fix ZTS build

Add function for detection of string zvals with length that does not fit
INT_MAX.

.gitignore

@@ -20,6 +20,9 @@
 *.tar.gz
 *.tar.bz2
 *.tar.xz
+*.tar.gz.asc
+*.tar.bz2.asc
+*.tar.xz.asc
 .FBCIndex
 .FBCLockFolder
 .deps
@@ -216,10 +219,6 @@ ext/reflection/spl.chm
 ext/simplexml/examples/security.new.xml
 ext/spl/examples/.htaccess
 ext/spl/examples/*.phps
-ext/sqlite/weztest.sqlite
-ext/sqlite/libsqlite/src/sqlite.h
-ext/sqlite/libsqlite/src/parse.out
-ext/sqlite/libsqlite/src/libsqlite.dsw
 ext/sqlite3/tests/phpsql*
 ext/sqlite3/tests/*.db
 ext/sqlite3/tests/*.tmp

.travis.yml

@@ -1,12 +1,30 @@
-language: php
-
-php:
-    # We only specify one version so we only get one worker
-    - 5.4
+language: c
+sudo: false
+addons:
+  apt:
+    packages:
+      - locales
+      - language-pack-de
+      - re2c
+      - libgmp-dev
+      - libicu-dev
+      - libmcrypt-dev
+      - libtidy-dev
+      - libenchant-dev
+      - libaspell-dev
+      - libpspell-dev
+      - librecode-dev
 
 notifications:
     email: 
        on_failure: change
+    irc:
+      template:
+        - "%{repository}#%{build_number} (%{branch} - %{commit} : %{author}): %{message} -  Change view : %{compare_url} - Build details : %{build_url}"
+      channels:
+        - "irc.efnet.org#php.pecl"
+      on_success: change
+      on_failure: always
 
 cache: 
     - apt
@@ -24,12 +42,6 @@ env:
       - ENABLE_MAINTAINER_ZTS=0 ENABLE_DEBUG=0
       - ENABLE_MAINTAINER_ZTS=1 ENABLE_DEBUG=1
 
-before_install:
-    - sudo apt-get update -qq
-    - sudo apt-get install -y libenchant-dev libaspell-dev libpspell-dev librecode-dev
-    - sudo cp ./travis/de /var/lib/locales/supported.d/de
-    - sudo dpkg-reconfigure locales
-
 before_script:
     # Compile PHP
     - ./travis/compile.sh
@@ -42,5 +54,5 @@ before_script:
 
 # Run PHPs run-tests.php 
 script:
-    - ./sapi/cli/php run-tests.php -p `pwd`/sapi/cli/php -g "FAIL,XFAIL,BORK,WARN,LEAK,SKIP" --show-diff --set-timeout 120 -s
+    - ./sapi/cli/php run-tests.php -p `pwd`/sapi/cli/php -g "FAIL,XFAIL,BORK,WARN,LEAK,SKIP" --offline --show-diff --set-timeout 120
     - ./sapi/cli/php sapi/phpdbg/tests/run-tests.php -diff2stdout --phpdbg sapi/phpdbg/phpdbg

EXTENSIONS

@@ -205,7 +205,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Unknown
+PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1

LICENSE

@@ -1,6 +1,6 @@
 -------------------------------------------------------------------- 
                   The PHP License, version 3.01
-Copyright (c) 1999 - 2014 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2016 The PHP Group. All rights reserved.
 -------------------------------------------------------------------- 
 
 Redistribution and use in source and binary forms, with or without

Makefile.gcov

@@ -57,7 +57,7 @@ php_lcov.info: lcov-test
 			cp $$x.bbg  lcov_data/$$y.bbg ; \
 		fi; \
 	done; \
-	for dir in ext/bcmath/libbcmath ext/fileinfo/libmagic ext/gd/libgd ext/mbstring/libmbfl ext/mbstring/oniguruma ext/pcre/pcrelib ext/pdo_sqlite/libsqlite ext/sqlite/libsqlite ext/sqlite3/libsqlite ext/xmlrpc/libxmlrpc ext/zip/lib; do \
+	for dir in ext/bcmath/libbcmath ext/date/lib ext/fileinfo/libmagic ext/gd/libgd ext/mbstring/libmbfl ext/mbstring/oniguruma ext/pcre/pcrelib ext/pdo_sqlite/libsqlite ext/sqlite3/libsqlite ext/xmlrpc/libxmlrpc ext/zip/lib; do \
 		if test -d lcov_data/$$dir; then \
 			rm -rf lcov_data/$$dir ; \
 		fi; \

Makefile.global

@@ -53,7 +53,7 @@ install-headers:
 			paths="$$paths $(INSTALL_ROOT)$(phpincludedir)/$$i"; \
 		done; \
 		$(mkinstalldirs) $$paths && \
-		echo "Installing header files:          $(INSTALL_ROOT)$(phpincludedir)/" && \
+		echo "Installing header files:           $(INSTALL_ROOT)$(phpincludedir)/" && \
 		for i in `echo $(INSTALL_HEADERS)`; do \
 			if test "$(PHP_PECL_EXTENSION)"; then \
 				src=`echo $$i | $(SED) -e "s#ext/$(PHP_PECL_EXTENSION)/##g"`; \

README.GIT-RULES

@@ -12,7 +12,7 @@ Collaboration is a Good Thing(tm), and Git lets us do this. Thus, following
 some basic rules with regards to Git usage will::
 
    a. Make everybody happier, especially those responsible for maintaining
-      Git itself.
+      PHP itself.
 
    b. Keep the changes consistently well documented and easily trackable.
 
@@ -48,11 +48,11 @@ Currently we have the following branches in use::
   PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
             stable version and is open for bugfixes only.
 
-  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
-            stable version and is open for bugfixes only.
+  PHP-5.5   Is used to release the PHP 5.5.x series. This is an old
+            stable version and is open for security fixes only.
 
-  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
-            stable version and is open for bugfixes only.
+  PHP-5.4   Is used to release the PHP 5.4.x series. This is an old
+            stable version and is open for security fixes only.
 
   PHP-5.3   This branch is closed.
 
@@ -67,7 +67,7 @@ Currently we have the following branches in use::
 
 The next few rules are more of a technical nature::
 
-   1. All changes should first go to the lowest branch (i.e. 5.4) and then
+   1. All changes should first go to the lowest branch (i.e. 5.6) and then
       get merged up to all other branches. If a change is not needed for
       later branches (i.e. fixes for features which where dropped from later
       branches) an empty merge should be done.

README.RELEASE_PROCESS

@@ -196,11 +196,11 @@ last commit id to web/php.git, then, mirrors will now sync
 Getting the stable release announced
 ------------------------------------
 
-1. Run the bumpRelease script for phpweb on your local checkout
+1. Update phpweb/include/releases.inc with the old release info
+  (updates the download archives)
 
- a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
-    The release announcement file should list in detail security fixes and
-    changes in behavior (whether due to a bug fix or not).
+ a. You can run ``php bin/bumpRelease 5`` if you are making a release for the
+    highest branch, otherwise you have to do this manually, see point 1.b
 
  b. In case multiple PHP minor versions are in active development you have
     to manually copy the old information to include/releases.inc
@@ -213,15 +213,18 @@ Getting the stable release announced
 
  c. ``$PHP_X_MD5`` array and update all the md5 sums
 
- d. set ``$PHP_X_RC`` to false!
+ d. ``$PHP_X_SHA256`` array and update all the SHA256 sums
 
- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. set ``$PHP_X_RC`` to false!
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
  ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array
 
- f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
+ g. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
 
-3. Update phpweb/include/releases.php with the old release info
-  (updates the download archives)
+3. Create the release file (releases/x_y_z.php)
+   Usually we use the same content as for point 6, but included in php template
+   instead of the release xml.
 
 4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
    (prepare for next RC)
@@ -266,6 +269,9 @@ to upgrade.
 9. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 http://news.php.net/php.internals/17222.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.
 
 Re-releasing the same version (or -pl)
 --------------------------------------
@@ -282,7 +288,9 @@ Re-releasing the same version (or -pl)
 
  d. ``$PHP_X_MD5`` array and update all the md5 sums
 
- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. ``$PHP_X_SHA256`` array and update all the SHA256 sums
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
  ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array
 
 3. Add a short notice to phpweb stating that there is a new release, and
@@ -299,3 +307,6 @@ to upgrade.
 5. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 the news entry.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.

TSRM/tsrm_nw.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2014 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2014 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_win32.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2014 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -616,6 +616,12 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
+			if (shm_handle) {
+				CloseHandle(shm_handle);
+			}
+			if (info_handle) {
+				CloseHandle(info_handle);
+			}
 			return -1;
 		}
 	}
@@ -654,17 +660,27 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
+	int err;
 
 	if (!shm->segment) {
 		return (void*)-1;
 	}
 
+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
+	err = GetLastError();
+	if (err) {
+		/* Catch more errors */
+		if (ERROR_NOT_ENOUGH_MEMORY == err) {
+			_set_errno(ENOMEM);
+		}
+		return (void*)-1;
+	}
+
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;
 
-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
 	return shm->addr;
 }
 

TSRM/tsrm_win32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2014 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

UPGRADING

@@ -61,6 +61,9 @@ PHP 5.6 UPGRADE NOTES
   longer accept keys or IVs with incorrect sizes. Furthermore an IV is now
   required if the used block cipher mode requires it.
 
+- cURL:
+  Uploads using the @file syntax are now unsupported by default.
+
 ========================================
 2. New Features
 ========================================
@@ -215,6 +218,9 @@ PHP 5.6 UPGRADE NOTES
     . CURLOPT_KRBLEVEL
     . CURLOPT_KRB4LEVEL
 
+  curl_getinfo($ch, CURLINFO_CERTINFO) returns certificate Subject and Issuer
+  as a string (PHP >= 5.6.25)
+
 - Strings:
   substr_compare() now allows $length to be zero.
   pack() and unpack() now support 64-bit format specifiers: q, Q, J and P.
@@ -262,10 +268,16 @@ PHP 5.6 UPGRADE NOTES
   Added scanner mode INI_SCANNER_TYPED to yield typed .ini values. 
   For PHP >= 5.6.1
 
+- JSON:
+  Added JSON_PRESERVE_ZERO_FRACTION option (PHP >= 5.6.5)
+
 ========================================
 6. New Functions
 ========================================
 
+- Datetime:
+  Added DatePeriod::getStartDate(), DatePeriod::getEndDate(), DatePeriod::getDateInterval() in 5.6.5.
+
 - GMP:
   Added gmp_root($a, $nth) and gmp_rootrem($a, $nth) for calculating nth roots.
   Added gmp_import($data, $word_size = 1, $options = GMP_MSW_FIRST | GMP_NATIVE_ENDIAN) in PHP 5.6.1.
@@ -298,12 +310,15 @@ PHP 5.6 UPGRADE NOTES
   Added PDO::pgsqlGetNotify($result_type = PDO::FETCH_USE_DEFAULT, $ms_timeout = 0)
   Added PDO::pgsqlGetPid()
 
-- Zip:
-  Added ZipArchive::setPassword($password)
+- Reflection
+  Added ReflectionFunction::isVariadic() and ReflectionParameter::isVariadic().
 
 - SPL
   Added SplFileObject::fread($length) to complement fwrite() method (>= 5.5.11)
 
+- Zip:
+  Added ZipArchive::setPassword($password)
+
 ========================================
 7. New Classes and Interfaces
 ========================================
@@ -385,6 +400,12 @@ PHP 5.6 UPGRADE NOTES
 10. New Global Constants
 ========================================
 
+- CURL:
+  CURL_HTTP_VERSION_2_0 and CURL_VERSION_HTTP2 (>= 5.6.8)
+
+- GD:
+  IMG_WEBP (>= 5.6.25)
+
 - LDAP:
   LDAP_ESCAPE_FILTER int(1)
   LDAP_ESCAPE_DN     int(2)

Zend/tests/bug43201.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #43201 (Crash on using unitialized vals and __get/__set)
+Bug #43201 (Crash on using uninitialized vals and __get/__set)
 --FILE--
 <?php
 class Foo {

Zend/tests/bug63336.phpt

@@ -1,7 +1,5 @@
 --TEST--
 Bug #63336 (invalid E_NOTICE error occur)
---XFAIL--
-Bug is not fixed yet
 --FILE--
 <?php
 error_reporting(E_ALL | E_NOTICE );
@@ -18,7 +16,7 @@ class Child extends Base {
     public function bar($var, $more=self::DUMMY) { return true; }
 }
 ?>
---EXPECT--
-Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = '123', $more = NULL) in %sbug63336.php on line %d
+--EXPECTF--
+Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = TEST, $more = NULL) in %sbug63336.php on line %d
 
-Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($var, $more = 'XXX') in %sbug63336.php on line %d
+Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($more = self::DUMMY) in %sbug63336.php on line %d

Zend/tests/bug65419.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #65419 (Inside trait, self::class != __CLASS__)
+--FILE--
+<?php
+trait abc
+{
+  static function def()
+  {
+    echo self::class, "\n";
+    echo __CLASS__, "\n";
+  }
+}
+
+class ghi
+{
+  use abc;
+}
+
+ghi::def();
+?>
+--EXPECTF--
+ghi
+ghi

Zend/tests/bug66609.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #66609 (php crashes with __get() and ++ operator in some cases)
+--FILE--
+<?php
+$bar = new Bar;
+$foo = new Foo;
+class Bar {
+	public function __get($x) {
+		global $foo;
+		return $foo->foo;
+	}
+}
+class Foo {
+	public function __get($x) {
+		global $bar;
+		return $bar->bar;
+	}
+}
+$foo->blah += 1; //crash
+++$foo->blah;    //crash
+$foo->blah++;    //crash
+$foo->blah--;    //crash
+--$foo->blah;    //crash
+echo "okey";
+?>
+--EXPECTF--
+Notice: Undefined property: Bar::$bar in %sbug66609.php on line %d
+okey

Zend/tests/bug67111.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #67111: Memory leak when using "continue 2" inside two foreach loops
+--FILE--
+<?php
+
+$array1 = [1, 2, 3];
+$array2 = [1, 2, 3];
+
+foreach ($array1 as $x) {
+    foreach ($array2 as $y) {
+        echo "$x.$y\n";
+        continue 2;
+    }
+}
+
+?>
+--EXPECT--
+1.1
+2.1
+3.1

Zend/tests/bug67314.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #67314 (Segmentation fault in gc_remove_zval_from_buffer)
+--FILE--
+<?php
+function crash()
+{
+    $notDefined[$i] = 'test';
+}
+
+function error_handler() { return false; }
+
+set_error_handler('error_handler');
+crash();
+echo "made it once\n";
+crash();
+echo "ok\n";
+--EXPECTF--
+Notice: Undefined variable: i in %sbug67314.php on line 4
+made it once
+
+Notice: Undefined variable: i in %sbug67314.php on line 4
+ok

Zend/tests/bug67436/bug67436.phpt

@@ -2,14 +2,14 @@
 bug67436: Autoloader isn't called if user defined error handler is present
 
 --INI--
-error_reporting=
+error_reporting=-1
 
 --FILE--
 <?php
 
 spl_autoload_register(function($classname) {
 	if (in_array($classname, array('a','b','c'))) {
-		require_once ($classname . '.php');
+		require_once __DIR__ . "/{$classname}.php";
 	}
 });
 

Zend/tests/bug67436/bug67436_nohandler.phpt

@@ -9,7 +9,7 @@ error_reporting=-1
 
 spl_autoload_register(function($classname) {
 	if (in_array($classname, array('a','b','c'))) {
-		require_once ($classname . '.php');
+		require_once __DIR__ . "/{$classname}.php";
 	}
 });
 

Zend/tests/bug68652.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #68652 (segmentation fault in destructor)
+--FILE--
+<?php
+class Foo {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Bar::getInstance();
+    }
+}
+
+class Bar {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Foo::getInstance();
+    }
+}
+
+
+$foo = new Foo();
+?>
+--EXPECTF--
+Fatal error: Access to undeclared static property: Bar::$instance in %sbug68652.php on line %d
+

Zend/tests/bug69017.phpt

@@ -0,0 +1,42 @@
+--TEST--
+#69017 (Fail to push to the empty array with the constant value defined in class scope)
+--FILE--
+<?php
+
+class c1
+{
+	const ZERO = 0;
+	const ONE = 1;
+	const MAX = PHP_INT_MAX;
+	public static $a1 = array(self::ONE => 'one');
+	public static $a2 = array(self::ZERO => 'zero');
+	public static $a3 = array(self::MAX => 'zero');
+}
+
+
+c1::$a1[] = 1;
+c1::$a2[] = 1;
+c1::$a3[] = 1;
+
+var_dump(c1::$a1);
+var_dump(c1::$a2);
+var_dump(c1::$a3);
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %sbug69017.php on line %d
+array(2) {
+  [1]=>
+  string(3) "one"
+  [2]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  string(4) "zero"
+  [1]=>
+  int(1)
+}
+array(1) {
+  [%d]=>
+  string(4) "zero"
+}

Zend/tests/bug69174.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #69174 (leaks when unused inner class use traits precedence)
+--FILE--
+<?php
+function test() {
+	class C1 {
+		use T1, T2 {
+			T1::foo insteadof T2;
+			T1::bar insteadof T2;
+		}
+	}
+}
+?>
+==DONE==
+--EXPECT--
+==DONE==

Zend/tests/bug69212.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Bug #69212: Leaking VIA_HANDLER func when exception thrown in __call/... arg passing
+--FILE--
+<?php
+
+class Test {
+    public static function __callStatic($method, $args) {}
+    public function __call($method, $args) {}
+}
+
+function do_throw() { throw new Exception; }
+
+try {
+    Test::foo(do_throw());
+} catch (Exception $e) {
+    echo "Caught!\n";
+}
+try {
+    (new Test)->bar(do_throw());
+} catch (Exception $e) {
+    echo "Caught!\n";
+}
+
+try {
+	$f = function () {};
+	$f->__invoke(do_throw());
+} catch (Exception $e) {
+	echo "Caught!\n";
+}
+
+try {
+	$t = new Test;
+	$f->__invoke($t->bar(Test::foo(do_throw())));
+} catch (Exception $e) {
+	echo "Caught!\n";
+}
+
+?>
+--EXPECT--
+Caught!
+Caught!
+Caught!
+Caught!

Zend/tests/bug69221.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #69221: Segmentation fault when using a generator in combination with an Iterator
+--FILE--
+<?php
+
+function gen() {
+	yield 1;
+};
+
+$gen1 = gen();
+$gen2 = (object) $gen1;
+
+foreach ($gen1 as $v1) {
+    foreach ($gen2 as $v2) {
+        break 2;
+    }
+}
+
+unset($gen1);
+foreach ($gen2 as $v) { var_dump($v); }
+
+?>
+--EXPECTF--
+int(1)

Zend/tests/bug69221_2.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #69221: Segmentation fault when using a generator in combination with an Iterator (2)
+--FILE--
+<?php
+
+$gen = function() {
+    yield 1;
+};
+
+$iter = new IteratorIterator($gen());
+$ngen = $iter->getInnerIterator();
+
+var_dump(iterator_to_array($ngen, false));
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}

Zend/tests/bug69420.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Bug #69420 (Invalid read in zend_std_get_method)
+--FILE--
+<?php
+
+trait T {
+	protected function test() {
+		echo "okey";
+	}
+}
+
+
+class A {
+	protected function test() {
+	}
+}
+
+class B extends A {
+	use T;
+	public function foo() {
+		$this->test();
+	}
+}
+
+
+$b = new B();
+$b->foo();
+?>
+--EXPECT--
+okey

Zend/tests/bug69467.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #69467 (Wrong checked for the interface by using Trait)
+--FILE--
+<?php
+interface Baz {
+    public function bad();
+}
+
+trait Bar{
+    protected function bad(){}
+}
+
+class Foo implements Baz{
+    use Bar;
+}
+
+$test = new Foo();
+var_dump($test instanceof Baz);
+?>
+--EXPECTF--
+Fatal error: Access level to Bar::bad() must be public (as in class Baz) in %sbug69467.php on line %d

Zend/tests/bug69537.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #69537 (__debugInfo with empty string for key gives error)
+--FILE--
+<?php
+class Foo {
+
+    public function __debugInfo(){
+        return ['' => 1];
+    }
+}
+
+var_dump(new Foo);
+?>
+--EXPECTF--
+object(Foo)#%d (%d) {
+  [""]=>
+  int(1)
+}
+

Zend/tests/bug69551.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #69551 - parse_ini_file() and parse_ini_string() segmentation fault
+--FILE--
+<?php
+$ini = <<<INI
+[Network.eth0]
+SubnetMask = "
+"
+INI;
+$settings = parse_ini_string($ini, false, INI_SCANNER_RAW);
+var_dump($settings);
+?>
+--EXPECTF--
+Warning: syntax error, unexpected '"' in Unknown on line %d
+ in %s on line %d
+bool(false)

Zend/tests/bug69599.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #69599: Strange generator+exception+variadic crash
+--FILE--
+<?php
+
+function crash() {
+    sin(...[0]);
+    throw new \Exception();
+    yield;
+}
+
+iterator_to_array(crash());
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 [internal function]: crash()
+#1 %s(%d): iterator_to_array(Object(Generator))
+#2 {main}
+  thrown in %s on line %d

Zend/tests/bug69732.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #69732 (can induce segmentation fault with basic php code)
+--FILE--
+<?php
+class wpq {
+    private $unreferenced;
+ 
+    public function __get($name) {
+        return $this->$name . "XXX";
+    }
+}
+ 
+function ret_assoc() {
+	$x = "XXX";
+    return array('foo' => 'bar', $x);
+}
+ 
+$wpq = new wpq;
+$wpq->interesting =& ret_assoc();
+$x = $wpq->interesting;
+printf("%s\n", $x);
+--EXPECTF--
+Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6
+
+Notice: Indirect modification of overloaded property wpq::$interesting has no effect in %sbug69732.php on line 16
+
+Fatal error: Cannot assign by reference to overloaded object in %sbug69732.php on line 16

Zend/tests/bug69740.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #69740: finally in generator (yield) swallows exception in iteration
+--FILE--
+<?php
+
+function generate() {
+    try {
+        yield 1;
+        yield 2;
+    } finally {
+        echo "finally\n";
+    }
+}
+
+foreach (generate() as $i) {
+    echo $i, "\n";
+    throw new Exception();
+}
+
+?>
+--EXPECTF--
+1
+finally
+
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/bug69892.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #69892: Different arrays compare indentical due to integer key truncation
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only"); ?>
+--FILE--
+<?php
+var_dump([0 => 0] === [0x100000000 => 0]);
+?>
+--EXPECT--
+bool(false)

Zend/tests/bug70012.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #70012 (Exception lost with nested finally block)
+--FILE--
+<?php
+try {
+	echo "Outer try\n";
+	try {
+		echo "  Middle try\n";
+		throw new Exception();
+	} finally {
+		echo "  Middle finally\n";
+		try {
+			echo "    Inner try\n";
+		} finally {
+			echo "    Inner finally\n";
+		}
+	}
+	echo "Outer shouldnt get here\n";
+} catch (Exception $e) {
+	echo "Outer catch\n";
+} finally {
+	echo "Outer finally\n";
+}
+?>
+--EXPECT--
+Outer try
+  Middle try
+  Middle finally
+    Inner try
+    Inner finally
+Outer catch
+Outer finally

Zend/tests/bug70121.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref)
+--FILE--
+<?php
+unserialize('O:12:"DateInterval":1:{s:4:"days";O:9:"Exception":7:{s:10:"'."\0".'*'."\0".'message";s:1:"x";s:17:"'."\0".'Exception'."\0".'string";s:1:"A";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";s:1:"a";s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";O:8:"stdClass":0:{}}}');
+?>
+OK
+--EXPECT--
+OK

Zend/tests/bug70681.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #70681: Segfault when binding $this of internal instance method to null
+--FILE--
+<?php
+
+$c = (new ReflectionMethod('SplStack', 'count'))->getClosure(new SplStack);
+$c = $c->bindTo(null);
+
+$c = (new ReflectionFunction('strlen'))->getClosure();
+$c = $c->bindTo(null);
+var_dump($c("foo"));
+
+?>
+--EXPECTF--
+Warning: Cannot unbind $this of internal method in %s on line %d
+int(3)

Zend/tests/bug70685.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #70685: Segfault for getClosure() internal method rebind with invalid $this
+--FILE--
+<?php
+
+class cls {}
+
+$c = (new ReflectionMethod('SplStack', 'count'))->getClosure(new SplStack);
+$c = $c->bindTo(new cls);
+var_dump($c);
+
+$c = (new ReflectionMethod('SplStack', 'count'))->getClosure(new SplStack);
+$c = $c->bindTo(new SplStack, 'cls');
+var_dump($c);
+
+?>
+--EXPECTF--
+Warning: Cannot bind internal method SplDoublyLinkedList::count() to object of class cls in %s on line %d
+NULL
+
+Warning: Cannot bind function SplDoublyLinkedList::count to scope class cls in %s on line %d
+NULL

Zend/tests/bug70748.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #70748 (Segfault in ini_lex () at Zend/zend_ini_scanner.l)
+--FILE--
+<?php
+$ini = '[${ 	';
+
+$ini_file = __DIR__ . "/bug70748.ini";
+
+file_put_contents($ini_file, $ini);
+
+var_dump(parse_ini_file($ini_file));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . "bug70748.ini");
+?>
+--EXPECTF--
+Warning: syntax error, unexpected $end, expecting '}' in %sbug70748.ini on line %d
+ in %sbug70748.php on line %d
+bool(false)

Zend/tests/bug70828.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #70828 (php-fpm 5.6 with opcache crashes when referencing a non-existent constant)
+--FILE--
+<?php
+
+namespace test {
+	use const nonexistent;
+
+	class test {
+		static function run(){
+			var_dump(nonexistent);
+			existent;
+		}
+	}
+}
+
+namespace {
+	define("test\\existent", "bug!", 1);
+	test\test::run();
+}
+?>
+--EXPECTF--
+Notice: Use of undefined constant nonexistent - assumed 'nonexistent' in %sbug70828.php on line %d
+string(11) "nonexistent"

Zend/tests/bug70944.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #70944 (try{ } finally{} can create infinite chains of exceptions)
+--FILE--
+<?php
+try {
+	$e = new Exception("Foo");
+	try {
+		throw  new Exception("Bar", 0, $e);
+	} finally {
+		throw $e;
+	}
+} catch (Exception $e) {
+	var_dump((string)$e);
+}
+
+try {
+	$e = new Exception("Foo");
+	try {
+		throw new Exception("Bar", 0, $e);
+	} finally {
+		throw new Exception("Dummy", 0, $e);
+	}
+} catch (Exception $e) {
+	var_dump((string)$e);
+}
+?>
+--EXPECTF--
+string(%d) "exception 'Exception' with message 'Foo' in %sbug70944.php:%d
+Stack trace:
+#0 {main}"
+string(%d) "exception 'Exception' with message 'Foo' in %sbug70944.php:%d
+Stack trace:
+#0 {main}
+
+Next exception 'Exception' with message 'Dummy' in %sbug70944.php:%d
+Stack trace:
+#0 {main}"

Zend/tests/bug70957.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #70957 (self::class can not be resolved with reflection for abstract class)
+--FILE--
+<?php
+
+abstract class Foo
+{
+    function bar($a = self::class) {}
+}
+
+trait T {
+    public function bar() {
+    }
+}
+
+class Bar extends Foo
+{
+    use T;
+}
+?>
+--EXPECTF--
+Strict Standards: Declaration of T::bar() should be compatible with Foo::bar($a = 'Foo') in %sbug70957.php on line %d

Zend/tests/bug70958.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #70958 (Invalid opcode while using ::class as trait method paramater default value)
+--FILE--
+<?php
+trait Foo
+{
+	function bar($a = self::class) {
+		var_dump($a);
+	}
+}
+
+class B {
+	use Foo;
+}
+
+$b = new B;
+
+$b->bar();
+?>
+--EXPECT--
+string(1) "B"

Zend/tests/bug71841.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL

Zend/tests/bug72496.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Bug #72496 (declare public method with signature incompatible with parent private method should not throw a warning)
+--FILE--
+<?php
+class Foo
+{
+    private function getFoo()
+    {
+        return 'Foo';
+    }
+
+    private function getBar()
+    {
+        return 'Bar';
+    }
+
+    private function getBaz()
+    {
+        return 'Baz';
+    }
+}
+
+class Bar extends Foo
+{
+    public function getFoo($extraArgument)
+    {
+        return $extraArgument;
+    }
+
+    protected function getBar($extraArgument)
+    {
+        return $extraArgument;
+    }
+
+    private function getBaz($extraArgument)
+    {
+        return $extraArgument;
+    }
+}
+
+echo "OK\n";
+--EXPECT--
+OK

Zend/tests/bug72907.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
+--FILE--
+<?php
+
+$a = 0;
+
+($a->a = &$E) + ($b = $a->b->i -= 0);
+
+?>
+--EXPECTF--
+Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
+
+Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
+
+Warning: Creating default object from empty value in %sbug72907.php on line %d
+
+Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d

Zend/tests/declare_005.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Testing declare statement with ticks
+--SKIPIF--
+--FILE--
+<?php
+register_tick_function(function () { echo "tick\n"; });
+function foo() { }
+
+declare(ticks=1) {
+
+$statement;
+foo();
+
+}
+?>
+--EXPECTF--
+tick
+tick

Zend/tests/gc_024.phpt

@@ -13,5 +13,5 @@ var_dump(gc_collect_cycles());
 echo "ok\n";
 ?>
 --EXPECT--
-int(1)
+int(2)
 ok

Zend/tests/generators/bug69419.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #69419: Returning compatible sub generator produces a warning
+--FILE--
+<?php
+
+function & genRefInner() {
+    $var = 1;
+    yield $var;
+}
+
+function & genRefOuter() {
+    return genRefInner();
+}
+
+foreach(genRefOuter() as $i) {
+    var_dump($i);
+}
+
+?>
+--EXPECTF--
+Notice: Only variable references should be returned by reference in %s on line %d
+int(1)

Zend/tests/memory_get_peak_usage.phpt

@@ -0,0 +1,19 @@
+--TEST--
+int memory_get_peak_usage ([ bool $real_usage = false ] );
+--CREDITS--
+marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+var_dump($a = memory_get_peak_usage());
+var_dump(memory_get_peak_usage(true));
+var_dump(memory_get_peak_usage(false));
+$array = range(1,1024*1024);
+var_dump(memory_get_peak_usage() > $a);
+?>
+--EXPECTF--
+int(%d)
+int(%d)
+int(%d)
+bool(true)

Zend/tests/ns_033.phpt

@@ -3,6 +3,8 @@
 --FILE--
 <?php
 use A;
+use \B;
 --EXPECTF--
 Warning: The use statement with non-compound name 'A' has no effect in %sns_033.php on line 2
 
+Warning: The use statement with non-compound name 'B' has no effect in %sns_033.php on line 3

Zend/tests/traits/bug65576a.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #65576 (Constructor from trait conflicts with inherited constructor)
+--FILE--
+<?php
+
+trait T
+{
+  public function __construct()
+  {
+    echo "Trait contructor\n";
+  }
+}
+
+class A
+{
+  public function __construct()
+  {
+    echo "Parent constructor\n";
+  }
+}
+
+class B extends A
+{
+  use T;
+}
+
+new B();
+
+--EXPECT--
+Trait contructor
+

Zend/tests/traits/bug65576b.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #65576 (Constructor from trait conflicts with inherited constructor)
+--FILE--
+<?php
+
+trait T
+{
+  public function __construct()
+  {
+    parent::__construct();
+    echo "Trait contructor\n";
+  }
+}
+
+class A
+{
+  public function __construct()
+  {
+    echo "Parent constructor\n";
+  }
+}
+
+class B extends A
+{
+  use T;
+}
+
+new B();
+
+--EXPECT--
+Parent constructor
+Trait contructor
+

Zend/tests/variadic/closure_invoke.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Closure::__invoke() with variadic parameter
+--FILE--
+<?php
+
+$closure = function(&...$refs) {};
+$closure->__invoke(
+    $v1,  $v2,  $v3,  $v4,
+    $v5,  $v6,  $v7,  $v8,
+    $v9, $v10, $v11, $v12,
+    $v13
+);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/zend.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -128,7 +128,7 @@ ZEND_API zval zval_used_for_init; /* True global variable */
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2014 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2016 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4
 
 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object TSRMLS_DC) /* {{{ */
@@ -817,9 +817,6 @@ void zend_shutdown(TSRMLS_D) /* {{{ */
 {
 #ifdef ZEND_SIGNALS
 	zend_signal_shutdown(TSRMLS_C);
-#endif
-#ifdef ZEND_WIN32
-	zend_shutdown_timeout_thread();
 #endif
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
 

Zend/zend.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -1074,7 +1074,7 @@ static int zval_update_class_constant(zval **pp, int is_static, int offset TSRML
 						*scope = old_scope;
 						return ret;
 					}
-				}				
+				}
 				ce = ce->parent;
 			} while (ce);
 
@@ -1279,9 +1279,14 @@ ZEND_API int add_assoc_double_ex(zval *arg, const char *key, uint key_len, doubl
 ZEND_API int add_assoc_string_ex(zval *arg, const char *key, uint key_len, char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
+	size_t _len = strlen(str);
+
+	if (UNEXPECTED(_len > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
 
 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRING(tmp, str, duplicate);
+	ZVAL_STRINGL(tmp, str, _len, duplicate);
 
 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), NULL);
 }
@@ -1291,6 +1296,10 @@ ZEND_API int add_assoc_stringl_ex(zval *arg, const char *key, uint key_len, char
 {
 	zval *tmp;
 
+	if (UNEXPECTED(length > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
+
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);
 
@@ -1362,6 +1371,11 @@ ZEND_API int add_index_double(zval *arg, ulong index, double d) /* {{{ */
 ZEND_API int add_index_string(zval *arg, ulong index, const char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
+	size_t _len = strlen(str);
+
+	if (UNEXPECTED(_len > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
 
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRING(tmp, str, duplicate);
@@ -1374,6 +1388,10 @@ ZEND_API int add_index_stringl(zval *arg, ulong index, const char *str, uint len
 {
 	zval *tmp;
 
+	if (UNEXPECTED(length > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
+
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);
 
@@ -1457,6 +1475,9 @@ ZEND_API int add_next_index_stringl(zval *arg, const char *str, uint length, int
 {
 	zval *tmp;
 
+	if (UNEXPECTED(length > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);
 
@@ -1473,9 +1494,14 @@ ZEND_API int add_next_index_zval(zval *arg, zval *value) /* {{{ */
 ZEND_API int add_get_assoc_string_ex(zval *arg, const char *key, uint key_len, const char *str, void **dest, int duplicate) /* {{{ */
 {
 	zval *tmp;
+	size_t _len = strlen(str);
+
+	if (UNEXPECTED(_len > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
 
 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRING(tmp, str, duplicate);
+	ZVAL_STRINGL(tmp, str, _len, duplicate);
 
 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), dest);
 }
@@ -1485,6 +1511,10 @@ ZEND_API int add_get_assoc_stringl_ex(zval *arg, const char *key, uint key_len,
 {
 	zval *tmp;
 
+	if (UNEXPECTED(length > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
+
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);
 
@@ -1664,9 +1694,14 @@ ZEND_API int add_property_string_ex(zval *arg, const char *key, uint key_len, co
 {
 	zval *tmp;
 	zval *z_key;
+	size_t _len = strlen(str);
+
+	if (UNEXPECTED(_len > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
 
 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRING(tmp, str, duplicate);
+	ZVAL_STRINGL(tmp, str, _len, duplicate);
 
 	MAKE_STD_ZVAL(z_key);
 	ZVAL_STRINGL(z_key, key, key_len-1, 1);
@@ -1683,6 +1718,10 @@ ZEND_API int add_property_stringl_ex(zval *arg, const char *key, uint key_len, c
 	zval *tmp;
 	zval *z_key;
 
+	if (UNEXPECTED(length > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
+	}
+
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);
 
@@ -1836,7 +1875,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 	module_post_deactivate_handlers = module_request_shutdown_handlers + shutdown_count + 1;
 	module_post_deactivate_handlers[post_deactivate_count] = NULL;
 	startup_count = 0;
-	
+
 	for (zend_hash_internal_pointer_reset_ex(&module_registry, &pos);
 	     zend_hash_get_current_data_ex(&module_registry, (void *) &module, &pos) == SUCCESS;
 	     zend_hash_move_forward_ex(&module_registry, &pos)) {
@@ -2083,7 +2122,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
 		}
 		if (ptr->arg_info) {
 			zend_internal_function_info *info = (zend_internal_function_info*)ptr->arg_info;
-			
+
 			internal_function->arg_info = (zend_arg_info*)ptr->arg_info+1;
 			internal_function->num_args = ptr->num_args;
 			/* Currently you cannot denote that the function can accept less arguments than num_args */
@@ -2701,7 +2740,7 @@ static int zend_is_callable_check_class(const char *name, int name_len, zend_fca
 			}
 			ret = 1;
 		}
-	} else if (name_len == sizeof("parent") - 1 && 
+	} else if (name_len == sizeof("parent") - 1 &&
 		       !memcmp(lcname, "parent", sizeof("parent") - 1)) {
 		if (!EG(scope)) {
 			if (error) *error = estrdup("cannot access parent:: when no class scope is active");
@@ -3030,7 +3069,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 	if (error) {
 		*error = NULL;
 	}
-	
+
 	fcc->initialized = 0;
 	fcc->calling_scope = NULL;
 	fcc->called_scope = NULL;
@@ -3042,7 +3081,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 		object_ptr = NULL;
 	}
 	if (object_ptr &&
-	    (!EG(objects_store).object_buckets || 
+	    (!EG(objects_store).object_buckets ||
 	     !EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(object_ptr)].valid)) {
 		return 0;
 	}
@@ -3123,7 +3162,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 						}
 
 					} else {
-						if (!EG(objects_store).object_buckets || 
+						if (!EG(objects_store).object_buckets ||
 						    !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(obj)].valid) {
 							return 0;
 						}
@@ -3192,7 +3231,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 					*callable_name = emalloc(*callable_name_len + 1);
 					memcpy(*callable_name, ce->name, ce->name_length);
 					memcpy((*callable_name) + ce->name_length, "::__invoke", sizeof("::__invoke"));
-				}									
+				}
 				return 1;
 			}
 			/* break missing intentionally */

Zend/zend_API.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -447,7 +447,7 @@ ZEND_API int add_property_zval_ex(zval *arg, const char *key, uint key_len, zval
 #define add_property_double(__arg, __key, __d) add_property_double_ex(__arg, __key, strlen(__key)+1, __d TSRMLS_CC)
 #define add_property_string(__arg, __key, __str, __duplicate) add_property_string_ex(__arg, __key, strlen(__key)+1, __str, __duplicate TSRMLS_CC)
 #define add_property_stringl(__arg, __key, __str, __length, __duplicate) add_property_stringl_ex(__arg, __key, strlen(__key)+1, __str, __length, __duplicate TSRMLS_CC)
-#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)       
+#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)
 
 
 ZEND_API int call_user_function(HashTable *function_table, zval **object_pp, zval *function_name, zval *retval_ptr, zend_uint param_count, zval *params[] TSRMLS_DC);
@@ -458,7 +458,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;
 
 /** Build zend_call_info/cache from a zval*
  *
- * Caller is responsible to provide a return value, otherwise the we will crash. 
+ * Caller is responsible to provide a return value, otherwise the we will crash.
  * fci->retval_ptr_ptr = NULL;
  * In order to pass parameters the following members need to be set:
  * fci->param_count = 0;
@@ -578,6 +578,9 @@ END_EXTERN_C()
 		const char *__s=(s);				\
 		zval *__z = (z);					\
 		Z_STRLEN_P(__z) = strlen(__s);		\
+		if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
+			zend_error(E_ERROR, "String size overflow"); \
+		}									\
 		Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
 		Z_TYPE_P(__z) = IS_STRING;			\
 	} while (0)
@@ -651,6 +654,20 @@ END_EXTERN_C()
 } while (0)
 #define RETURN_ZVAL_FAST(z) { RETVAL_ZVAL_FAST(z); return; }
 
+/* Check that returned string length fits int */
+#define RETVAL_STRINGL_CHECK(s, len, dup) do {	\
+	size_t __len = (len);					\
+	if (UNEXPECTED(__len > INT_MAX)) { 		\
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max is %d", INT_MAX); \
+		if(!(dup)) { 						\
+			efree((s));						\
+		}									\
+		RETURN_FALSE;						\
+	}										\
+	RETVAL_STRINGL((s), __len, (dup)); \
+} while (0)
+
+
 #define SET_VAR_STRING(n, v) {																				\
 								{																			\
 									zval *var;																\

Zend/zend_alloc.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -678,7 +678,7 @@ static inline unsigned int zend_mm_high_bit(size_t _size)
 	__asm {
 		bsr eax, _size
 	}
-#elif defined(__GNUC__) && (defined(__arm__) ||  defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return (8 * SIZEOF_SIZE_T - 1) - __builtin_clzl(_size);
 #else
 	unsigned int n = 0;
@@ -706,7 +706,7 @@ static inline unsigned int zend_mm_low_bit(size_t _size)
 	__asm {
 		bsf eax, _size
    }
-#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return __builtin_ctzl(_size);
 #else
 	static const int offset[16] = {4,0,1,0,2,0,1,0,3,0,1,0,2,0,1,0};
@@ -984,7 +984,7 @@ static void zend_mm_random(unsigned char *buf, size_t size) /* {{{ */
 	int has_context = 0;
 
 	if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
-		/* Could mean that the key container does not exist, let try 
+		/* Could mean that the key container does not exist, let try
 		   again by asking for a new one */
 		if (GetLastError() == NTE_BAD_KEYSET) {
 			if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
@@ -1348,7 +1348,7 @@ static int zend_mm_check_ptr(zend_mm_heap *heap, void *ptr, int silent ZEND_FILE
 	}
 	if (!silent) {
 		TSRMLS_FETCH();
-		
+
 		zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
 		zend_debug_alloc_output("---------------------------------------\n");
 		zend_debug_alloc_output("%s(%d) : Block "PTR_FMT" status:\n" ZEND_FILE_LINE_RELAY_CC, ptr);
@@ -2175,7 +2175,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 #if ZEND_MM_CACHE
 	if (ZEND_MM_SMALL_SIZE(true_size)) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
-		
+
 		if (heap->cache[index] != NULL) {
 			zend_mm_free_block *best_fit;
 			zend_mm_free_block **cache;
@@ -2188,7 +2188,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 			heap->cache[index] = best_fit->prev_free_block;
 			ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
 			ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
-	
+
 			ptr = ZEND_MM_DATA_OF(best_fit);
 
 #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
@@ -2470,7 +2470,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	     : "%0"(res),
 	       "rm"(size),
 	       "rm"(offset));
-	
+
 	if (UNEXPECTED(overflow)) {
 		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
@@ -2578,6 +2578,15 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 #endif
 
 
+ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
+{
+	size_t str_size = safe_address(nmemb, size, offset);
+	if (UNEXPECTED(str_size > INT_MAX)) {
+		zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
+	}
+	return emalloc_rel(str_size);
+}
+
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
 	return emalloc_rel(safe_address(nmemb, size, offset));
@@ -2619,7 +2628,7 @@ ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI
 
 ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	int length;
+	size_t length;
 	char *p;
 #ifdef ZEND_SIGNALS
 	TSRMLS_FETCH();
@@ -2627,13 +2636,13 @@ ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 
 	HANDLE_BLOCK_INTERRUPTIONS();
 
-	length = strlen(s)+1;
-	p = (char *) _emalloc(length ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	length = strlen(s);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
 	}
-	memcpy(p, s, length);
+	memcpy(p, s, length+1);
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 	return p;
 }
@@ -2647,7 +2656,7 @@ ZEND_API char *_estrndup(const char *s, uint length ZEND_FILE_LINE_DC ZEND_FILE_
 
 	HANDLE_BLOCK_INTERRUPTIONS();
 
-	p = (char *) _emalloc(length+1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -2668,7 +2677,7 @@ ZEND_API char *zend_strndup(const char *s, uint length)
 
 	HANDLE_BLOCK_INTERRUPTIONS();
 
-	p = (char *) malloc(length+1);
+	p = (char *) malloc(safe_address(length, 1, 1));
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;

Zend/zend_alloc.h

@@ -2,10 +2,10 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        | 
+   | that is bundled with this package in the file LICENSE, and is        |
    | available through the world-wide-web at the following url:           |
    | http://www.zend.com/license/2_00.txt.                                |
    | If you did not receive a copy of the Zend license and are unable to  |
@@ -56,6 +56,7 @@ ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_M
 
 ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE(1);
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
+ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
 ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE2(1,2);
@@ -69,6 +70,7 @@ ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_
 /* Standard wrapper macros */
 #define emalloc(size)						_emalloc((size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define safe_emalloc(nmemb, size, offset)	_safe_emalloc((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
+#define safe_emalloc_string(nmemb, size, offset)	_safe_emalloc_string((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define efree(ptr)							_efree((ptr) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define ecalloc(nmemb, size)				_ecalloc((nmemb), (size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define erealloc(ptr, size)					_erealloc((ptr), (size), 0 ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)

Zend/zend_ast.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_ast.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_build.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_builtin_functions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_builtin_functions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_closures.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -88,6 +88,12 @@ ZEND_METHOD(Closure, bind)
 		zend_error(E_WARNING, "Cannot bind an instance to a static closure");
 	}
 
+	if (newthis == NULL && !(closure->func.common.fn_flags & ZEND_ACC_STATIC)
+			&& closure->func.common.scope && closure->func.type == ZEND_INTERNAL_FUNCTION) {
+		zend_error(E_WARNING, "Cannot unbind $this of internal method");
+		return;
+	}
+
 	if (scope_arg != NULL) { /* scope argument was given */
 		if (IS_ZEND_STD_OBJECT(*scope_arg)) {
 			ce = Z_OBJCE_P(scope_arg);
@@ -127,6 +133,19 @@ ZEND_METHOD(Closure, bind)
 		ce = closure->func.common.scope;
 	}
 
+	/* verify that we aren't binding internal function to a wrong scope */
+	if (closure->func.type == ZEND_INTERNAL_FUNCTION && closure->func.common.scope != NULL) {
+		if (ce && !instanceof_function(ce, closure->func.common.scope TSRMLS_CC)) {
+			zend_error(E_WARNING, "Cannot bind function %s::%s to scope class %s", closure->func.common.scope->name, closure->func.common.function_name, ce->name);
+			return;
+		}
+		if (ce && newthis && (closure->func.common.fn_flags & ZEND_ACC_STATIC) == 0 &&
+				!instanceof_function(Z_OBJCE_P(newthis), closure->func.common.scope TSRMLS_CC)) {
+			zend_error(E_WARNING, "Cannot bind internal method %s::%s() to object of class %s", closure->func.common.scope->name, closure->func.common.function_name, Z_OBJCE_P(newthis)->name);
+			return;
+		}
+	}
+
 	zend_create_closure(return_value, &closure->func, ce, newthis TSRMLS_CC);
 }
 /* }}} */
@@ -148,10 +167,12 @@ ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {
 {
 	zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
 	zend_function *invoke = (zend_function*)emalloc(sizeof(zend_function));
+	const zend_uint keep_flags = ZEND_ACC_RETURN_REFERENCE | ZEND_ACC_VARIADIC;
 
 	invoke->common = closure->func.common;
 	invoke->type = ZEND_INTERNAL_FUNCTION;
-	invoke->internal_function.fn_flags = ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func.common.fn_flags & ZEND_ACC_RETURN_REFERENCE);
+	invoke->internal_function.fn_flags =
+		ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func.common.fn_flags & keep_flags);
 	invoke->internal_function.handler = ZEND_MN(Closure___invoke);
 	invoke->internal_function.module = 0;
 	invoke->internal_function.scope = zend_ce_closure;
@@ -443,6 +464,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 
 	closure->func = *func;
 	closure->func.common.prototype = NULL;
+	closure->func.common.fn_flags |= ZEND_ACC_CLOSURE;
 
 	if ((scope == NULL) && (this_ptr != NULL)) {
 		/* use dummy scope if we're binding an object without specifying a scope */
@@ -461,19 +483,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 		closure->func.op_array.run_time_cache = NULL;
 		(*closure->func.op_array.refcount)++;
 	} else {
-		/* verify that we aren't binding internal function to a wrong scope */
-		if(func->common.scope != NULL) {
-			if(scope && !instanceof_function(scope, func->common.scope TSRMLS_CC)) {
-				zend_error(E_WARNING, "Cannot bind function %s::%s to scope class %s", func->common.scope->name, func->common.function_name, scope->name);
-				scope = NULL;
-			}
-			if(scope && this_ptr && (func->common.fn_flags & ZEND_ACC_STATIC) == 0 &&
-					!instanceof_function(Z_OBJCE_P(this_ptr), closure->func.common.scope TSRMLS_CC)) {
-				zend_error(E_WARNING, "Cannot bind function %s::%s to object of class %s", func->common.scope->name, func->common.function_name, Z_OBJCE_P(this_ptr)->name);
-				scope = NULL;
-				this_ptr = NULL;
-			}
-		} else {
+		if (!func->common.scope) {
 			/* if it's a free function, we won't set scope & this since they're meaningless */
 			this_ptr = NULL;
 			scope = NULL;

Zend/zend_closures.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_compile.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -2214,6 +2214,18 @@ void zend_do_resolve_class_name(znode *result, znode *class_name, int is_static
 			if (!CG(active_class_entry)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot access self::class when no class scope is active");
 			}
+			if ((CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) == ZEND_ACC_TRAIT) {
+				zval_dtor(&class_name->u.constant);
+				constant_name.op_type = IS_CONST;
+				ZVAL_STRINGL(&constant_name.u.constant, "__CLASS__", sizeof("__CLASS__")-1, 1);
+				if (is_static) {
+					*result = constant_name;
+					result->u.constant.type = IS_CONSTANT;
+				} else {
+					zend_do_fetch_constant(result, NULL, &constant_name, ZEND_RT, 1 TSRMLS_CC);
+				}
+				break;
+			}
 			zval_dtor(&class_name->u.constant);
 			class_name->op_type = IS_CONST;
 			ZVAL_STRINGL(&class_name->u.constant, CG(active_class_entry)->name, CG(active_class_entry)->name_length, 1);
@@ -3240,8 +3252,8 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 		return 1;
 	}
 
-	/* If both methods are private do not enforce a signature */
-    if ((fe->common.fn_flags & ZEND_ACC_PRIVATE) && (proto->common.fn_flags & ZEND_ACC_PRIVATE)) {
+	/* If the prototype method is private do not enforce a signature */
+	if (proto->common.fn_flags & ZEND_ACC_PRIVATE) {
 		return 1;
 	}
 
@@ -3466,10 +3478,7 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 					if (precv && precv->opcode == ZEND_RECV_INIT && precv->op2_type != IS_UNUSED) {
 						zval *zv, zv_copy;
 						int use_copy;
-						ALLOC_ZVAL(zv);
-						*zv = *precv->op2.zv;
-						zval_copy_ctor(zv);
-						INIT_PZVAL(zv);
+						zv = precv->op2.zv;
 						if ((Z_TYPE_P(zv) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
 							REALLOC_BUF_IF_EXCEED(buf, offset, length, Z_STRLEN_P(zv));
 							memcpy(offset, Z_STRVAL_P(zv), Z_STRLEN_P(zv));
@@ -3511,7 +3520,6 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 								zval_dtor(&zv_copy);
 							}
 						}
-						zval_ptr_dtor(&zv);
 					}
 				} else {
 					memcpy(offset, "NULL", 4);
@@ -3629,6 +3637,7 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 {
 	zend_property_info *child_info;
 	zend_class_entry *parent_ce = ce->parent;
+	TSRMLS_FETCH();
 
 	if (parent_info->flags & (ZEND_ACC_PRIVATE|ZEND_ACC_SHADOW)) {
 		if (zend_hash_quick_find(&ce->properties_info, hash_key->arKey, hash_key->nKeyLength, hash_key->h, (void **) &child_info)==SUCCESS) {
@@ -3661,7 +3670,8 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 		if ((child_info->flags & ZEND_ACC_PPP_MASK) > (parent_info->flags & ZEND_ACC_PPP_MASK)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Access level to %s::$%s must be %s (as in class %s)%s", ce->name, hash_key->arKey, zend_visibility_string(parent_info->flags), parent_ce->name, (parent_info->flags&ZEND_ACC_PUBLIC) ? "" : " or weaker");
 		} else if ((child_info->flags & ZEND_ACC_STATIC) == 0) {
-			zval_ptr_dtor(&(ce->default_properties_table[parent_info->offset]));
+			/* Don't keep default properties in GC (thry may be freed by opcache) */
+			i_zval_ptr_dtor_nogc(ce->default_properties_table[parent_info->offset] ZEND_FILE_LINE_CC TSRMLS_CC);
 			ce->default_properties_table[parent_info->offset] = ce->default_properties_table[child_info->offset];
 			ce->default_properties_table[child_info->offset] = NULL;
 			child_info->offset = parent_info->offset;
@@ -3973,7 +3983,7 @@ static void zend_add_magic_methods(zend_class_entry* ce, const char* mname, uint
 	if (!strncmp(mname, ZEND_CLONE_FUNC_NAME, mname_len)) {
 		ce->clone = fe; fe->common.fn_flags |= ZEND_ACC_CLONE;
 	} else if (!strncmp(mname, ZEND_CONSTRUCTOR_FUNC_NAME, mname_len)) {
-		if (ce->constructor) {
+		if (ce->constructor && (!ce->parent || ce->constructor != ce->parent->constructor)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "%s has colliding constructor definitions coming from traits", ce->name);
 		}
 		ce->constructor = fe; fe->common.fn_flags |= ZEND_ACC_CTOR;
@@ -4000,7 +4010,7 @@ static void zend_add_magic_methods(zend_class_entry* ce, const char* mname, uint
 		zend_str_tolower_copy(lowercase_name, ce->name, ce->name_length);
 		lowercase_name = (char*)zend_new_interned_string(lowercase_name, ce->name_length + 1, 1 TSRMLS_CC);
 		if (!memcmp(mname, lowercase_name, mname_len)) {
-			if (ce->constructor) {
+			if (ce->constructor && (!ce->parent || ce->constructor != ce->parent->constructor)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "%s has colliding constructor definitions coming from traits", ce->name);
 			}
 			ce->constructor = fe;
@@ -4045,7 +4055,8 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			}
 			zend_hash_quick_update(*overriden, arKey, nKeyLength, h, fn, sizeof(zend_function), (void**)&fn);
 			return;
-		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
+		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT &&
+				(existing_fn->common.scope->ce_flags & ZEND_ACC_INTERFACE) == 0) {
 			/* Make sure the trait method is compatible with previosly declared abstract method */
 			if (!zend_traits_method_compatibility_check(fn, existing_fn TSRMLS_CC)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "Declaration of %s must be compatible with %s",
@@ -4075,6 +4086,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			/* inherited members are overridden by members inserted by traits */
 			/* check whether the trait method fulfills the inheritance requirements */
 			do_inheritance_check_on_method(fn, existing_fn TSRMLS_CC);
+			fn->common.prototype = NULL;
 		}
 	}
 
@@ -4093,7 +4105,7 @@ static int zend_fixup_trait_method(zend_function *fn, zend_class_entry *ce TSRML
 		if (fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
 			ce->ce_flags |= ZEND_ACC_IMPLICIT_ABSTRACT_CLASS;
 		}
-		if (fn->op_array.static_variables) {
+		if (fn->type == ZEND_USER_FUNCTION && fn->op_array.static_variables) {
 			ce->ce_flags |= ZEND_HAS_STATIC_IN_METHODS;
 		}
 	}
@@ -4205,6 +4217,7 @@ static void zend_check_trait_usage(zend_class_entry *ce, zend_class_entry *trait
 static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /* {{{ */
 {
 	size_t i, j = 0;
+	zend_trait_precedence **precedences;
 	zend_trait_precedence *cur_precedence;
 	zend_trait_method_reference *cur_method_ref;
 	char *lcname;
@@ -4213,7 +4226,9 @@ static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /*
 	/* resolve class references */
 	if (ce->trait_precedences) {
 		i = 0;
-		while ((cur_precedence = ce->trait_precedences[i])) {
+		precedences = ce->trait_precedences;
+		ce->trait_precedences = NULL;
+		while ((cur_precedence = precedences[i])) {
 			/** Resolve classes for all precedence operations. */
 			if (cur_precedence->exclude_from_classes) {
 				cur_method_ref = cur_precedence->trait_method;
@@ -4270,6 +4285,7 @@ static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /*
 			}
 			i++;
 		}
+		ce->trait_precedences = precedences;
 	}
 
 	if (ce->trait_aliases) {
@@ -4337,16 +4353,20 @@ static void zend_do_traits_method_binding(zend_class_entry *ce TSRMLS_DC) /* {{{
 	for (i = 0; i < ce->num_traits; i++) {
 		if (ce->trait_precedences) {
 			HashTable exclude_table;
+			zend_trait_precedence **precedences;
 
 			/* TODO: revisit this start size, may be its not optimal */
 			zend_hash_init_ex(&exclude_table, 2, NULL, NULL, 0, 0);
 
-			zend_traits_compile_exclude_table(&exclude_table, ce->trait_precedences, ce->traits[i]);
+			precedences = ce->trait_precedences;
+			ce->trait_precedences = NULL;
+			zend_traits_compile_exclude_table(&exclude_table, precedences, ce->traits[i]);
 
 			/* copies functions, applies defined aliasing, and excludes unused trait methods */
 			zend_hash_apply_with_arguments(&ce->traits[i]->function_table TSRMLS_CC, (apply_func_args_t)zend_traits_copy_functions, 3, ce, &overriden, &exclude_table);
 
 			zend_hash_destroy(&exclude_table);
+			ce->trait_precedences = precedences;
 		} else {
 			zend_hash_apply_with_arguments(&ce->traits[i]->function_table TSRMLS_CC, (apply_func_args_t)zend_traits_copy_functions, 3, ce, &overriden, NULL);
 		}
@@ -4354,6 +4374,17 @@ static void zend_do_traits_method_binding(zend_class_entry *ce TSRMLS_DC) /* {{{
 
     zend_hash_apply_with_argument(&ce->function_table, (apply_func_arg_t)zend_fixup_trait_method, ce TSRMLS_CC);
 
+	if (ce->trait_precedences) {
+		i = 0;
+		while (ce->trait_precedences[i]) {
+			if (ce->trait_precedences[i]->exclude_from_classes) {
+				efree(ce->trait_precedences[i]->exclude_from_classes);
+				ce->trait_precedences[i]->exclude_from_classes = NULL;
+			}
+			i++;
+		}
+	}
+
 	if (overriden) {
 		zend_hash_destroy(overriden);
 		FREE_HASHTABLE(overriden);
@@ -5373,7 +5404,7 @@ ZEND_API int zend_unmangle_property_name_ex(const char *mangled_property, int le
 
 	*class_name = NULL;
 
-	if (mangled_property[0]!=0) {
+	if (!len || mangled_property[0] != 0) {
 		*prop_name = mangled_property;
 		if (prop_len) {
 			*prop_len = len;
@@ -5781,7 +5812,7 @@ void zend_do_fetch_constant(znode *result, znode *constant_container, znode *con
 				opline->op2.constant = zend_add_const_name_literal(CG(active_op_array), &constant_name->u.constant, 0 TSRMLS_CC);
 			} else {
 				opline->extended_value = IS_CONSTANT_UNQUALIFIED;
-				if (CG(current_namespace)) {
+				if (check_namespace && CG(current_namespace)) {
 					opline->extended_value |= IS_CONSTANT_IN_NAMESPACE;
 					opline->op2.constant = zend_add_const_name_literal(CG(active_op_array), &constant_name->u.constant, 1 TSRMLS_CC);
 				} else {
@@ -6800,7 +6831,14 @@ void zend_do_extended_fcall_end(TSRMLS_D) /* {{{ */
 
 void zend_do_ticks(TSRMLS_D) /* {{{ */
 {
-	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	zend_op *opline;
+
+	/* This prevents a double TICK generated by the parser statement of "declare()" */
+	if (CG(active_op_array)->last && CG(active_op_array)->opcodes[CG(active_op_array)->last - 1].opcode == ZEND_TICKS) {
+		return;
+	}
+
+	opline = get_next_op(CG(active_op_array) TSRMLS_CC);
 
 	opline->opcode = ZEND_TICKS;
 	SET_UNUSED(opline->op1);
@@ -7116,7 +7154,7 @@ void zend_do_begin_namespace(const znode *name, zend_bool with_bracket TSRMLS_DC
 }
 /* }}} */
 
-void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	char *lcname;
 	zval *name, *ns, tmp;
@@ -7143,7 +7181,7 @@ void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{
 			ZVAL_STRING(name, p+1, 1);
 		} else {
 			ZVAL_ZVAL(name, ns, 1, 0);
-			warn = !is_global && !CG(current_namespace);
+			warn = !CG(current_namespace);
 		}
 	}
 
@@ -7199,7 +7237,7 @@ void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{
 }
 /* }}} */
 
-void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC) /* {{{ */
+void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC) /* {{{ */
 {
 	char *lookup_name;
 	zval *name, *ns, tmp;
@@ -7220,7 +7258,7 @@ void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int i
 			ZVAL_STRING(name, p+1, 1);
 		} else {
 			ZVAL_ZVAL(name, ns, 1, 0);
-			warn = !is_global && !CG(current_namespace);
+			warn = !CG(current_namespace);
 		}
 	}
 
@@ -7284,25 +7322,25 @@ void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int i
 }
 /* }}} */
 
-void zend_do_use_function(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use_function(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	if (!CG(current_import_function)) {
 		CG(current_import_function) = emalloc(sizeof(HashTable));
 		zend_hash_init(CG(current_import_function), 0, NULL, ZVAL_PTR_DTOR, 0);
 	}
 
-	zend_do_use_non_class(ns_name, new_name, is_global, 1, 0, CG(current_import_function), CG(function_table) TSRMLS_CC);
+	zend_do_use_non_class(ns_name, new_name, 1, 0, CG(current_import_function), CG(function_table) TSRMLS_CC);
 }
 /* }}} */
 
-void zend_do_use_const(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use_const(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	if (!CG(current_import_const)) {
 		CG(current_import_const) = emalloc(sizeof(HashTable));
 		zend_hash_init(CG(current_import_const), 0, NULL, ZVAL_PTR_DTOR, 0);
 	}
 
-	zend_do_use_non_class(ns_name, new_name, is_global, 0, 1, CG(current_import_const), &CG(const_filenames) TSRMLS_CC);
+	zend_do_use_non_class(ns_name, new_name, 0, 1, CG(current_import_const), &CG(const_filenames) TSRMLS_CC);
 }
 /* }}} */
 

Zend/zend_compile.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -651,10 +651,10 @@ void zend_do_build_namespace_name(znode *result, znode *prefix, znode *name TSRM
 void zend_do_begin_namespace(const znode *name, zend_bool with_brackets TSRMLS_DC);
 void zend_do_end_namespace(TSRMLS_D);
 void zend_verify_namespace(TSRMLS_D);
-void zend_do_use(znode *name, znode *new_name, int is_global TSRMLS_DC);
-void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC);
-void zend_do_use_function(znode *name, znode *new_name, int is_global TSRMLS_DC);
-void zend_do_use_const(znode *name, znode *new_name, int is_global TSRMLS_DC);
+void zend_do_use(znode *name, znode *new_name TSRMLS_DC);
+void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC);
+void zend_do_use_function(znode *name, znode *new_name TSRMLS_DC);
+void zend_do_use_const(znode *name, znode *new_name TSRMLS_DC);
 void zend_do_end_compilation(TSRMLS_D);
 void zend_do_constant_expression(znode *result, zend_ast *ast TSRMLS_DC);
 

Zend/zend_config.nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_config.w32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_constants.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_constants.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_default_classes.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_dynamic_array.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_dynamic_array.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_errors.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_exceptions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -36,16 +36,24 @@ ZEND_API void (*zend_throw_exception_hook)(zval *ex TSRMLS_DC);
 
 void zend_exception_set_previous(zval *exception, zval *add_previous TSRMLS_DC)
 {
-	zval *previous;
+	zval *previous, *ancestor;
 
 	if (exception == add_previous || !add_previous || !exception) {
 		return;
 	}
-	if (Z_TYPE_P(add_previous) != IS_OBJECT && !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
+	if (Z_TYPE_P(add_previous) != IS_OBJECT || !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
 		zend_error(E_ERROR, "Cannot set non exception as previous exception");
 		return;
 	}
 	while (exception && exception != add_previous && Z_OBJ_HANDLE_P(exception) != Z_OBJ_HANDLE_P(add_previous)) {
+		ancestor = zend_read_property(default_exception_ce, add_previous, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+		while (Z_TYPE_P(ancestor) == IS_OBJECT) {
+			if (Z_OBJ_HANDLE_P(ancestor) == Z_OBJ_HANDLE_P(exception)) {
+				zval_ptr_dtor(&add_previous);
+				return;
+			}
+			ancestor = zend_read_property(default_exception_ce, ancestor, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+		}
 		previous = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
 		if (Z_TYPE_P(previous) == IS_NULL) {
 			zend_update_property(default_exception_ce, exception, "previous", sizeof("previous")-1, add_previous TSRMLS_CC);
@@ -218,6 +226,32 @@ ZEND_METHOD(exception, __construct)
 }
 /* }}} */
 
+/* {{{ proto Exception::__wakeup()
+   Exception unserialize checks */
+#define CHECK_EXC_TYPE(name, type) \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
+	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
+		zval *tmp; \
+		MAKE_STD_ZVAL(tmp); \
+		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
+		zval_ptr_dtor(&tmp); \
+	}
+
+ZEND_METHOD(exception, __wakeup)
+{
+	zval *value;
+	zval *object = getThis();
+	CHECK_EXC_TYPE("message", IS_STRING);
+	CHECK_EXC_TYPE("string", IS_STRING);
+	CHECK_EXC_TYPE("code", IS_LONG);
+	CHECK_EXC_TYPE("file", IS_STRING);
+	CHECK_EXC_TYPE("line", IS_LONG);
+	CHECK_EXC_TYPE("trace", IS_ARRAY);
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
+}
+/* }}} */
+
 /* {{{ proto ErrorException::__construct(string message, int code, int severity [, string filename [, int lineno [, Exception previous]]])
    ErrorException constructor */
 ZEND_METHOD(error_exception, __construct)
@@ -586,11 +620,15 @@ ZEND_METHOD(exception, getTraceAsString)
 	int res_len = 0, *len = &res_len, num = 0;
 
 	DEFAULT_0_PARAMS;
-	
+
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if (Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
+
 	res = estrdup("");
 	str = &res;
 
-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);
 
 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -598,8 +636,8 @@ ZEND_METHOD(exception, getTraceAsString)
 	TRACE_APPEND_STRL(s_tmp, strlen(s_tmp));
 	efree(s_tmp);
 
-	res[res_len] = '\0';	
-	RETURN_STRINGL(res, res_len, 0); 
+	res[res_len] = '\0';
+	RETURN_STRINGL(res, res_len, 0);
 }
 /* }}} */
 
@@ -614,6 +652,7 @@ ZEND_METHOD(exception, getPrevious)
 	previous = zend_read_property(default_exception_ce, getThis(), "previous", sizeof("previous")-1, 1 TSRMLS_CC);
 	RETURN_ZVAL(previous, 1, 0);
 }
+/* }}} */
 
 int zend_spprintf(char **message, int max_len, const char *format, ...) /* {{{ */
 {
@@ -636,15 +675,15 @@ ZEND_METHOD(exception, __toString)
 	int len = 0;
 	zend_fcall_info fci;
 	zval fname;
-	
+
 	DEFAULT_0_PARAMS;
-	
+
 	str = estrndup("", 0);
 
 	exception = getThis();
 	ZVAL_STRINGL(&fname, "gettraceasstring", sizeof("gettraceasstring")-1, 1);
 
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT) {
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
 		prev_str = str;
 		_default_exception_get_entry(exception, "message", sizeof("message")-1, &message TSRMLS_CC);
 		_default_exception_get_entry(exception, "file", sizeof("file")-1, &file TSRMLS_CC);
@@ -654,6 +693,7 @@ ZEND_METHOD(exception, __toString)
 		convert_to_string(&file);
 		convert_to_long(&line);
 
+		trace = NULL;
 		fci.size = sizeof(fci);
 		fci.function_table = &Z_OBJCE_P(exception)->function_table;
 		fci.function_name = &fname;
@@ -666,7 +706,7 @@ ZEND_METHOD(exception, __toString)
 
 		zend_call_function(&fci, NULL TSRMLS_CC);
 
-		if (Z_TYPE_P(trace) != IS_STRING) {
+		if (trace && Z_TYPE_P(trace) != IS_STRING) {
 			zval_ptr_dtor(&trace);
 			trace = NULL;
 		}
@@ -723,6 +763,7 @@ ZEND_END_ARG_INFO()
 const static zend_function_entry default_exception_functions[] = {
 	ZEND_ME(exception, __clone, NULL, ZEND_ACC_PRIVATE|ZEND_ACC_FINAL)
 	ZEND_ME(exception, __construct, arginfo_exception___construct, ZEND_ACC_PUBLIC)
+	ZEND_ME(exception, __wakeup, NULL, ZEND_ACC_PUBLIC)
 	ZEND_ME(exception, getMessage, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getCode, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getFile, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)

Zend/zend_exceptions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_execute.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -522,9 +522,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 	zval *variable_ptr = *variable_ptr_ptr;
 	zval *value_ptr = *value_ptr_ptr;
 
-	if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else if (variable_ptr != value_ptr) {
+	if (variable_ptr != value_ptr) {
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
 			Z_DELREF_P(value_ptr);

Zend/zend_execute.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -364,13 +364,6 @@ void zend_verify_abstract_class(zend_class_entry *ce TSRMLS_DC);
 
 ZEND_API void zend_fetch_dimension_by_zval(zval **result, zval *container, zval *dim TSRMLS_DC);
 
-#ifdef ZEND_WIN32
-void zend_init_timeout_thread(void);
-void zend_shutdown_timeout_thread(void);
-#define WM_REGISTER_ZEND_TIMEOUT		(WM_USER+1)
-#define WM_UNREGISTER_ZEND_TIMEOUT		(WM_USER+2)
-#endif
-
 #define zendi_zval_copy_ctor(p) zval_copy_ctor(&(p))
 #define zendi_zval_dtor(p) zval_dtor(&(p))
 

Zend/zend_execute_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -46,13 +46,10 @@ ZEND_API const zend_fcall_info empty_fcall_info = { 0, NULL, NULL, NULL, NULL, 0
 ZEND_API const zend_fcall_info_cache empty_fcall_info_cache = { 0, NULL, NULL, NULL, NULL };
 
 #ifdef ZEND_WIN32
-#include <process.h>
-static WNDCLASS wc;
-static HWND timeout_window;
-static HANDLE timeout_thread_event;
-static HANDLE timeout_thread_handle;
-static DWORD timeout_thread_id;
-static int timeout_thread_initialized=0;
+#ifdef ZTS
+__declspec(thread)
+#endif
+HANDLE tq_timer = NULL;
 #endif
 
 #if 0&&ZEND_DEBUG
@@ -1234,115 +1231,19 @@ ZEND_API void zend_timeout(int dummy) /* {{{ */
 /* }}} */
 
 #ifdef ZEND_WIN32
-static LRESULT CALLBACK zend_timeout_WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) /* {{{ */
+VOID CALLBACK tq_timer_cb(PVOID arg, BOOLEAN timed_out)
 {
-#ifdef ZTS
-	THREAD_T thread_id = (THREAD_T)wParam;
-#endif
+	zend_bool *php_timed_out;
 
