_segment;
-				}				
-			}
-			mm_block = (zend_mm_block *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
-		}
-
-		mm_block->size = true_size;
-
-		/* setup guard block */
-		guard_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
-		guard_block->type = ZEND_MM_USED_BLOCK;
-		guard_block->size = ZEND_MM_ALIGNED_HEADER_SIZE;
-		guard_block->guard_block = 1;
-		guard_block->prev_size = mm_block->size;
-
-		return ZEND_MM_DATA_OF(mm_block);
-	}
-
-	if (next_block->type != ZEND_MM_FREE_BLOCK || (mm_block->size + next_block->size < true_size)) {
-		void *ptr;
-	
-		ptr = zend_mm_alloc(heap, size);
-		memcpy(ptr, p, mm_block->size - ZEND_MM_ALIGNED_HEADER_SIZE);
-		zend_mm_free(heap, p);
-		return ptr;
-	}
-
-	zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) next_block);
-	mm_block->size += next_block->size;
-	/* update the next block's prev_size */
-	ZEND_MM_BLOCK_AT(mm_block, mm_block->size)->prev_size = mm_block->size;
-	
-	zend_mm_create_new_free_block(heap, mm_block, true_size);
-
-	return p;
-}
-#endif
-/*
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * indent-tabs-mode: t
- * End:
- */
@@ -1,85 +0,0 @@
-/*
-   +----------------------------------------------------------------------+
-   | Zend Engine                                                          |
-   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
-   +----------------------------------------------------------------------+
-   | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        |
-   | available through the world-wide-web at the following url:           |
-   | http://www.zend.com/license/2_00.txt.                                |
-   | If you did not receive a copy of the Zend license and are unable to  |
-   | obtain it through the world-wide-web, please send a note to          |
-   | license@zend.com so we can mail you a copy immediately.              |
-   +----------------------------------------------------------------------+
-   | Authors: Andi Gutmans <andi@zend.com>                                |
-   |          Zeev Suraski <zeev@zend.com>                                |
-   +----------------------------------------------------------------------+
-*/
-
-/* $Id$ */
-#if 0
-#ifndef _ZEND_MM_H
-#define _ZEND_MM_H
-
-#include <sys/types.h>
-
-#include "zend.h"
-#include "zend_types.h"
-
-
-#ifdef ZEND_WIN32
-#undef ZEND_MM
-#else
-/* #define ZEND_MM */
-#undef ZEND_MM
-#endif
-
-/* mm block type */
-typedef struct _zend_mm_block {
-	unsigned int size : 31;
-	unsigned int type : 1;
-	size_t prev_size;
-	unsigned int guard_block : 1;
-} zend_mm_block;
-
-typedef struct _zend_mm_free_block {
-	unsigned int size : 31;
-	unsigned int type : 1;
-	size_t prev_size;
-	struct _zend_mm_free_block *prev_free_block;
-	struct _zend_mm_free_block *next_free_block;
-} zend_mm_free_block;
-
-typedef struct _zend_mm_segment {
-	struct _zend_mm_segment *next_segment;
-} zend_mm_segment;
-
-#define ZEND_MM_NUM_BUCKETS 16
-
-#define ZEND_HEAP_MAX_BUCKETS ZEND_MM_NUM_BUCKETS
-
-typedef int zend_heap[2*ZEND_HEAP_MAX_BUCKETS-1];
-
-typedef struct _zend_mm_heap {
-	zend_mm_segment *segments_list;
-	size_t block_size;
-	zend_mm_free_block *free_buckets[ZEND_MM_NUM_BUCKETS];
-	zend_heap heap;
-} zend_mm_heap;
-
-zend_bool zend_mm_startup(zend_mm_heap *heap, size_t block_size);
-void zend_mm_shutdown(zend_mm_heap *heap);
-void *zend_mm_alloc(zend_mm_heap *heap, size_t size);
-void zend_mm_free(zend_mm_heap *heap, void *p);
-void *zend_mm_realloc(zend_mm_heap *heap, void *p, size_t size);
-
-#endif /* _ZEND_MM_H */
-#endif
-/*
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * indent-tabs-mode: t
- * End:
- */
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        | 
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -334,14 +334,17 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)

 			if (rv) {
 				retval = &rv;
-				if ((type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET) && rv->refcount > 0) {
-					zval *tmp = rv;
+				if (!rv->is_ref &&
+				    (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
+					if (rv->refcount > 0) {
+						zval *tmp = rv;

-					ALLOC_ZVAL(rv);
-					*rv = *tmp;
-					zval_copy_ctor(rv);
-					rv->is_ref = 0;
-					rv->refcount = 0;
+						ALLOC_ZVAL(rv);
+						*rv = *tmp;
+						zval_copy_ctor(rv);
+						rv->is_ref = 0;
+						rv->refcount = 0;
+					}
 					if (Z_TYPE_P(rv) != IS_OBJECT) {
 						zend_error(E_NOTICE, "Indirect modification of overloaded property %s::$%s has no effect", zobj->ce->name, Z_STRVAL_P(member));
 					}
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -64,8 +64,11 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS

 ZEND_API void zend_objects_store_mark_destructed(zend_objects_store *objects TSRMLS_DC)
 {
-	zend_uint i = 1;
+	zend_uint i;

+	if (!objects->object_buckets) {
+		return;
+	}
 	for (i = 1; i < objects->top ; i++) {
 		if (objects->object_buckets[i].valid) {
 			objects->object_buckets[i].destructor_called = 1;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |