This commit was manufactured by cvs2svn to create tag 'php_5_2_6'.

These were caused by the tests assuming default values for some session
configuration settings, in particular session.save_path and session.name.
The tests now explicitly set these settings in the --INI-- section.

EXTENSIONS

@@ -159,7 +159,7 @@ STATUS:              Working
 SINCE:               5.0
 -------------------------------------------------------------------------------
 EXTENSION:           oci8
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>
+PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>, Antony Dovgal <tony2001@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------

README.PARAMETER_PARSING_API

@@ -70,7 +70,7 @@ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lsz",
 /* Gets an object of class specified by my_ce, and an optional double. */
 zval *obj;
 double d = 0.5;
-zend_class_entry my_ce;
+zend_class_entry *my_ce;
 if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O|d",
 						  &obj, my_ce, &d) == FAILURE) {
 	return;

README.UPDATE_5_2

@@ -172,6 +172,21 @@ Items from the NEWS file explained
   from your error handler in order to populate $php_errormsg. This allows
   you to fine-grain the levels of the messages stored.
 
+==============================
+Regressions introduced/fixed
+==============================
+
+- In version 5.2.4 a security fix caused a regression for patterns of
+  the form "/foo/*/bar/*". Since version 5.2.5 instead of raising a warning the
+  glob() function will return false when openbase_dir restrictions are violated.
+
+  #See http://bugs.php.net/bug.php?id=41655
+
+  The warning that used to be raised looked like something as follows:
+  Warning: glob() [function.glob]: Unable to access /foo/*/bar/* in /foo.php on line xxx
+  #See http://cvs.php.net/viewvc.cgi/php-src/ext/standard/dir.c?r1=1.169&r2=1.170
+
+  The patch can safely be applied to PHP 5.2.4 as well.
 
 ==============================
 Backwards incompatible changes

TSRM/TSRM.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Thread Safe Resource Manager                                         |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1999-2007, Andi Gutmans, Sascha Schumann, Zeev Suraski |
+   | Copyright (c) 1999-2008, Andi Gutmans, Sascha Schumann, Zeev Suraski |
    | This source file is subject to the TSRM license, that is bundled     |
    | with this package in the file LICENSE                                |
    +----------------------------------------------------------------------+

TSRM/TSRM.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Thread Safe Resource Manager                                         |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1999-2007, Andi Gutmans, Sascha Schumann, Zeev Suraski |
+   | Copyright (c) 1999-2008, Andi Gutmans, Sascha Schumann, Zeev Suraski |
    | This source file is subject to the TSRM license, that is bundled     |
    | with this package in the file LICENSE                                |
    +----------------------------------------------------------------------+

TSRM/tsrm_nw.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_virtual_cwd.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -489,6 +489,9 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	int ret;
 	int use_cache;
 	int use_relative_path = 0;
+#ifdef TSRM_WIN32
+	int is_unc;
+#endif
 	TSRMLS_FETCH();
 
 	use_cache = ((use_realpath != CWD_EXPAND) && CWDG(realpath_cache_size_limit));
@@ -573,9 +576,6 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 		char *ptr, *path_copy, *free_path;
 		char *tok;
 		int ptr_length;
-#ifdef TSRM_WIN32
-		int is_unc;
-#endif
 no_realpath:
 
 #ifdef TSRM_WIN32
@@ -712,22 +712,24 @@ no_realpath:
 			}
 			ptr = tsrm_strtok_r(NULL, TOKENIZER_STRING, &tok);
 		}
-#if defined(TSRM_WIN32) || defined(NETWARE)
-		if (path[path_length-1] == '\\' || path[path_length-1] == '/') {
-#else 
-		if (path[path_length-1] == '/') {
-#endif
-			state->cwd = (char*)realloc(state->cwd, state->cwd_length + 2);
-			state->cwd[state->cwd_length++] = DEFAULT_SLASH;
-			state->cwd[state->cwd_length] = 0;
-		}
-
 		free(free_path);
 
-		if ((use_realpath == CWD_REALPATH) && ret) {
-			CWD_STATE_FREE(state);
-			*state = old_state;					
-			return 1;
+		if (use_realpath == CWD_REALPATH) {
+			if (ret) {
+				CWD_STATE_FREE(state);
+				*state = old_state;					
+				return 1;
+			}
+		} else {
+#if defined(TSRM_WIN32) || defined(NETWARE)
+			if (path[path_length-1] == '\\' || path[path_length-1] == '/') {
+#else 
+			if (path[path_length-1] == '/') {
+#endif
+				state->cwd = (char*)realloc(state->cwd, state->cwd_length + 2);
+				state->cwd[state->cwd_length++] = DEFAULT_SLASH;
+				state->cwd[state->cwd_length] = 0;
+			}
 		}
 
 		if (state->cwd_length == COPY_WHEN_ABSOLUTE(state->cwd)) {
@@ -738,7 +740,12 @@ no_realpath:
 		}
 	}
 
+	/* Store existent file in realpath cache. */
+#ifdef TSRM_WIN32
+	if (use_cache && !is_unc) {
+#else
 	if (use_cache && (use_realpath == CWD_REALPATH)) {
+#endif
 		realpath_cache_add(path, path_length, state->cwd, state->cwd_length, t TSRMLS_CC);
 	}
 

TSRM/tsrm_virtual_cwd.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_win32.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_win32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2007 The PHP Group                                |
+   | Copyright (c) 1997-2008 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/acconfig.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/tests/bug29674.phpt

@@ -33,7 +33,7 @@ $obj->printVars();
 ===BASE===
 string(4) "Base"
 
-Notice: Undefined property:  BaseClass::$private_child in %sbug29674.php on line %d
+Notice: Undefined property: BaseClass::$private_child in %sbug29674.php on line %d
 NULL
 ===CHILD===
 string(4) "Base"

Zend/tests/bug29689.phpt

@@ -52,7 +52,7 @@ $baz->printFoo();
 --EXPECTF--
 foo: foo foo2
 bar: bar 
-Notice: Undefined property:  bar::$foo2 in %s on line %d
+Notice: Undefined property: bar::$foo2 in %s on line %d
 
 ---baz--
 foo: foo foo2

Zend/tests/bug30922.phpt

@@ -10,4 +10,4 @@ var_dump($a instanceOf A);
 echo "ok\n";
 ?>
 --EXPECTF--
-Fatal error: Interface RecurisiveFooFar cannot not implement itself in %sbug30922.php on line %d
+Fatal error: Interface RecurisiveFooFar cannot implement itself in %sbug30922.php on line %d

Zend/tests/bug36071.phpt

@@ -6,8 +6,6 @@ error_reporting=4095
 <?php
 $a = clone 0;
 $a[0]->b = 0;
-echo "ok\n";
 ?>
 --EXPECTF--
-Warning: __clone method called on non-object in %sbug36071.php on line 2
-ok
+Fatal error: __clone method called on non-object in %sbug36071.php on line 2

Zend/tests/bug38469.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #38469 Unexpected creation of cycle
+--FILE--
+<?php
+$a = array();
+$a[0] = $a;
+var_dump($a);
+$b = array(array());
+$b[0][0] = $b;
+var_dump($b);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(0) {
+  }
+}
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(0) {
+      }
+    }
+  }
+}

Zend/tests/bug41919.phpt

@@ -8,5 +8,4 @@ $foo[3]->bar[1] = "bang";
 echo "ok\n";
 ?>
 --EXPECTF--
-Warning: Cannot use string offset as an array in %s/bug41919.php on line %d
-ok
+Fatal error: Cannot use string offset as an object in %s/bug41919.php on line %d

Zend/tests/bug42772.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #42772 (Storing $this in a static var fails while handling a cast to string)
+--FILE--
+<?php
+class Foo {
+    static public $foo;
+    function __toString() {
+        self::$foo = $this;
+        return 'foo';
+    }
+}
+
+$foo = (string)new Foo();
+var_dump(Foo::$foo);
+?>
+--EXPECT--
+object(Foo)#1 (0) {
+}

Zend/tests/bug42817.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #42817 (clone() on a non-object does not result in a fatal error)
+--FILE--
+<?php
+$a = clone(null);
+array_push($a->b, $c);
+?>
+--EXPECTF--
+Fatal error: __clone method called on non-object in %sbug42817.php on line 2

Zend/tests/bug42818.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #42818 ($foo = clone(array()); leaks memory)
+--FILE--
+<?php
+$foo = clone(array());
+?>
+--EXPECTF--
+Fatal error: __clone method called on non-object in %sbug42818.php on line 2
+

Zend/tests/bug42937.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #42937 (__call() method not invoked when methods are called on parent from child class)
+--FILE--
+<?php
+class A {
+	function __call($strMethod, $arrArgs) {
+		echo "$strMethod\n";
+	}
+}
+
+class C {
+	function __call($strMethod, $arrArgs) {
+		echo "$strMethod\n";
+	}
+}
+
+class B extends A {
+	function test() {
+		self::test1();
+		parent::test2();
+		A::test3();
+		B::test4();
+		C::test5();
+	}
+}
+
+$a = new A();
+$a->test();
+
+$b = new B();
+$b->test();
+?>
+--EXPECTF--
+test
+test1
+test2
+test3
+test4
+
+Fatal error: Call to undefined method C::test5() in %sbug42937.php on line 20

Zend/tests/bug43128.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #43128 Very long class name causes segfault 
+--FILE--
+<?php
+
+$a = str_repeat("a", 10 * 1024 * 1024);
+
+eval("class $a {}");
+
+# call_user_func($a); // Warning
+# $a->$a();           // Fatal error
+
+if ($a instanceof $a); // Segmentation fault
+new $a;                // Segmentation fault
+echo "ok\n";
+--EXPECT--
+ok

Zend/tests/bug43175.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #43175 (__destruct() throwing an exception with __call() causes segfault)
+--FILE--
+<?php
+
+class foobar {
+    public function __destruct() {
+        throw new Exception();
+    }
+    public function __call($m, $a) {
+        return $this;
+    }
+}
+function foobar() {
+    return new foobar();
+}
+try {
+    foobar()->unknown();
+} catch (Exception $e) {
+    echo "__call via traditional factory should be caught\n";
+}
+?>
+--EXPECT--
+__call via traditional factory should be caught

Zend/tests/bug43201.phpt

@@ -0,0 +1,54 @@
+--TEST--
+Bug #43201 (Crash on using unitialized vals and __get/__set)
+--FILE--
+<?php
+class Foo {
+	function __get($k) {
+		return null;
+	}
+	function __set($k, $v) {
+		$this->$k = $v;
+	}
+}
+
+$c = new Foo();
+
+$c->arr[0]["k"] = 1;
+$c->arr[0]["k2"] = $ref;
+for($cnt=0;$cnt<6;$cnt++) {
+	$ref = chop($undef);	
+	$c->arr[$cnt]["k2"] = $ref;
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 13
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 14
+
+Notice: Undefined variable: ref in %sbug43201.php on line 14
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+ok

Zend/tests/bug43450.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #43450 (Memory leak on some functions with implicit object __toString() call)
+--SKIPIF--
+<?php if (!function_exists('memory_get_usage')) die('memory_get_usage() not installed'); ?>
+--FILE--
+<?php
+error_reporting(E_ALL|E_STRICT);
+
+class Foo 
+{
+    public function __toString()
+	{
+	    return __CLASS__;
+	}
+}
+
+$num_repeats = 100000;
+
+$start = (memory_get_usage() / 1024) + 16;
+for ($i=1;$i<$num_repeats;$i++) 
+{
+	$foo = new Foo();
+	md5($foo);
+}
+$end = memory_get_peak_usage() / 1024;
+
+if ($start < $end) {
+	echo 'FAIL';
+} else {
+	echo 'PASS';
+}
+
+?>
+--EXPECT--
+PASS

Zend/tests/bug43483.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #43483 (get_class_methods() does not list all visible methods)
+--FILE--
+<?php
+class C {
+	public static function test() {
+		D::prot();
+		print_r(get_class_methods("D"));
+	}
+}
+class D extends C {
+	protected static function prot() {
+		echo "Successfully called D::prot().\n";
+	}
+}
+D::test();
+?>
+--EXPECT--
+Successfully called D::prot().
+Array
+(
+    [0] => prot
+    [1] => test
+)

Zend/tests/bug43703.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #43703 (Signature compatibility check broken)
+--FILE--
+<?php
+class JoinPoint
+{
+}
+
+abstract class Pointcut
+{
+    abstract public function evaluate(JoinPoint $joinPoint);
+}
+
+class Read extends Pointcut
+{
+    public function evaluate(Joinpoint $joinPoint)
+    {
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE

Zend/tests/bug44069.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #44069 (Huge memory usage with concatenation using . instead of .=)
+--FILE--
+<?php
+$array = array();
+$newstring = "";
+$string = str_repeat('This is a teststring.', 50);
+for($i = 1; $i <= 2000; $i++)
+{
+//	$newstring .= $string; //This uses an expected amount of mem.
+	$newstring = $newstring . $string; //This uses very much mem.
+
+	for($j = 1; $j <= 10; $j++)
+	{
+		$array[] = 'test';
+	}
+}
+echo "ok\n";
+?>
+--EXPECT--
+ok

Zend/tests/bug44141.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #44141 (private parent constructor callable through static function)
+--FILE--
+<?php
+class X
+{
+        public $x;
+        private function __construct($x)
+        {
+                $this->x = $x;
+        }
+}
+
+class Y extends X
+{
+        static public function cheat($x)
+        {
+                return new Y($x);
+        }
+}
+
+$y = Y::cheat(5);
+echo $y->x, PHP_EOL;
+--EXPECTF--
+Fatal error: Call to private X::__construct() from context 'Y' in %sbug44141.php on line 15

Zend/tests/bug44184.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #44184 (Double free of loop-variable on exception)
+--FILE--
+<?php
+function foo() {
+	$x = array(1,2,3);
+	foreach ($x as $a) {
+		while (1) {
+			throw new Exception();
+		}
+	    return;
+	}
+}
+try {
+	foo();
+} catch (Exception $ex) {
+	echo "ok\n";
+}
+?>
+--EXPECT--
+ok

Zend/tests/clone_uncloneable.phpt

@@ -0,0 +1,20 @@
+--TEST--
+cloning uncloneable object
+--SKIPIF--
+<?php if (!extension_loaded("xsl")) die("skip xsl extension is missing");?>
+--INI--
+zend.ze1_compatibility_mode=1
+--FILE--
+<?php
+
+$new = &new XSLTProcessor(); 
+var_dump($new);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Strict Standards: Assigning the return value of new by reference is deprecated in %s on line %d
+
+Strict Standards: Implicit cloning object of class 'XSLTProcessor' because of 'zend.ze1_compatibility_mode' in %s on line %d
+
+Fatal error: Trying to clone uncloneable object of class XSLTProcessor in Unknown on line 0

Zend/tests/errmsg_038.phpt

@@ -10,4 +10,4 @@ class test {
 echo "Done\n";
 ?>
 --EXPECTF--	
-Fatal error: Cannot declare property test::$var final, the final modifier is allowed only for methods in %s on line %d
+Fatal error: Cannot declare property test::$var final, the final modifier is allowed only for methods and classes in %s on line %d

Zend/tests/indexing_001.phpt

@@ -0,0 +1,212 @@
+--TEST--
+Indexing - various special cases.
+--FILE--
+<?php
+echo "*** Indexing - Testing value assignment with key ***\n";
+$array=array(1);
+$testvalues=array(null, 0, 1, true, false,'',' ',0.1,array());
+
+foreach ($testvalues as $testvalue) {
+	$testvalue['foo']=$array;
+	var_dump ($testvalue);
+}
+echo "\n*** Indexing - Testing reference assignment with key ***\n";
+
+$testvalues=array(null, 0, 1, true, false,'',0.1,array());
+
+foreach ($testvalues as $testvalue) {
+	$testvalue['foo']=&$array;
+	var_dump ($testvalue);
+}
+echo "*** Indexing - Testing value assignment no key ***\n";
+$array=array(1);
+$testvalues=array(null, 0, 1, true, false,'',0.1,array());
+
+foreach ($testvalues as $testvalue) {
+	$testvalue[]=$array;
+	var_dump ($testvalue);
+}
+echo "\n*** Indexing - Testing reference assignment no key ***\n";
+
+$testvalues=array(null, 0, 1, true, false,'',0.1,array());
+
+foreach ($testvalues as $testvalue) {
+	$testvalue[]=&$array;
+	var_dump ($testvalue);
+}
+
+
+echo "\nDone";
+?>
+--EXPECTF--
+*** Indexing - Testing value assignment with key ***
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(0)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(1)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Notice: Array to string conversion in %s on line %d
+string(1) "A"
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+float(0.1)
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+*** Indexing - Testing reference assignment with key ***
+array(1) {
+  ["foo"]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(0)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(1)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+bool(true)
+array(1) {
+  ["foo"]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+array(1) {
+  ["foo"]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+float(0.1)
+array(1) {
+  ["foo"]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+*** Indexing - Testing value assignment no key ***
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(0)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(1)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+bool(true)
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+float(0.1)
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+*** Indexing - Testing reference assignment no key ***
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(0)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+int(1)
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+bool(true)
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+float(0.1)
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    int(1)
+  }
+}
+
+Done

Zend/tests/multibyte/multibyte_encoding_001.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Zend Multibyte and ShiftJIS
+--SKIPIF--
+<?php
+if (!in_array("detect_unicode", array_keys(ini_get_all()))) {
+  die("skip Requires configure --enable-zend-multibyte option");
+}
+if (!extension_loaded("mbstring")) {
+  die("skip Requires mbstring extension");
+}
+?>
+--INI--
+mbstring.internal_encoding=SJIS
+--FILE--
+<?php
+declare(encoding='Shift_JIS');
+$s = "•\"; // 0x95+0x5c in script, not somewhere else "
+printf("%x:%x\n", ord($s[0]), ord($s[1]));
+?>
+===DONE===
+--EXPECT--
+95:5c
+===DONE===

Zend/tests/multibyte/multibyte_encoding_002.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Zend Multibyte and UTF-8 BOM
+--SKIPIF--
+<?php
+if (!in_array("detect_unicode", array_keys(ini_get_all()))) {
+  die("skip Requires configure --enable-zend-multibyte option");
+}
+if (!extension_loaded("mbstring")) {
+  die("skip Requires mbstring extension");
+}
+?>
+--INI--
+mbstring.internal_encoding=iso-8859-1
+--FILE--
+<?php
+print "Hello World\n";
+?>
+===DONE===
+--EXPECT--
+Hello World
+===DONE===

Zend/zend.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -101,7 +101,7 @@ ZEND_API zval zval_used_for_init; /* True global variable */
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2007 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2008 Zend Technologies\n"
 
 
 #define PRINT_ZVAL_INDENT 4

Zend/zend.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -181,9 +181,21 @@ char *alloca ();
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2)) && !(defined(ZTS) && defined(ZEND_WIN32)) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
 # define do_alloca(p) alloca(p)
 # define free_alloca(p)
+# define ZEND_ALLOCA_MAX_SIZE (32 * 1024)
+# define ALLOCA_FLAG(name) \
+	zend_bool name;
+# define do_alloca_with_limit_ex(size, limit, use_heap) \
+	((use_heap = ((size) > (limit))) ? emalloc(size) : alloca(size))
+# define do_alloca_with_limit(size, use_heap) \
+	do_alloca_with_limit_ex(size, ZEND_ALLOCA_MAX_SIZE, use_heap)
+# define free_alloca_with_limit(p, use_heap) \
+	do { if (use_heap) efree(p); } while (0)
 #else
 # define do_alloca(p)		emalloc(p)
 # define free_alloca(p)	efree(p)
+# define ALLOCA_FLAG(name)
+# define do_alloca_with_limit(p, use_heap)		emalloc(p)
+# define free_alloca_with_limit(p, use_heap)	efree(p)
 #endif
 
 #if ZEND_DEBUG

Zend/zend_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -168,9 +168,15 @@ ZEND_API int _zend_get_parameters_array_ex(int param_count, zval ***argument_arr
 			*value_ptr = **value;
 			INIT_PZVAL(value_ptr);
 			zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);
+
+			if (Z_OBJ_HANDLER_PP(value, clone_obj) == NULL) {
+				zend_error(E_CORE_ERROR, "Trying to clone uncloneable object of class %s", class_name);
+			}
+
 			if(!dup) {
 				efree(class_name);
 			}
+
 			value_ptr->value.obj = Z_OBJ_HANDLER_PP(value, clone_obj)(*value TSRMLS_CC);
 			zval_ptr_dtor(value);
 			*value = value_ptr;
@@ -1700,7 +1706,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, zend_function_entr
 				if (!(scope->ce_flags & ZEND_ACC_INTERFACE)) {
 					/* Since the class is not an interface it needs to be declared as a abstract class. */
 					/* Since here we are handling internal functions only we can add the keyword flag. */
-					/* This time we set the flag for the keyword 'abstratc'. */
+					/* This time we set the flag for the keyword 'abstract'. */
 					scope->ce_flags |= ZEND_ACC_EXPLICIT_ABSTRACT_CLASS;
 				}
 			}
@@ -1723,11 +1729,10 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, zend_function_entr
 			}
 		}
 		fname_len = strlen(ptr->fname);
-		lowercase_name = do_alloca(fname_len+1);
-		zend_str_tolower_copy(lowercase_name, ptr->fname, fname_len);
+		lowercase_name = zend_str_tolower_dup(ptr->fname, fname_len);
 		if (zend_hash_add(target_function_table, lowercase_name, fname_len+1, &function, sizeof(zend_function), (void**)&reg_function) == FAILURE) {
 			unload=1;
-			free_alloca(lowercase_name);
+			efree(lowercase_name);
 			break;
 		}
 		if (scope) {
@@ -1767,7 +1772,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, zend_function_entr
 		}
 		ptr++;
 		count++;
-		free_alloca(lowercase_name);
+		efree(lowercase_name);
 	}
 	if (unload) { /* before unloading, display all remaining bad function in the module */
 		if (scope) {

Zend/zend_API.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_alloc.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -396,6 +396,7 @@ struct _zend_mm_heap {
 	size_t              free_bitmap;
 	size_t              large_free_bitmap;
 	size_t              block_size;
+	size_t              compact_size;
 	zend_mm_segment    *segments_list;
 	zend_mm_storage    *storage;
 	size_t				real_size;
@@ -648,10 +649,15 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 static inline unsigned int zend_mm_high_bit(size_t _size)
 {
 #if defined(__GNUC__) && defined(i386)
-    unsigned int n;
+	unsigned int n;
 
 	__asm__("bsrl %1,%0\n\t" : "=r" (n) : "rm"  (_size));
 	return n;
+#elif defined(__GNUC__) && defined(__x86_64__)
+	unsigned long n;
+
+        __asm__("bsrq %1,%0\n\t" : "=r" (n) : "rm"  (_size));
+        return (unsigned int)n;
 #elif defined(_MSC_VER) && defined(_M_IX86)
 	__asm {
 		bsr eax, _size
@@ -669,10 +675,15 @@ static inline unsigned int zend_mm_high_bit(size_t _size)
 static inline unsigned int zend_mm_low_bit(size_t _size)
 {
 #if defined(__GNUC__) && defined(i386)
-    unsigned int n;
+	unsigned int n;
 
 	__asm__("bsfl %1,%0\n\t" : "=r" (n) : "rm"  (_size));
 	return n;
+#elif defined(__GNUC__) && defined(__x86_64__)
+        unsigned long n;
+
+        __asm__("bsfq %1,%0\n\t" : "=r" (n) : "rm"  (_size));
+        return (unsigned int)n;
 #elif defined(_MSC_VER) && defined(_M_IX86)
 	__asm {
 		bsf eax, _size
@@ -1028,6 +1039,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_mem_handlers *handlers,
 
 	heap->storage = storage;
 	heap->block_size = block_size;
+	heap->compact_size = 0;
 	heap->segments_list = NULL;
 	zend_mm_init(heap);
 # if ZEND_MM_CACHE_STAT
@@ -1078,6 +1090,7 @@ ZEND_API zend_mm_heap *zend_mm_startup(void)
 	char *mem_type = getenv("ZEND_MM_MEM_TYPE");
 	char *tmp;
 	const zend_mm_mem_handlers *handlers;
+	zend_mm_heap *heap;
 
 	if (mem_type == NULL) {
 		i = 0;
@@ -1109,7 +1122,16 @@ ZEND_API zend_mm_heap *zend_mm_startup(void)
 		seg_size = ZEND_MM_SEG_SIZE;
 	}
 
-	return zend_mm_startup_ex(handlers, seg_size, ZEND_MM_RESERVE_SIZE, 0, NULL);
+	heap = zend_mm_startup_ex(handlers, seg_size, ZEND_MM_RESERVE_SIZE, 0, NULL);
+	if (heap) {
+		tmp = getenv("ZEND_MM_COMPACT");
+		if (tmp) {
+			heap->compact_size = zend_atoi(tmp, 0);
+		} else {
+			heap->compact_size = 2 * 1024 * 1024;
+		}
+	}
+	return heap;
 }
 
 #if ZEND_DEBUG
@@ -1563,7 +1585,9 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, int full_shutdown, int silent
 #ifdef HAVE_MEM_WIN32
 		/* FIX for bug #41713 */
 		/* TODO: add new "compact" handler */
-		if (storage->handlers->dtor == zend_mm_mem_win32_dtor &&
+		if (heap->compact_size &&
+		    heap->real_peak > heap->compact_size &&
+		    storage->handlers->dtor == zend_mm_mem_win32_dtor &&
 		    storage->handlers->init == zend_mm_mem_win32_init) {
 		    HeapDestroy((HANDLE)storage->data);
 		    storage->data = (void*)HeapCreate(HEAP_NO_SERIALIZE, 0, 0);
@@ -1723,6 +1747,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	size_t remaining_size;
 	size_t segment_size;
 	zend_mm_segment *segment;
+	int keep_rest = 0;
 
 	if (EXPECTED(ZEND_MM_SMALL_SIZE(true_size))) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
@@ -1791,6 +1816,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 			   segment must have header "size" and trailer "guard" block */
 			segment_size = true_size + ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE;
 			segment_size = (segment_size + (heap->block_size-1)) & ~(heap->block_size-1);
+			keep_rest = 1;
 		} else {
 			segment_size = heap->block_size;
 		}
@@ -1870,7 +1896,11 @@ zend_mm_finished_searching_for_block:
 		ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
 
 		/* add the new free block to the free list */
-		zend_mm_add_to_free_list(heap, new_free_block);
+		if (EXPECTED(!keep_rest)) {
+			zend_mm_add_to_free_list(heap, new_free_block);
+		} else {
+			zend_mm_add_to_rest_list(heap, new_free_block);
+		}
 	}
 
 	ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 1);
@@ -2286,10 +2316,10 @@ ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_
 static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 {
 	size_t res = nmemb;
-	unsigned long overflow ;
+	unsigned long overflow = 0;
 
-	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl $0,%1"
-	     : "=a"(res), "=d" (overflow)
+	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl %1,%1"
+	     : "=&a"(res), "=&d" (overflow)
 	     : "%0"(res),
 	       "rm"(size),
 	       "rm"(offset));
@@ -2301,6 +2331,26 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	return res;
 }
 
+#elif defined(__GNUC__) && defined(__x86_64__)
+
+static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+{
+        size_t res = nmemb;
+        unsigned long overflow = 0;
+
+        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq %1,%1"
+             : "=&a"(res), "=&d" (overflow)
+             : "%0"(res),
+               "rm"(size),
+               "rm"(offset));
+
+        if (UNEXPECTED(overflow)) {
+                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                return 0;
+        }
+        return res;
+}
+
 #else
 
 static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)

Zend/zend_alloc.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_arg_defs.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_builtin_functions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -867,7 +867,7 @@ ZEND_FUNCTION(get_class_methods)
 		if ((mptr->common.fn_flags & ZEND_ACC_PUBLIC) 
 		 || (EG(scope) &&
 		     (((mptr->common.fn_flags & ZEND_ACC_PROTECTED) &&
-		       instanceof_function(EG(scope), mptr->common.scope TSRMLS_CC))
+		       zend_check_protected(mptr->common.scope, EG(scope)))
 		   || ((mptr->common.fn_flags & ZEND_ACC_PRIVATE) &&
 		       EG(scope) == mptr->common.scope)))) {
 			char *key;
@@ -1013,19 +1013,20 @@ ZEND_FUNCTION(class_exists)
 	char *class_name, *lc_name;
 	zend_class_entry **ce;
 	int class_name_len;
-	zend_bool autoload = 1;
 	int found;
+	zend_bool autoload = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &class_name, &class_name_len, &autoload) == FAILURE) {
 		return;
 	}
 
 	if (!autoload) {
-		lc_name = do_alloca(class_name_len + 1);
+		lc_name = do_alloca_with_limit(class_name_len + 1, use_heap);
 		zend_str_tolower_copy(lc_name, class_name, class_name_len);
 	
 		found = zend_hash_find(EG(class_table), lc_name, class_name_len+1, (void **) &ce);
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		RETURN_BOOL(found == SUCCESS && !((*ce)->ce_flags & ZEND_ACC_INTERFACE));
 	}
 
@@ -1044,19 +1045,20 @@ ZEND_FUNCTION(interface_exists)
 	char *iface_name, *lc_name;
 	zend_class_entry **ce;
 	int iface_name_len;
-	zend_bool autoload = 1;
 	int found;
+	zend_bool autoload = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &iface_name, &iface_name_len, &autoload) == FAILURE) {
 		return;
 	}
 
 	if (!autoload) {
-		lc_name = do_alloca(iface_name_len + 1);
+		lc_name = do_alloca_with_limit(iface_name_len + 1, use_heap);
 		zend_str_tolower_copy(lc_name, iface_name, iface_name_len);
 	
 		found = zend_hash_find(EG(class_table), lc_name, iface_name_len+1, (void **) &ce);
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		RETURN_BOOL(found == SUCCESS && (*ce)->ce_flags & ZEND_ACC_INTERFACE);
 	}
 
@@ -1216,6 +1218,7 @@ ZEND_FUNCTION(set_error_handler)
 		had_orig_error_handler = 1;
 		*return_value = *EG(user_error_handler);
 		zval_copy_ctor(return_value);
+		INIT_PZVAL(return_value);
 		zend_stack_push(&EG(user_error_handlers_error_reporting), &EG(user_error_handler_error_reporting), sizeof(EG(user_error_handler_error_reporting)));
 		zend_ptr_stack_push(&EG(user_error_handlers), EG(user_error_handler));
 	}
@@ -1230,6 +1233,7 @@ ZEND_FUNCTION(set_error_handler)
 	EG(user_error_handler_error_reporting) = (int)error_type;
 	*EG(user_error_handler) = *error_handler;
 	zval_copy_ctor(EG(user_error_handler));
+	INIT_PZVAL(EG(user_error_handler));
 
 	if (!had_orig_error_handler) {
 		RETURN_NULL();

Zend/zend_builtin_functions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_compile.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -541,8 +541,39 @@ static zend_bool opline_is_fetch_this(zend_op *opline TSRMLS_DC)
 
 void zend_do_assign(znode *result, znode *variable, znode *value TSRMLS_DC)
 {
-	int last_op_number = get_next_op_number(CG(active_op_array));
-	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	int last_op_number;
+	zend_op *opline;
+
+	if (value->op_type == IS_CV) {
+		zend_llist *fetch_list_ptr;
+
+		zend_stack_top(&CG(bp_stack), (void **) &fetch_list_ptr);
+		if (fetch_list_ptr && fetch_list_ptr->head) {
+			opline = (zend_op *)fetch_list_ptr->head->data;
+
+			if (opline->opcode == ZEND_FETCH_DIM_W &&
+			    opline->op1.op_type == IS_CV &&
+			    opline->op1.u.var == value->u.var) {
+
+				opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+				opline->opcode = ZEND_FETCH_R;
+				opline->result.op_type = IS_VAR;
+				opline->result.u.EA.type = 0;
+				opline->result.u.var = get_temporary_variable(CG(active_op_array));
+				opline->op1.op_type = IS_CONST;
+				ZVAL_STRINGL(&opline->op1.u.constant,
+					CG(active_op_array)->vars[value->u.var].name, 
+					CG(active_op_array)->vars[value->u.var].name_len, 1);
+				SET_UNUSED(opline->op2);
+				value = &opline->result;
+			}
+		}
+	}
+
+	zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
+
+	last_op_number = get_next_op_number(CG(active_op_array));
+	opline = get_next_op(CG(active_op_array) TSRMLS_CC);
 
 	if (variable->op_type == IS_VAR) {
 		int n = 0;
@@ -654,8 +685,14 @@ static inline void do_begin_loop(TSRMLS_D)
 }
 
 
-static inline void do_end_loop(int cont_addr TSRMLS_DC)
+static inline void do_end_loop(int cont_addr, int has_loop_var TSRMLS_DC)
 {
+	if (!has_loop_var) {
+		/* The start fileld is used to free temporary variables in case of exceptions.
+		 * We won't try to free something of we don't have loop variable.
+		 */
+		CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].start = -1;
+	}
 	CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].cont = cont_addr;
 	CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].brk = get_next_op_number(CG(active_op_array));
 	CG(active_op_array)->current_brk_cont = CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].parent;
@@ -690,7 +727,7 @@ void zend_do_while_end(znode *while_token, znode *close_bracket_token TSRMLS_DC)
 	/* update while's conditional jmp */
 	CG(active_op_array)->opcodes[close_bracket_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array));
 
-	do_end_loop(while_token->u.opline_num TSRMLS_CC);
+	do_end_loop(while_token->u.opline_num, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -734,7 +771,7 @@ void zend_do_for_end(znode *second_semicolon_token TSRMLS_DC)
 	SET_UNUSED(opline->op1);
 	SET_UNUSED(opline->op2);
 
-	do_end_loop(second_semicolon_token->u.opline_num+1 TSRMLS_CC);
+	do_end_loop(second_semicolon_token->u.opline_num+1, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -1069,6 +1106,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
 	zend_uint fn_flags;
 	char *lcname;
 	zend_bool orig_interactive;
+	ALLOCA_FLAG(use_heap)
 
 	if (is_method) {
 		if (CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE) {
@@ -1129,7 +1167,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
 		}
 
 		if (!(CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE)) {
-			short_class_name = do_alloca(short_class_name_length + 1);
+			short_class_name = do_alloca_with_limit(short_class_name_length + 1, use_heap);
 			zend_str_tolower_copy(short_class_name, CG(active_class_entry)->name, short_class_name_length);
 			/* Improve after RC: cache the lowercase class name */
 
@@ -1163,7 +1201,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
 			} else if (!(fn_flags & ZEND_ACC_STATIC)) {
 				CG(active_op_array)->fn_flags |= ZEND_ACC_ALLOW_STATIC;
 			}
-			free_alloca(short_class_name);
+			free_alloca_with_limit(short_class_name, use_heap);
 		}
 
 		efree(lcname);
@@ -1990,7 +2028,7 @@ static zend_bool zend_do_perform_implementation_check(zend_function *fe, zend_fu
 			return 0;
 		}
 		if (fe->common.arg_info[i].class_name
-			&& strcmp(fe->common.arg_info[i].class_name, proto->common.arg_info[i].class_name)!=0) {
+			&& strcasecmp(fe->common.arg_info[i].class_name, proto->common.arg_info[i].class_name)!=0) {
 			return 0;
 		}
 		if (fe->common.arg_info[i].array_type_hint != proto->common.arg_info[i].array_type_hint) {
@@ -2191,7 +2229,7 @@ static inline void do_implement_interface(zend_class_entry *ce, zend_class_entry
 		zend_error(E_CORE_ERROR, "Class %s could not implement interface %s", ce->name, iface->name);
 	}
 	if (ce == iface) {
-		zend_error(E_ERROR, "Interface %s cannot not implement itself", ce->name);
+		zend_error(E_ERROR, "Interface %s cannot implement itself", ce->name);
 	}
 }
 
@@ -2614,7 +2652,7 @@ void zend_do_do_while_end(znode *do_token, znode *expr_open_bracket, znode *expr
 	opline->op2.u.opline_num = do_token->u.opline_num;
 	SET_UNUSED(opline->op2);
 
-	do_end_loop(expr_open_bracket->u.opline_num TSRMLS_CC);
+	do_end_loop(expr_open_bracket->u.opline_num, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -3005,7 +3043,7 @@ void zend_do_declare_property(znode *var_name, znode *value, zend_uint access_ty
 	}
 
 	if (access_type & ZEND_ACC_FINAL) {
-		zend_error(E_COMPILE_ERROR, "Cannot declare property %s::$%s final, the final modifier is allowed only for methods",
+		zend_error(E_COMPILE_ERROR, "Cannot declare property %s::$%s final, the final modifier is allowed only for methods and classes",
 				   CG(active_class_entry)->name, var_name->u.constant.value.str.val);
 	}
 
@@ -3420,8 +3458,6 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 	zend_llist_element *dimension;
 	zend_op *opline;
 	znode last_container;
-	int last_op_number;
-	zend_op *last_op;
 
 	le = CG(list_llist).head;
 	while (le) {
@@ -3461,9 +3497,6 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 		}
 		((list_llist_element *) le->data)->value = last_container;
 		zend_llist_destroy(&((list_llist_element *) le->data)->dimensions);
-		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
-		last_op_number = get_next_op_number(CG(active_op_array))-1;
-		last_op = &CG(active_op_array)->opcodes[last_op_number];
 		zend_do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value TSRMLS_CC);
 		zend_do_free(result TSRMLS_CC);
 		le = le->next;
@@ -3824,9 +3857,9 @@ void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znod
 
 	value_node = opline->result;
 
-	zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 	if (assign_by_ref) {
 		/* Mark FE_FETCH as IS_VAR as it holds the data directly as a value */
+		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 		zend_do_assign_ref(NULL, value, &value_node TSRMLS_CC);
 	} else {
 		zend_do_assign(&dummy, value, &value_node TSRMLS_CC);
@@ -3836,7 +3869,6 @@ void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znod
 	if (key->op_type != IS_UNUSED) {
 		znode key_node;
 
-		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 		opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1];
 		opline->result.op_type = IS_TMP_VAR;
 		opline->result.u.EA.type = 0;
@@ -3865,7 +3897,7 @@ void zend_do_foreach_end(znode *foreach_token, znode *as_token TSRMLS_DC)
 	CG(active_op_array)->opcodes[foreach_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array)); /* FE_RESET */
 	CG(active_op_array)->opcodes[as_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array)); /* FE_FETCH */
 
-	do_end_loop(as_token->u.opline_num TSRMLS_CC);
+	do_end_loop(as_token->u.opline_num, 1 TSRMLS_CC);
 
 	zend_stack_top(&CG(foreach_copy_stack), (void **) &container_ptr);
 	generate_free_foreach_copy(container_ptr TSRMLS_CC);

Zend/zend_compile.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_config.nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_config.w32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_constants.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -274,6 +274,7 @@ ZEND_API int zend_get_constant_ex(char *name, uint name_len, zval *result, zend_
 			zval_update_constant_ex(ret_constant, (void*)1, *ce TSRMLS_CC);
 			*result = **ret_constant;
 			zval_copy_ctor(result);
+			INIT_PZVAL(result);
 		}
 
 		return retval;

Zend/zend_constants.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_default_classes.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_dynamic_array.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_dynamic_array.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_errors.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_exceptions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_exceptions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_execute.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -645,7 +645,13 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 
 			if (((int)T->str_offset.offset < 0)) {
 				zend_error(E_WARNING, "Illegal string offset:  %d", T->str_offset.offset);
-				break;
+				if (!RETURN_VALUE_UNUSED(result)) {
+					T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
+					PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
+					AI_USE_PTR(T(result->u.var).var);
+				}
+				FREE_OP_VAR_PTR(free_op1);
+				return;
 			}
 			if (T->str_offset.offset >= Z_STRLEN_P(T->str_offset.str)) {
 				zend_uint i;
@@ -665,7 +671,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 
 			if (Z_TYPE_P(value)!=IS_STRING) {
 				tmp = *value;
-				if (op2->op_type & (IS_VAR|IS_CV)) {
+				if (op2->op_type != IS_TMP_VAR) {
 					zval_copy_ctor(&tmp);
 				}
 				convert_to_string(&tmp);
@@ -674,16 +680,13 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 
 			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL_P(final_value)[0];
 
-			if (op2->op_type == IS_TMP_VAR) {
-				if (final_value == &T(op2->u.var).tmp_var) {
-					/* we can safely free final_value here
-					 * because separation is done only
-					 * in case op2->op_type == IS_VAR */
-					STR_FREE(Z_STRVAL_P(final_value));
-				}
-			}
 			if (final_value == &tmp) {
 				zval_dtor(final_value);
+			} else if (op2->op_type == IS_TMP_VAR) {
+				/* we can safely free final_value here
+				 * because separation is done only
+				 * in case op2->op_type == IS_VAR */
+				STR_FREE(Z_STRVAL_P(final_value));
 			}
 			/*
 			 * the value of an assignment to a string offset is undefined
@@ -692,11 +695,11 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 		} while (0);
 		/* zval_ptr_dtor(&T->str_offset.str); Nuke this line if it doesn't cause a leak */
 
-/*		T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); */
 		if (!RETURN_VALUE_UNUSED(result)) {
-			T(result->u.var).var.ptr_ptr = &value;
-			PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
-			AI_USE_PTR(T(result->u.var).var);
+			T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr;
+			ALLOC_ZVAL(T(result->u.var).var.ptr);
+			INIT_PZVAL(T(result->u.var).var.ptr);
+			ZVAL_STRINGL(T(result->u.var).var.ptr, Z_STRVAL_P(T->str_offset.str)+T->str_offset.offset, 1, 1);
 		}
 		FREE_OP_VAR_PTR(free_op1);
 		return;
@@ -736,18 +739,12 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
  				zend_uint refcount = variable_ptr->refcount;
  				zval garbage;
  
- 				if (type != IS_TMP_VAR) {
- 					value->refcount++;
- 				}
  				garbage = *variable_ptr;
  				*variable_ptr = *value;
  				variable_ptr->refcount = refcount;
  				variable_ptr->is_ref = 1;
  				zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);
  				variable_ptr->value.obj = Z_OBJ_HANDLER_P(value, clone_obj)(value TSRMLS_CC);
- 				if (type != IS_TMP_VAR) {
- 					value->refcount--;
- 				}
  				zendi_zval_dtor(garbage);
  			}
  		} else {
@@ -775,16 +772,12 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 			zend_uint refcount = variable_ptr->refcount;
 			zval garbage;
 
-			if (type!=IS_TMP_VAR) {
-				value->refcount++;
-			}
 			garbage = *variable_ptr;
 			*variable_ptr = *value;
 			variable_ptr->refcount = refcount;
 			variable_ptr->is_ref = 1;
 			if (type!=IS_TMP_VAR) {
 				zendi_zval_copy_ctor(*variable_ptr);
-				value->refcount--;
 			}
 			zendi_zval_dtor(garbage);
 		}
@@ -1234,12 +1227,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 	zval *container;
 
 	if (!container_ptr) {
-		zend_error(E_WARNING, "Cannot use string offset as an array");
-		if (result) {
-			result->var.ptr_ptr = &EG(error_zval_ptr);
-			PZVAL_LOCK(*result->var.ptr_ptr);
-		}
-		return;
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
 	}
 
 	container = *container_ptr;

Zend/zend_execute.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_execute_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -452,6 +452,19 @@ ZEND_API int zend_is_true(zval *op)
 #define IS_CONSTANT_VISITED(p)    (Z_TYPE_P(p) & IS_VISITED_CONSTANT)
 #define MARK_CONSTANT_VISITED(p)  Z_TYPE_P(p) |= IS_VISITED_CONSTANT
 
+static void zval_deep_copy(zval **p)
+{
+	zval *value;
+
+	ALLOC_ZVAL(value);
+	*value = **p;
+	Z_TYPE_P(value) &= ~IS_CONSTANT_INDEX;
+	zval_copy_ctor(value);
+	Z_TYPE_P(value) = Z_TYPE_PP(p);
+	INIT_PZVAL(value);
+	*p = value;
+}
+
 ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *scope TSRMLS_DC)
 {
 	zval *p = *pp;
@@ -503,6 +516,16 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco
 		p = *pp;
 		Z_TYPE_P(p) = IS_ARRAY;
 
+		if (!inline_change) {
+			zval *tmp;
+			HashTable *tmp_ht = NULL;
+
+			ALLOC_HASHTABLE(tmp_ht);
+			zend_hash_init(tmp_ht, zend_hash_num_elements(Z_ARRVAL_P(p)), NULL, ZVAL_PTR_DTOR, 0);
+			zend_hash_copy(tmp_ht, Z_ARRVAL_P(p), (copy_ctor_func_t) zval_deep_copy, (void *) &tmp, sizeof(zval *));
+			Z_ARRVAL_P(p) = tmp_ht;
+		} 
+
 		/* First go over the array and see if there are any constant indices */
 		zend_hash_internal_pointer_reset(Z_ARRVAL_P(p));
 		while (zend_hash_get_current_data(Z_ARRVAL_P(p), (void **) &element)==SUCCESS) {
@@ -1034,19 +1057,20 @@ ZEND_API int zend_lookup_class_ex(char *name, int name_length, int use_autoload,
 	int retval;
 	char *lc_name;
 	zval *exception;
-	char dummy = 1;
 	zend_fcall_info fcall_info;
 	zend_fcall_info_cache fcall_cache;
+	char dummy = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (name == NULL || !name_length) {
 		return FAILURE;
 	}
 	
-	lc_name = do_alloca(name_length + 1);
+	lc_name = do_alloca_with_limit(name_length + 1, use_heap);
 	zend_str_tolower_copy(lc_name, name, name_length);
 
 	if (zend_hash_find(EG(class_table), lc_name, name_length+1, (void **) ce) == SUCCESS) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return SUCCESS;
 	}
 
@@ -1054,7 +1078,7 @@ ZEND_API int zend_lookup_class_ex(char *name, int name_length, int use_autoload,
 	 * (doesn't impact fuctionality of __autoload()
 	*/
 	if (!use_autoload || zend_is_compiling(TSRMLS_C)) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
@@ -1064,7 +1088,7 @@ ZEND_API int zend_lookup_class_ex(char *name, int name_length, int use_autoload,
 	}
 	
 	if (zend_hash_add(EG(in_autoload), lc_name, name_length+1, (void**)&dummy, sizeof(char), NULL) == FAILURE) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
@@ -1102,12 +1126,12 @@ ZEND_API int zend_lookup_class_ex(char *name, int name_length, int use_autoload,
 
 	if (retval == FAILURE) {
 		EG(exception) = exception;
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
 	if (EG(exception) && exception) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		zend_error(E_ERROR, "Function %s(%s) threw an exception of type '%s'", ZEND_AUTOLOAD_FUNC_NAME, name, Z_OBJCE_P(EG(exception))->name);
 		return FAILURE;
 	}
@@ -1119,7 +1143,7 @@ ZEND_API int zend_lookup_class_ex(char *name, int name_length, int use_autoload,
 	}
 
 	retval = zend_hash_find(EG(class_table), lc_name, name_length + 1, (void **) ce);
-	free_alloca(lc_name);
+	free_alloca_with_limit(lc_name, use_heap);
 	return retval;
 }
 

Zend/zend_extensions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_extensions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_fast_cache.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_globals.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_globals_macros.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_hash.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_hash.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_highlight.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_highlight.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_indent.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_indent.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_ini.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -26,7 +26,7 @@
 #include "zend_operators.h"
 #include "zend_strtod.h"
 
-static HashTable *registered_zend_ini_directives; 
+static HashTable *registered_zend_ini_directives;
 
 #define NO_VALUE_PLAINTEXT		"no value"
 #define NO_VALUE_HTML			"<i>no value</i>"
@@ -51,7 +51,7 @@ static int zend_restore_ini_entry_cb(zend_ini_entry *ini_entry, int stage TSRMLS
 			zend_try {
 			/* even if on_modify bails out, we have to continue on with restoring,
 				since there can be allocated variables that would be freed on MM shutdown
-				and would lead to memory corruption later  ini entry is modified again */
+				and would lead to memory corruption later ini entry is modified again */
 				ini_entry->on_modify(ini_entry, ini_entry->orig_value, ini_entry->orig_value_length, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage TSRMLS_CC);
 			} zend_end_try();
 		}
@@ -63,6 +63,9 @@ static int zend_restore_ini_entry_cb(zend_ini_entry *ini_entry, int stage TSRMLS
 		ini_entry->modified = 0;
 		ini_entry->orig_value = NULL;
 		ini_entry->orig_value_length = 0;
+		if (ini_entry->modifiable >= (1 << 3)) {
+			ini_entry->modifiable >>= 3;
+		}
 	}
 	return 0;
 }
@@ -84,7 +87,7 @@ ZEND_API int zend_ini_startup(TSRMLS_D) /* {{{ */
 
 	EG(ini_directives) = registered_zend_ini_directives;
 	EG(modified_ini_directives) = NULL;
-	if (zend_hash_init_ex(registered_zend_ini_directives, 100, NULL, NULL, 1, 0)==FAILURE) {
+	if (zend_hash_init_ex(registered_zend_ini_directives, 100, NULL, NULL, 1, 0) == FAILURE) {
 		return FAILURE;
 	}
 	return SUCCESS;
@@ -126,7 +129,7 @@ ZEND_API int zend_copy_ini_directives(TSRMLS_D) /* {{{ */
 
 	EG(modified_ini_directives) = NULL;
 	EG(ini_directives) = (HashTable *) malloc(sizeof(HashTable));
-	if (zend_hash_init_ex(EG(ini_directives), registered_zend_ini_directives->nNumOfElements, NULL, NULL, 1, 0)==FAILURE) {
+	if (zend_hash_init_ex(EG(ini_directives), registered_zend_ini_directives->nNumOfElements, NULL, NULL, 1, 0) == FAILURE) {
 		return FAILURE;
 	}
 	zend_hash_copy(EG(ini_directives), registered_zend_ini_directives, NULL, &ini_entry, sizeof(zend_ini_entry));
@@ -139,15 +142,15 @@ static int ini_key_compare(const void *a, const void *b TSRMLS_DC) /* {{{ */
 {
 	Bucket *f;
 	Bucket *s;
- 
+
 	f = *((Bucket **) a);
 	s = *((Bucket **) b);
 
-	if (f->nKeyLength==0 && s->nKeyLength==0) { /* both numeric */
+	if (f->nKeyLength == 0 && s->nKeyLength == 0) { /* both numeric */
 		return ZEND_NORMALIZE_BOOL(f->nKeyLength - s->nKeyLength);
-	} else if (f->nKeyLength==0) { /* f is numeric, s is not */
+	} else if (f->nKeyLength == 0) { /* f is numeric, s is not */
 		return -1;
-	} else if (s->nKeyLength==0) { /* s is numeric, f is not */
+	} else if (s->nKeyLength == 0) { /* s is numeric, f is not */
 		return 1;
 	} else { /* both strings */
 		return zend_binary_strcasecmp(f->arKey, f->nKeyLength, s->arKey, s->nKeyLength);
@@ -189,15 +192,15 @@ ZEND_API int zend_register_ini_entries(zend_ini_entry *ini_entry, int module_num
 	while (p->name) {
 		p->module_number = module_number;
 		config_directive_success = 0;
-		if (zend_hash_add(directives, p->name, p->name_length, p, sizeof(zend_ini_entry), (void **) &hashed_ini_entry)==FAILURE) {
+		if (zend_hash_add(directives, p->name, p->name_length, p, sizeof(zend_ini_entry), (void **) &hashed_ini_entry) == FAILURE) {
 			zend_unregister_ini_entries(module_number TSRMLS_CC);
 			return FAILURE;
 		}
-		if ((zend_get_configuration_directive(p->name, p->name_length, &default_value))==SUCCESS) {
+		if ((zend_get_configuration_directive(p->name, p->name_length, &default_value)) == SUCCESS) {
 			if (!hashed_ini_entry->on_modify
-				|| hashed_ini_entry->on_modify(hashed_ini_entry, default_value.value.str.val, default_value.value.str.len, hashed_ini_entry->mh_arg1, hashed_ini_entry->mh_arg2, hashed_ini_entry->mh_arg3, ZEND_INI_STAGE_STARTUP TSRMLS_CC)==SUCCESS) {
-				hashed_ini_entry->value = default_value.value.str.val;
-				hashed_ini_entry->value_length = default_value.value.str.len;
+				|| hashed_ini_entry->on_modify(hashed_ini_entry, Z_STRVAL(default_value), Z_STRLEN(default_value), hashed_ini_entry->mh_arg1, hashed_ini_entry->mh_arg2, hashed_ini_entry->mh_arg3, ZEND_INI_STAGE_STARTUP TSRMLS_CC) == SUCCESS) {
+				hashed_ini_entry->value = Z_STRVAL(default_value);
+				hashed_ini_entry->value_length = Z_STRLEN(default_value);
 				config_directive_success = 1;
 			}
 		}
@@ -244,15 +247,20 @@ ZEND_API int zend_alter_ini_entry_ex(char *name, uint name_length, char *new_val
 {
 	zend_ini_entry *ini_entry;
 	char *duplicate;
+	zend_bool modifiable;
 	zend_bool modified;
 	TSRMLS_FETCH();
 
-	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==FAILURE) {
+	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry) == FAILURE) {
 		return FAILURE;
 	}
 
+	modifiable = ini_entry->modifiable;
+	modified = ini_entry->modified;
+
 	if (stage == ZEND_INI_STAGE_ACTIVATE && modify_type == ZEND_INI_SYSTEM) {
-		ini_entry->modifiable = ZEND_INI_SYSTEM;
+		/* only touch lower bits */
+		ini_entry->modifiable = (ini_entry->modifiable & (ZEND_INI_ALL << 3)) | ZEND_INI_SYSTEM;
 	}
 
 	if (!force_change) {
@@ -261,8 +269,6 @@ ZEND_API int zend_alter_ini_entry_ex(char *name, uint name_length, char *new_val
 		}
 	}
 
-	modified = ini_entry->modified;
-
 	if (!EG(modified_ini_directives)) {
 		ALLOC_HASHTABLE(EG(modified_ini_directives));
 		zend_hash_init(EG(modified_ini_directives), 8, NULL, NULL, 0);
@@ -270,6 +276,8 @@ ZEND_API int zend_alter_ini_entry_ex(char *name, uint name_length, char *new_val
 	if (!modified) {
 		ini_entry->orig_value = ini_entry->value;
 		ini_entry->orig_value_length = ini_entry->value_length;
+		/* store orginial value in the upper bits */
+		ini_entry->modifiable = (modifiable << 3) | ini_entry->modifiable;
 		ini_entry->modified = 1;
 		zend_hash_add(EG(modified_ini_directives), name, name_length, &ini_entry, sizeof(zend_ini_entry*), NULL);
 	}
@@ -277,7 +285,7 @@ ZEND_API int zend_alter_ini_entry_ex(char *name, uint name_length, char *new_val
 	duplicate = estrndup(new_value, new_value_length);
 
 	if (!ini_entry->on_modify
-		|| ini_entry->on_modify(ini_entry, duplicate, new_value_length, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage TSRMLS_CC)==SUCCESS) {
+		|| ini_entry->on_modify(ini_entry, duplicate, new_value_length, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage TSRMLS_CC) == SUCCESS) {
 		if (modified && ini_entry->orig_value != ini_entry->value) { /* we already changed the value, free the changed value */
 			efree(ini_entry->value);
 		}
@@ -296,8 +304,8 @@ ZEND_API int zend_restore_ini_entry(char *name, uint name_length, int stage) /*
 	zend_ini_entry *ini_entry;
 	TSRMLS_FETCH();
 
-	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==FAILURE ||
-	    (stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifiable & ZEND_INI_USER) == 0)) {
+	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry) == FAILURE ||
+		(stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifiable & ZEND_INI_USER) == 0)) {
 		return FAILURE;
 	}
 
@@ -305,7 +313,7 @@ ZEND_API int zend_restore_ini_entry(char *name, uint name_length, int stage) /*
 		zend_restore_ini_entry_cb(ini_entry, stage TSRMLS_CC);
 		zend_hash_del(EG(modified_ini_directives), name, name_length);
 	}
-	
+
 	return SUCCESS;
 }
 /* }}} */
@@ -314,7 +322,7 @@ ZEND_API int zend_ini_register_displayer(char *name, uint name_length, void (*di
 {
 	zend_ini_entry *ini_entry;
 
-	if (zend_hash_find(registered_zend_ini_directives, name, name_length, (void **) &ini_entry)==FAILURE) {
+	if (zend_hash_find(registered_zend_ini_directives, name, name_length, (void **) &ini_entry) == FAILURE) {
 		return FAILURE;
 	}
 
@@ -332,7 +340,7 @@ ZEND_API long zend_ini_long(char *name, uint name_length, int orig) /* {{{ */
 	zend_ini_entry *ini_entry;
 	TSRMLS_FETCH();
 
-	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==SUCCESS) {
+	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry) == SUCCESS) {
 		if (orig && ini_entry->modified) {
 			return (ini_entry->orig_value ? strtol(ini_entry->orig_value, NULL, 0) : 0);
 		} else if (ini_entry->value) {
@@ -349,7 +357,7 @@ ZEND_API double zend_ini_double(char *name, uint name_length, int orig) /* {{{ *
 	zend_ini_entry *ini_entry;
 	TSRMLS_FETCH();
 
-	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==SUCCESS) {
+	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry) == SUCCESS) {
 		if (orig && ini_entry->modified) {
 			return (double) (ini_entry->orig_value ? zend_strtod(ini_entry->orig_value, NULL) : 0.0);
 		} else if (ini_entry->value) {
@@ -366,7 +374,7 @@ ZEND_API char *zend_ini_string(char *name, uint name_length, int orig) /* {{{ */
 	zend_ini_entry *ini_entry;
 	TSRMLS_FETCH();
 
-	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==SUCCESS) {
+	if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry) == SUCCESS) {
 		if (orig && ini_entry->modified) {
 			return ini_entry->orig_value;
 		} else {
@@ -378,7 +386,7 @@ ZEND_API char *zend_ini_string(char *name, uint name_length, int orig) /* {{{ */
 }
 /* }}} */
 
-#if TONY_20070307 
+#if TONY_20070307
 static void zend_ini_displayer_cb(zend_ini_entry *ini_entry, int type) /* {{{ */
 {
 	if (ini_entry->displayer) {
@@ -387,18 +395,18 @@ static void zend_ini_displayer_cb(zend_ini_entry *ini_entry, int type) /* {{{ */
 		char *display_string;
 		uint display_string_length;
 
-		if (type==ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
+		if (type == ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
 			if (ini_entry->orig_value) {
 				display_string = ini_entry->orig_value;
 				display_string_length = ini_entry->orig_value_length;
 			} else {
 				if (zend_uv.html_errors) {
 					display_string = NO_VALUE_HTML;
-					display_string_length = sizeof(NO_VALUE_HTML)-1;
+					display_string_length = sizeof(NO_VALUE_HTML) - 1;
 				} else {
 					display_string = NO_VALUE_PLAINTEXT;
-					display_string_length = sizeof(NO_VALUE_PLAINTEXT)-1;
-				}	
+					display_string_length = sizeof(NO_VALUE_PLAINTEXT) - 1;
+				}
 			}
 		} else if (ini_entry->value && ini_entry->value[0]) {
 			display_string = ini_entry->value;
@@ -406,11 +414,11 @@ static void zend_ini_displayer_cb(zend_ini_entry *ini_entry, int type) /* {{{ */
 		} else {
 			if (zend_uv.html_errors) {
 				display_string = NO_VALUE_HTML;
-				display_string_length = sizeof(NO_VALUE_HTML)-1;
+				display_string_length = sizeof(NO_VALUE_HTML) - 1;
 			} else {
 				display_string = NO_VALUE_PLAINTEXT;
-				display_string_length = sizeof(NO_VALUE_PLAINTEXT)-1;
-			}	
+				display_string_length = sizeof(NO_VALUE_PLAINTEXT) - 1;
+			}
 		}
 		ZEND_WRITE(display_string, display_string_length);
 	}
@@ -423,7 +431,7 @@ ZEND_INI_DISP(zend_ini_boolean_displayer_cb) /* {{{ */
 	int value, tmp_value_len;
 	char *tmp_value;
 
-	if (type==ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
+	if (type == ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
 		tmp_value = (ini_entry->orig_value ? ini_entry->orig_value : NULL );
 		tmp_value_len = ini_entry->orig_value_length;
 	} else if (ini_entry->value) {
@@ -434,18 +442,20 @@ ZEND_INI_DISP(zend_ini_boolean_displayer_cb) /* {{{ */
 		tmp_value_len = 0;
 	}
 
-	if (tmp_value_len == 4 && strcasecmp(tmp_value, "true") == 0) {
-		value = 1;
-	} else if (tmp_value_len == 3 && strcasecmp(tmp_value, "yes") == 0) {
-		value = 1;
-	} else if (tmp_value_len == 2 && strcasecmp(tmp_value, "on") == 0) {
-		value = 1;
-	} else if (value) {
-		value = atoi(tmp_value);
+	if (tmp_value) {
+		if (tmp_value_len == 4 && strcasecmp(tmp_value, "true") == 0) {
+			value = 1;
+		} else if (tmp_value_len == 3 && strcasecmp(tmp_value, "yes") == 0) {
+			value = 1;
+		} else if (tmp_value_len == 2 && strcasecmp(tmp_value, "on") == 0) {
+			value = 1;
+		} else {
+			value = atoi(tmp_value);
+		}
 	} else {
 		value = 0;
 	}
-	
+
 	if (value) {
 		ZEND_PUTS("On");
 	} else {
@@ -458,7 +468,7 @@ ZEND_INI_DISP(zend_ini_color_displayer_cb) /* {{{ */
 {
 	char *value;
 
-	if (type==ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
+	if (type == ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
 		value = ini_entry->orig_value;
 	} else if (ini_entry->value) {
 		value = ini_entry->value;
@@ -470,13 +480,13 @@ ZEND_INI_DISP(zend_ini_color_displayer_cb) /* {{{ */
 			zend_printf("<font style=\"color: %s\">%s</font>", value, value);
 		} else {
 			ZEND_PUTS(value);
-		}   
+		}
 	} else {
 		if (zend_uv.html_errors) {
 			ZEND_PUTS(NO_VALUE_HTML);
 		} else {
 			ZEND_PUTS(NO_VALUE_PLAINTEXT);
-		}	
+		}
 	}
 }
 /* }}} */
@@ -485,7 +495,7 @@ ZEND_INI_DISP(display_link_numbers) /* {{{ */
 {
 	char *value;
 
-	if (type==ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
+	if (type == ZEND_INI_DISPLAY_ORIG && ini_entry->modified) {
 		value = ini_entry->orig_value;
 	} else if (ini_entry->value) {
 		value = ini_entry->value;
@@ -494,7 +504,7 @@ ZEND_INI_DISP(display_link_numbers) /* {{{ */
 	}
 
 	if (value) {
-		if (atoi(value)==-1) {
+		if (atoi(value) == -1) {
 			ZEND_PUTS("Unlimited");
 		} else {
 			zend_printf("%s", value);
@@ -517,15 +527,15 @@ ZEND_API ZEND_INI_MH(OnUpdateBool) /* {{{ */
 
 	p = (zend_bool *) (base+(size_t) mh_arg1);
 
-	if (new_value_length==2 && strcasecmp("on", new_value)==0) {
+	if (new_value_length == 2 && strcasecmp("on", new_value) == 0) {
 		*p = (zend_bool) 1;
-	} 
-	else if (new_value_length==3 && strcasecmp("yes", new_value)==0) {
+	}
+	else if (new_value_length == 3 && strcasecmp("yes", new_value) == 0) {
 		*p = (zend_bool) 1;
-	} 
-	else if (new_value_length==4 && strcasecmp("true", new_value)==0) {
+	}
+	else if (new_value_length == 4 && strcasecmp("true", new_value) == 0) {
 		*p = (zend_bool) 1;
-	} 
+	}
 	else {
 		*p = (zend_bool) atoi(new_value);
 	}
@@ -549,6 +559,7 @@ ZEND_API ZEND_INI_MH(OnUpdateLong) /* {{{ */
 	*p = zend_atoi(new_value, new_value_length);
 	return SUCCESS;
 }
+/* }}} */
 
 ZEND_API ZEND_INI_MH(OnUpdateLongGEZero)
 {

Zend/zend_ini.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_ini_parser.y

@@ -3,7 +3,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_ini_scanner.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_interfaces.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_interfaces.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_istdiostream.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_iterators.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_iterators.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_language_parser.y

@@ -551,7 +551,7 @@ non_empty_for_expr:
 
 expr_without_variable:
 		T_LIST '(' { zend_do_list_init(TSRMLS_C); } assignment_list ')' '=' expr { zend_do_list_end(&$$, &$7 TSRMLS_CC); }
-	|	variable '=' expr		{ zend_check_writable_variable(&$1); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign(&$$, &$1, &$3 TSRMLS_CC); }
+	|	variable '=' expr		{ zend_check_writable_variable(&$1); zend_do_assign(&$$, &$1, &$3 TSRMLS_CC); }
 	|	variable '=' '&' variable { zend_check_writable_variable(&$1); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign_ref(&$$, &$1, &$4 TSRMLS_CC); }
 	|	variable '=' '&' T_NEW class_name_reference { zend_error(E_STRICT, "Assigning the return value of new by reference is deprecated");  zend_check_writable_variable(&$1); zend_do_extended_fcall_begin(TSRMLS_C); zend_do_begin_new_object(&$4, &$5 TSRMLS_CC); } ctor_arguments { zend_do_end_new_object(&$3, &$4, &$7 TSRMLS_CC); zend_do_extended_fcall_end(TSRMLS_C); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign_ref(&$$, &$1, &$3 TSRMLS_CC); }
 	|	T_NEW class_name_reference { zend_do_extended_fcall_begin(TSRMLS_C); zend_do_begin_new_object(&$1, &$2 TSRMLS_CC); } ctor_arguments { zend_do_end_new_object(&$$, &$1, &$4 TSRMLS_CC); zend_do_extended_fcall_end(TSRMLS_C);}
@@ -740,13 +740,13 @@ r_variable:
 
 
 w_variable:
-	variable	{ zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); $$ = $1; }
-				{ zend_check_writable_variable(&$1); }
+	variable	{ zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); $$ = $1;
+				zend_check_writable_variable(&$1); }
 ;
 
 rw_variable:
-	variable	{ zend_do_end_variable_parse(BP_VAR_RW, 0 TSRMLS_CC); $$ = $1; }
-				{ zend_check_writable_variable(&$1); }
+	variable	{ zend_do_end_variable_parse(BP_VAR_RW, 0 TSRMLS_CC); $$ = $1;
+				zend_check_writable_variable(&$1); }
 ;
 
 variable:

Zend/zend_language_scanner.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_language_scanner.l

@@ -723,7 +723,7 @@ ZEND_API int zend_multibyte_yyinput(zend_file_handle *file_handle, char *buf, si
 
 	/* TODO: support widechars */
 
-	for (n = 0; n < sizeof(buf) && (c = zend_stream_getc(yyin TSRMLS_CC)) != EOF && c != '\n'; ++n) {
+	for (n = 0; n < len && (c = zend_stream_getc(yyin TSRMLS_CC)) != EOF && c != '\n'; ++n) {
 		buf[n] = (char)c;
 	}
 	if (c == '\n') {
@@ -731,8 +731,8 @@ ZEND_API int zend_multibyte_yyinput(zend_file_handle *file_handle, char *buf, si
 	}
 
 	SCNG(script_org_size) = n;
-	SCNG(script_org) = (char*)emalloc(SCNG(script_org_size)+1);
-	memcpy(SCNG(script_org)+SCNG(script_org_size)-n, buf, n);
+	SCNG(script_org) = (char*)emalloc(SCNG(script_org_size) + 1);
+	memcpy(SCNG(script_org), buf, n);
 
 	return n;
 }
@@ -749,29 +749,18 @@ ZEND_API int zend_multibyte_read_script(TSRMLS_D)
 	SCNG(script_org) = NULL;
 	SCNG(script_org_size) = 0;
 
-	for (;;) {
-		n = zend_stream_read(yyin, buf, sizeof(buf) TSRMLS_CC);
-		if (n <= 0) {
-			break;
-		}
-
+	for (; (n = zend_stream_read(yyin, buf, sizeof(buf) TSRMLS_CC)) > 0; ) {
 		SCNG(script_org_size) += n;
-		if (SCNG(script_org)) {
-			SCNG(script_org) = (char*)erealloc(SCNG(script_org), SCNG(script_org_size)+1);
-		} else {
-			SCNG(script_org) = (char*)emalloc(SCNG(script_org_size)+1);
-		}
-		memcpy(SCNG(script_org)+SCNG(script_org_size)-n, buf, n);
+		SCNG(script_org) = (char*)erealloc(SCNG(script_org), SCNG(script_org_size));
+		memcpy(SCNG(script_org) + SCNG(script_org_size) - n, buf, n);
 	}
 
 	if (n < 0) {
 		return -1;
 	}
 
-	if (!SCNG(script_org)) {
-		SCNG(script_org) = emalloc(SCNG(script_org_size)+1);
-	}
-	*(SCNG(script_org)+SCNG(script_org_size)) = (char)NULL;
+	SCNG(script_org) = (char*)erealloc(SCNG(script_org), SCNG(script_org_size) + 1);
+	*(SCNG(script_org)+SCNG(script_org_size)) = '\0';
 
 	return 0;
 }
@@ -1930,8 +1919,13 @@ HEREDOC_CHARS       ("{"*([^$\n\r\\{]|("\\"[^\n\r]))|{HEREDOC_LITERAL_DOLLAR}|({
 	if (yyleng > CG(heredoc_len) && !memcmp(end - CG(heredoc_len), CG(heredoc), CG(heredoc_len))) {
 		int len = yyleng - CG(heredoc_len) - 2; /* 2 for newline before and after label */
 
-		if (len > 0 && yytext[len - 1] == '\r' && yytext[len] == '\n') {
-			len--;
+		/* May have matched fooLABEL; make sure there's a newline before it */
+		if (yytext[len] != '\n') {
+			if (yytext[len] != '\r') {
+				goto wrong_label;
+			}
+		} else if (len > 0 && yytext[len - 1] == '\r') {
+			len--; /* Windows newline */
 		}
 
 		/* Go back before last label char, to match in ST_END_HEREDOC state */
@@ -1948,6 +1942,7 @@ HEREDOC_CHARS       ("{"*([^$\n\r\\{]|("\\"[^\n\r]))|{HEREDOC_LITERAL_DOLLAR}|({
 	} else {
 		/* Go back to end of label, so the next match works correctly in case of
 		 * a variable or another label at the beginning of the next line */
+wrong_label:
 		yyless(yyleng - 1);
 		yymore();
 	}

Zend/zend_list.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_list.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_llist.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_llist.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_modules.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_multibyte.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_multibyte.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_multiply.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_object_handlers.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -354,7 +354,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)
 			}
 		} else {
 			if (!silent) {
-				zend_error(E_NOTICE,"Undefined property:  %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
+				zend_error(E_NOTICE,"Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
 			}
 			retval = &EG(uninitialized_zval_ptr);
 		}
@@ -758,14 +758,15 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 	zend_function *fbc;
 	char *lc_method_name;
 	zval *object = *object_ptr;
+	ALLOCA_FLAG(use_heap)
 	
-	lc_method_name = do_alloca(method_len+1);
+	lc_method_name = do_alloca_with_limit(method_len+1, use_heap);
 	/* Create a zend_copy_str_tolower(dest, src, src_length); */
 	zend_str_tolower_copy(lc_method_name, method_name, method_len);
 		
 	zobj = Z_OBJ_P(object);
 	if (zend_hash_find(&zobj->ce->function_table, lc_method_name, method_len+1, (void **)&fbc) == FAILURE) {
-		free_alloca(lc_method_name);
+		free_alloca_with_limit(lc_method_name, use_heap);
 		if (zobj->ce->__call) {
 			zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
 			call_user_call->type = ZEND_INTERNAL_FUNCTION;
@@ -820,7 +821,7 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 		}
 	}
 
-	free_alloca(lc_method_name);
+	free_alloca_with_limit(lc_method_name, use_heap);
 	return fbc;
 }
 
@@ -831,12 +832,32 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, char *f
 	zend_function *fbc;
 
 	if (zend_hash_find(&ce->function_table, function_name_strval, function_name_strlen+1, (void **) &fbc)==FAILURE) {
-		char *class_name = ce->name;
+		if (ce->__call &&
+		    EG(This) &&
+		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
+		    instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
+			zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
 
-		if (!class_name) {
-			class_name = "";
+			call_user_call->type = ZEND_INTERNAL_FUNCTION;
+			call_user_call->module = ce->module;
+			call_user_call->handler = zend_std_call_user_call;
+			call_user_call->arg_info = NULL;
+			call_user_call->num_args = 0;
+			call_user_call->scope = ce;
+			call_user_call->fn_flags = 0;
+			call_user_call->function_name = estrndup(function_name_strval, function_name_strlen);
+			call_user_call->pass_rest_by_reference = 0;
+			call_user_call->return_reference = ZEND_RETURN_VALUE;
+
+			return (union _zend_function *)call_user_call;
+		} else {
+			char *class_name = ce->name;
+
+			if (!class_name) {
+				class_name = "";
+			}
+			zend_error(E_ERROR, "Call to undefined method %s::%s()", class_name, function_name_strval);
 		}
-		zend_error(E_ERROR, "Call to undefined method %s::%s()", class_name, function_name_strval);
 	}
 	if (fbc->op_array.fn_flags & ZEND_ACC_PUBLIC) {
 		/* No further checks necessary, most common case */
@@ -897,7 +918,7 @@ ZEND_API zval **zend_std_get_static_property(zend_class_entry *ce, char *propert
 		if (silent) {
 			return NULL;
 		} else {
-			zend_error(E_ERROR, "Access to undeclared static property:  %s::$%s", ce->name, property_name);
+			zend_error(E_ERROR, "Access to undeclared static property: %s::$%s", ce->name, property_name);
 		}
 	}
 
@@ -923,7 +944,7 @@ ZEND_API union _zend_function *zend_std_get_constructor(zval *object TSRMLS_DC)
 		} else if (constructor->op_array.fn_flags & ZEND_ACC_PRIVATE) {
 			/* Ensure that if we're calling a private function, we're allowed to do so.
 			 */
-			if (Z_OBJ_HANDLER_P(object, get_class_entry)(object TSRMLS_CC) != EG(scope)) {
+			if (constructor->common.scope != EG(scope)) {
 				if (EG(scope)) {
 					zend_error(E_ERROR, "Call to private %s::%s() from context '%s'", constructor->common.scope->name, constructor->common.function_name, EG(scope)->name);
 				} else {
@@ -1085,6 +1106,9 @@ ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int ty
                 }
 				if (Z_TYPE_P(retval) == IS_STRING) {
 					INIT_PZVAL(writeobj);
+					if (readobj == writeobj) {
+						zval_dtor(readobj);
+					}
 					ZVAL_ZVAL(writeobj, retval, 1, 1);
 					if (Z_TYPE_P(writeobj) != type) {
 						convert_to_explicit_type(writeobj, type);
@@ -1093,6 +1117,9 @@ ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int ty
 				} else {
 					zval_ptr_dtor(&retval);
 					INIT_PZVAL(writeobj);
+					if (readobj == writeobj) {
+						zval_dtor(readobj);
+					}
 					ZVAL_EMPTY_STRING(writeobj);
 					zend_error(E_RECOVERABLE_ERROR, "Method %s::__toString() must return a string value", ce->name);
 					return SUCCESS;
@@ -1107,15 +1134,23 @@ ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int ty
 			ce = Z_OBJCE_P(readobj);
 			zend_error(E_NOTICE, "Object of class %s could not be converted to int", ce->name);
 			INIT_PZVAL(writeobj);
+			if (readobj == writeobj) {
+				zval_dtor(readobj);
+			}
 			ZVAL_LONG(writeobj, 1);
 			return SUCCESS;
 		case IS_DOUBLE:
 			ce = Z_OBJCE_P(readobj);
 			zend_error(E_NOTICE, "Object of class %s could not be converted to double", ce->name);
 			INIT_PZVAL(writeobj);
+			if (readobj == writeobj) {
+				zval_dtor(readobj);
+			}
 			ZVAL_DOUBLE(writeobj, 1);
 			return SUCCESS;
 		default:
+			INIT_PZVAL(writeobj);
+			Z_TYPE_P(writeobj) = IS_NULL;
 			break;
 	}
 	return FAILURE;

Zend/zend_object_handlers.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_objects.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_objects.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_objects_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_objects_API.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_opcode.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2008 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -101,6 +101,8 @@ void init_op_array(zend_op_array *op_array, zend_uchar type, int initial_ops_siz
 
 	op_array->fn_flags = CG(interactive)?ZEND_ACC_INTERACTIVE:0;
 
+	memset(op_array->reserved, 0, ZEND_MAX_RESERVED_RESOURCES * sizeof(void*));
+
 	zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_ctor_handler, op_array TSRMLS_CC);
 }