-	switch (message) {
-		case WM_DESTROY:
-			PostQuitMessage(0);
-			break;
-		case WM_REGISTER_ZEND_TIMEOUT:
-			/* wParam is the thread id pointer, lParam is the timeout amount in seconds */
-			if (lParam == 0) {
-				KillTimer(timeout_window, wParam);
-			} else {
-#ifdef ZTS
-				void ***tsrm_ls;
-#endif
-				SetTimer(timeout_window, wParam, lParam*1000, NULL);
-#ifdef ZTS
-				tsrm_ls = ts_resource_ex(0, &thread_id);
-				if (!tsrm_ls) {
-					/* shouldn't normally happen */
-					break;
-				}
-#endif
-				EG(timed_out) = 0;
-			}
-			break;
-		case WM_UNREGISTER_ZEND_TIMEOUT:
-			/* wParam is the thread id pointer */
-			KillTimer(timeout_window, wParam);
-			break;
-		case WM_TIMER: {
-#ifdef ZTS
-				void ***tsrm_ls;
-
-				tsrm_ls = ts_resource_ex(0, &thread_id);
-				if (!tsrm_ls) {
-					/* Thread died before receiving its timeout? */
-					break;
-				}
-#endif
-				KillTimer(timeout_window, wParam);
-				EG(timed_out) = 1;
-			}
-			break;
-		default:
-			return DefWindowProc(hWnd, message, wParam, lParam);
-	}
-	return 0;
-}
-/* }}} */
-
-static unsigned __stdcall timeout_thread_proc(void *pArgs) /* {{{ */
-{
-	MSG message;
-
-	wc.style=0;
-	wc.lpfnWndProc = zend_timeout_WndProc;
-	wc.cbClsExtra=0;
-	wc.cbWndExtra=0;
-	wc.hInstance=NULL;
-	wc.hIcon=NULL;
-	wc.hCursor=NULL;
-	wc.hbrBackground=(HBRUSH)(COLOR_BACKGROUND + 5);
-	wc.lpszMenuName=NULL;
-	wc.lpszClassName = "Zend Timeout Window";
-	if (!RegisterClass(&wc)) {
-		return -1;
-	}
-	timeout_window = CreateWindow(wc.lpszClassName, wc.lpszClassName, 0, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, NULL, NULL, NULL);
-	SetEvent(timeout_thread_event);
-	while (GetMessage(&message, NULL, 0, 0)) {
-		SendMessage(timeout_window, message.message, message.wParam, message.lParam);
-		if (message.message == WM_QUIT) {
-			break;
-		}
-	}
-	DestroyWindow(timeout_window);
-	UnregisterClass(wc.lpszClassName, NULL);
-	SetEvent(timeout_thread_handle);
-	return 0;
-}
-/* }}} */
-
-void zend_init_timeout_thread(void) /* {{{ */
-{
-	timeout_thread_event = CreateEvent(NULL, FALSE, FALSE, NULL);
-	timeout_thread_handle = CreateEvent(NULL, FALSE, FALSE, NULL);
-	_beginthreadex(NULL, 0, timeout_thread_proc, NULL, 0, &timeout_thread_id);
-	WaitForSingleObject(timeout_thread_event, INFINITE);
-}
-/* }}} */
-
-void zend_shutdown_timeout_thread(void) /* {{{ */
-{
-	if (!timeout_thread_initialized) {
+	/* The doc states it'll be always true, however it theoretically
+		could be FALSE when the thread was signaled. */
+	if (!timed_out) {
 		return;
 	}
-	PostThreadMessage(timeout_thread_id, WM_QUIT, 0, 0);
 
-	/* Wait for thread termination */
-	WaitForSingleObject(timeout_thread_handle, 5000);
-	CloseHandle(timeout_thread_handle);
-	timeout_thread_initialized = 0;
+	php_timed_out = (zend_bool *)arg;
+	*php_timed_out = 1;
 }
-/* }}} */
-
 #endif
 
 /* This one doesn't exists on QNX */
@@ -1360,13 +1261,28 @@ void zend_set_timeout(long seconds, int reset_signals) /* {{{ */
 	if(!seconds) {
 		return;
 	}
-	if (timeout_thread_initialized == 0 && InterlockedIncrement(&timeout_thread_initialized) == 1) {
-		/* We start up this process-wide thread here and not in zend_startup(), because if Zend
-		 * is initialized inside a DllMain(), you're not supposed to start threads from it.
-		 */
-		zend_init_timeout_thread();
+
+        /* Don't use ChangeTimerQueueTimer() as it will not restart an expired
+		timer, so we could end up with just an ignored timeout. Instead
+		delete and recreate. */
+	if (NULL != tq_timer) {
+		if (!DeleteTimerQueueTimer(NULL, tq_timer, NULL)) {
+			EG(timed_out) = 0;
+			tq_timer = NULL;
+			zend_error(E_ERROR, "Could not delete queued timer");
+			return;
+		}
+		tq_timer = NULL;
 	}
-	PostThreadMessage(timeout_thread_id, WM_REGISTER_ZEND_TIMEOUT, (WPARAM) GetCurrentThreadId(), (LPARAM) seconds);
+
+	/* XXX passing NULL means the default timer queue provided by the system is used */
+	if (!CreateTimerQueueTimer(&tq_timer, NULL, (WAITORTIMERCALLBACK)tq_timer_cb, (VOID*)&EG(timed_out), seconds*1000, 0, WT_EXECUTEONLYONCE)) {
+		EG(timed_out) = 0;
+		tq_timer = NULL;
+		zend_error(E_ERROR, "Could not queue new timer");
+		return;
+	}
+	EG(timed_out) = 0;
 #else
 #	ifdef HAVE_SETITIMER
 	{
@@ -1408,9 +1324,16 @@ void zend_set_timeout(long seconds, int reset_signals) /* {{{ */
 void zend_unset_timeout(TSRMLS_D) /* {{{ */
 {
 #ifdef ZEND_WIN32
-	if(timeout_thread_initialized) {
-		PostThreadMessage(timeout_thread_id, WM_UNREGISTER_ZEND_TIMEOUT, (WPARAM) GetCurrentThreadId(), (LPARAM) 0);
+	if (NULL != tq_timer) {
+		if (!DeleteTimerQueueTimer(NULL, tq_timer, NULL)) {
+			EG(timed_out) = 0;
+			tq_timer = NULL;
+			zend_error(E_ERROR, "Could not delete queued timer");
+			return;
+		}
+		tq_timer = NULL;
 	}
+	EG(timed_out) = 0;
 #else
 #	ifdef HAVE_SETITIMER
 	if (EG(timeout_seconds)) {
@@ -1662,6 +1585,10 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 			ex->symbol_table = EG(active_symbol_table);
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
+					if (UNEXPECTED(**EX_CV_NUM(ex, i) == &EG(uninitialized_zval))) {
+						Z_DELREF(EG(uninitialized_zval));
+						ALLOC_INIT_ZVAL(**EX_CV_NUM(ex, i));
+					}
 					zend_hash_quick_update(EG(active_symbol_table),
 						ex->op_array->vars[i].name,
 						ex->op_array->vars[i].name_len + 1,

Zend/zend_extensions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -100,6 +100,14 @@ int zend_load_extension(const char *path)
 		fprintf(stderr, "Cannot load %s - it was built with configuration %s, whereas running engine is %s\n",
 					new_extension->name, extension_version_info->build_id, ZEND_EXTENSION_BUILD_ID);
 /* See http://support.microsoft.com/kb/190351 */
+#ifdef PHP_WIN32
+		fflush(stderr);
+#endif
+		DL_UNLOAD(handle);
+		return FAILURE;
+	} else if (zend_get_extension(new_extension->name)) {
+		fprintf(stderr, "Cannot load %s - extension already loaded\n", new_extension->name);
+/* See http://support.microsoft.com/kb/190351 */
 #ifdef PHP_WIN32
 		fflush(stderr);
 #endif

Zend/zend_extensions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_float.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_float.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_gc.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -147,8 +147,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 	GC_BENCH_INC(zval_possible_root);
 
 	if (GC_ZVAL_GET_COLOR(zv) != GC_PURPLE) {
-		GC_ZVAL_SET_PURPLE(zv);
-
 		if (!GC_ZVAL_ADDRESS(zv)) {
 			gc_root_buffer *newRoot = GC_G(unused);
 
@@ -159,7 +157,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -169,10 +166,10 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				if (!newRoot) {
 					return;
 				}
-				GC_ZVAL_SET_PURPLE(zv);
 				GC_G(unused) = newRoot->prev;
 			}
 
+			GC_ZVAL_SET_PURPLE(zv);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -203,7 +200,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 
 	obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
 	if (GC_GET_COLOR(obj->buffered) != GC_PURPLE) {
-		GC_SET_PURPLE(obj->buffered);
 		if (!GC_ADDRESS(obj->buffered)) {
 			gc_root_buffer *newRoot = GC_G(unused);
 
@@ -214,7 +210,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -225,10 +220,10 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 					return;
 				}
 				obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
-				GC_SET_PURPLE(obj->buffered);
 				GC_G(unused) = newRoot->prev;
 			}
 
+			GC_SET_PURPLE(obj->buffered);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;

Zend/zend_gc.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_generators.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -198,6 +198,9 @@ static void zend_generator_dtor_storage(zend_generator *generator, zend_object_h
 	if (finally_op_num) {
 		ex->opline = &ex->op_array->opcodes[finally_op_num];
 		ex->fast_ret = NULL;
+		ex->delayed_exception = EG(exception);
+		EG(exception) = NULL;
+
 		generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
 		zend_generator_resume(generator TSRMLS_CC);
 	}
@@ -605,9 +608,9 @@ ZEND_METHOD(Generator, __wakeup)
 
 static void zend_generator_iterator_dtor(zend_object_iterator *iterator TSRMLS_DC) /* {{{ */
 {
-	zval *object = ((zend_generator_iterator *) iterator)->object;
+	zend_generator_iterator *iter = (zend_generator_iterator *) iterator;
 
-	zval_ptr_dtor(&object);
+	zend_objects_store_del_ref_by_handle(iter->handle TSRMLS_CC);
 }
 /* }}} */
 
@@ -699,8 +702,8 @@ zend_object_iterator *zend_generator_get_iterator(zend_class_entry *ce, zval *ob
 
 	/* We have to keep a reference to the generator object zval around,
 	 * otherwise the generator may be destroyed during iteration. */
-	Z_ADDREF_P(object);
-	iterator->object = object;
+	iterator->handle = Z_OBJ_HANDLE_P(object);
+	zend_objects_store_add_ref_by_handle(iterator->handle TSRMLS_CC);
 
 	return (zend_object_iterator *) iterator;
 }

Zend/zend_generators.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -28,9 +28,9 @@ extern ZEND_API zend_class_entry *zend_ce_generator;
 typedef struct _zend_generator_iterator {
 	zend_object_iterator intern;
 
-	/* The generator object zval has to be stored, because the iterator is
-	 * holding a ref to it, which has to be dtored. */
-	zval *object;
+	/* The generator object handle has to be stored, because the
+	 * iterator is holding a ref to it, which has to be dtored. */
+	zend_object_handle handle;
 } zend_generator_iterator;
 
 typedef struct _zend_generator {

Zend/zend_globals.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_globals_macros.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_hash.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 
@@ -1269,6 +1269,9 @@ ZEND_API int zend_hash_update_current_key_ex(HashTable *ht, int key_type, const
 
 		if (key_type == HASH_KEY_IS_LONG) {
 			p->h = num_index;
+			if ((long)num_index >= (long)ht->nNextFreeElement) {
+				ht->nNextFreeElement = num_index < LONG_MAX ? num_index + 1 : LONG_MAX;
+			}
 		} else {
 			p->h = h;
 			p->nKeyLength = str_length;
@@ -1443,11 +1446,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 		}
 		if (ordered) {
 			if (p1->nKeyLength==0 && p2->nKeyLength==0) { /* numeric indices */
-				result = p1->h - p2->h;
-				if (result!=0) {
+				if (p1->h != p2->h) {
 					HASH_UNPROTECT_RECURSION(ht1); 
 					HASH_UNPROTECT_RECURSION(ht2); 
-					return result;
+					return p1->h > p2->h ? 1 : -1;
 				}
 			} else { /* string indices */
 				result = p1->nKeyLength - p2->nKeyLength;

Zend/zend_hash.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_highlight.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_highlight.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_indent.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        | 

Zend/zend_indent.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |