sync NEWS

Re-Fixed bug #70249 (Segmentation fault while running PHPUnit tests on phpBB 3.2-dev)
Let's fixed this in the root instead
2026-11-11 11:10:49 +00:00 · 2015-11-11 10:59:11 +01:00 · 2015-11-11 10:58:36 +01:00 · 2015-11-11 10:56:56 +01:00 · 2015-11-10 12:09:45 +01:00 · 2015-11-10 12:09:30 +01:00
67 changed files with 1428 additions and 308 deletions
@@ -1,5 +1,55 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+12 Nov 2015, PHP 7.0.0 RC 7
+
+- Core:
+  . Fixed bug #70249 (Segmentation fault while running PHPUnit tests on
+    phpBB 3.2-dev). (Laruence)
+  . Fixed bug #70805 (Segmentation faults whilst running Drupal 8 test suite).
+    (Dmitry, Laruence)
+  . Fixed bug #70842 (Persistent Stream Segmentation Fault). (Caleb Champlin)
+  . Fixed bug #70862 (Several functions do not check return code of
+    php_stream_copy_to_mem()). (Anatol)
+  . Fixed bug #70863 (Incorect logic to increment_function for proxy objects).
+    (Anatol)
+  . Fixed bug #70323 (Regression in zend_fetch_debug_backtrace() can cause
+    segfaults). (Aharvey, Laruence)
+  . Fixed bug #70873 (Regression on private static properties access).
+    (Laruence)
+
+- OCI8:
+  . Fixed bug #68298 (OCI int overflow) (Senthil).
+
+- Opcache:
+  . Fixed bug #70656 (require() statement broken after opcache_reset() or a
+    few hours of use). (Laruence)
+  . Fixed bug #70843 (Segmentation fault on MacOSX with
+    opcache.file_cache_only=1). (Laruence)
+
+- PDO:
+  . Fix bug #70861 (Segmentation fault in pdo_parse_params() during Drupal 8
+    test suite). (Anatol)
+
+- Session:
+  . Fixed bug #70876 (Segmentation fault when regenerating session id with
+    strict mode). (Laruence)
+
+- SOAP:
+  . Fixed bug #70875 (Segmentation fault if wsdl has no targetNamespace
+    attribute). (Matteo)
+
+- SPL:
+  . Fixed bug #70853 (SplFixedArray throws exception when using ref variable
+    as index). (Laruence)
+  . Fixed bug #70868 (PCRE JIT and pattern reuse segfault). (Laruence)
+
+- Standard:
+  . Fixed bug #70808 (array_merge_recursive corrupts memory of unset items).
+    (Laruence)
+
+- XSL:
+  . Fixed bug #70678 (PHP7 returns true when false is expected). (Felipe)
+
 29 Oct 2015, PHP 7.0.0 RC 6

 - Core:
@@ -352,7 +352,7 @@ Relevant RFCs:
 Other language changes
 ----------------------

-* Removed support for static calls to non-static calls form an incompatible
+* Removed support for static calls to non-static methods from an incompatible
  $this context. In this case $this will not be defined, but the call will be
  allowed with a deprecation notice. An example:

@@ -0,0 +1,46 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["array"]);
+			unset($GLOBALS["a"]); // this will be called in gc_colloct_roots and put $a into gc roots buf
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+$c = new A;
+$array = array($c); //This is used to leave a room for $GLOBALS["a"]
+unset($c);
+
+while ($i++ < 9997) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t); // This is used to trigger C::__destruct while doing gc_colloct_roots
+
+$e = $a;
+unset($a); // This one can not be putted into roots buf because it's full, thus gc_colloct_roots will be called, 
+           // but C::__destructor which is called in gc_colloct_roots will put $a into buf
+		   // which will make $a be putted into gc roots buf twice
+var_dump(gc_collect_cycles());
+?>
+--EXPECT--
+int(0)
@@ -0,0 +1,43 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite) (Crash)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["array"]);
+			unset($GLOBALS["a"]);
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+$c = new A;
+$array = array($c); 
+unset($c);
+
+while ($i++ < 9997) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t);
+unset($a);
+
+var_dump(gc_collect_cycles());
+?>
+--EXPECT--
+int(2)
@@ -0,0 +1,37 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite) (Memleak)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["a"]);
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+while ($i++ < 9998) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t);
+
+unset($a);
+var_dump(gc_collect_cycles());
+--EXPECT--
+int(2)
@@ -0,0 +1,34 @@
+--TEST--
+Bug #70873 (Regression on private static properties access)
+--FILE--
+<?php
+
+class A {
+	private static $x = 1;
+}
+
+class B extends A {
+	function bar() {
+		var_dump(self::$x);
+	}
+};
+
+class C extends A {
+	function bar() {
+		var_dump(A::$x);
+	}
+};
+
+
+$a = new B;
+$a->bar();
+
+$b = new C;
+$b->bar();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot access  property B::$x in %sbug70873.php:%d
+Stack trace:
+#0 %sbug70873.php(%d): B->bar()
+#1 {main}
+  thrown in %sbug70873.php on line %d
@@ -0,0 +1,40 @@
+--TEST--
+Combination of foreach, finally and goto (call order)
+--FILE--
+<?php
+class A {
+	public $n = 0;
+	function __construct($n) {
+		$this->n = $n;
+	}
+	function __destruct() {
+		echo "destruct" . $this->n . "\n";
+	}
+}
+
+foreach ([new A(1)] as $a) {
+    $a = null;
+    try {
+        foreach ([new A(2)] as $a) {
+            $a = null;
+            try {
+                foreach ([new A(3)] as $a) {
+                    $a = null;
+                    goto out;
+                }
+            } finally {
+                echo "finally1\n";
+            }
+out: ;
+        }
+    } finally {
+        echo "finally2\n";
+    }
+}
+?>
+--EXPECT--
+destruct3
+finally1
+destruct2
+finally2
+destruct1
@@ -0,0 +1,42 @@
+--TEST--
+Combination of foreach, finally and exception (call order)
+--FILE--
+<?php
+class A {
+	public $n = 0;
+	function __construct($n) {
+		$this->n = $n;
+	}
+	function __destruct() {
+		echo "destruct" . $this->n . "\n";
+	}
+}
+
+foreach ([new A(1)] as $a) {
+    $a = null;
+    try {
+        foreach ([new A(2)] as $a) {
+            $a = null;
+            try {
+                foreach ([new A(3)] as $a) {
+                    $a = null;
+                    throw new Exception();
+                }
+            } finally {
+                echo "finally1\n";
+            }
+        }
+    } catch (Exception $e) {
+        echo "catch\n";
+    } finally {
+        echo "finally2\n";
+    }
+}
+?>
+--EXPECT--
+destruct3
+finally1
+destruct2
+catch
+finally2
+destruct1
@@ -0,0 +1,13 @@
+--TEST--
+Accessing a static property on a statically evaluable class expression
+--FILE--
+<?php
+
+class A {
+    public static $b = 42;
+}
+var_dump(('A' . (string) '')::$b);
+
+?>
+--EXPECT--
+int(42)
@@ -0,0 +1,13 @@
+--TEST--
+Static property on constexpr class with leading backslash
+--FILE--
+<?php
+
+class A {
+    public static $b = 42;
+}
+var_dump(('\A' . (string) '')::$b);
+
+?>
+--EXPECT--
+int(42)
@@ -0,0 +1,11 @@
+--TEST--
+Static property access on constexpr class evaluating to integer
+--FILE--
+<?php
+((int)1)::$b;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class name must be a valid object or a string in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -22,7 +22,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.0.0-dev"
+#define ZEND_VERSION "3.0.0"

 #define ZEND_ENGINE_3

@@ -1463,9 +1463,9 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 			size = real_size;
 #endif
 #ifdef ZEND_WIN32
-			/* On Windows we don't have ability to extend huge block in-place.
-			 * We allocate them with 2MB size granularuty, to avoid many 
-			 * reallocatioons whenthey when they are extended by small peaces
+			/* On Windows we don't have ability to extend huge blocks in-place.
+			 * We allocate them with 2MB size granularity, to avoid many 
+			 * reallocations when they are extended by small pieces
 			 */
 			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
 #else
@@ -1731,9 +1731,9 @@ static void zend_mm_change_huge_block_size(zend_mm_heap *heap, void *ptr, size_t
 static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
 #ifdef ZEND_WIN32
-	/* On Windows we don't have ability to extend huge block in-place.
-	 * We allocate them with 2MB size granularuty, to avoid many 
-	 * reallocatioons whenthey when they are extended by small peaces
+	/* On Windows we don't have ability to extend huge blocks in-place.
+	 * We allocate them with 2MB size granularity, to avoid many 
+	 * reallocations when they are extended by small pieces
 	 */
 	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
 #else
@@ -2481,7 +2481,7 @@ ZEND_FUNCTION(debug_print_backtrace)

 ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int options, int limit) /* {{{ */
 {
-	zend_execute_data *call, *ptr, *skip;
+	zend_execute_data *ptr, *skip, *call = NULL;
 	zend_object *object;
 	int lineno, frameno = 0;
 	zend_function *func;
@@ -2490,8 +2490,12 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 	zend_string *include_filename = NULL;
 	zval stack_frame;

-	call = NULL;
-	ptr = EG(current_execute_data);
+	array_init(return_value);
+
+	if (!(ptr = EG(current_execute_data))) {
+		return;
+	}
+
 	if (!ptr->func || !ZEND_USER_CODE(ptr->func->common.type)) {
 		call = ptr;
 		ptr = ptr->prev_execute_data;
@@ -2509,13 +2513,11 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 				ptr = ptr->prev_execute_data;
 			}
 		}
+		if (!call) {
+			call = ptr;
+			ptr = ptr->prev_execute_data;
+		}
 	}
-	if (!call) {
-		call = ptr;
-		ptr = ptr->prev_execute_data;
-	}
-
-	array_init(return_value);

 	while (ptr && (limit == 0 || frameno < limit)) {
 		frameno++;
@@ -2418,7 +2418,7 @@ static zend_always_inline zend_generator *zend_get_running_generator(zend_execut
 }
 /* }}} */

-static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
+static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
 {
 	int i;
 	if (UNEXPECTED(EX(call))) {
@@ -2543,6 +2543,12 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data
 			call = EX(call);
 		} while (call);
 	}
+}
+/* }}} */
+
+static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
+{
+	int i;

 	for (i = 0; i < EX(func)->op_array.last_brk_cont; i++) {
 		const zend_brk_cont_element *brk_cont = &EX(func)->op_array.brk_cont_array[i];
@@ -2592,7 +2598,8 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data
 /* }}} */

 void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);
+	cleanup_live_vars(execute_data, op_num, catch_op_num);
 }

 #ifdef HAVE_GCC_GLOBAL_REGS
@@ -242,6 +242,13 @@ ZEND_API void ZEND_FASTCALL gc_possible_root(zend_refcounted *ref)
 		GC_REFCOUNT(ref)++;
 		gc_collect_cycles();
 		GC_REFCOUNT(ref)--;
+		if (UNEXPECTED(GC_REFCOUNT(ref)) == 0) {
+			zval_dtor_func_for_ptr(ref);
+			return;
+		}
+		if (UNEXPECTED(GC_INFO(ref))) {
+			return;
+		}
 		newRoot = GC_G(unused);
 		if (!newRoot) {
 #if ZEND_GC_DEBUG
@@ -1049,9 +1049,13 @@ ZEND_API int ZEND_FASTCALL zend_hash_del_ind(HashTable *ht, zend_string *key)
 					return FAILURE;
 				} else {
 					if (ht->pDestructor) {
-						ht->pDestructor(data);
+						zval tmp;
+						ZVAL_COPY_VALUE(&tmp, data);
+						ZVAL_UNDEF(data);
+						ht->pDestructor(&tmp);
+					} else {
+						ZVAL_UNDEF(data);
 					}
-					ZVAL_UNDEF(data);
 				}
 			} else {
 				_zend_hash_del_el_ex(ht, idx, p, prev);
@@ -1454,8 +1458,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply(HashTable *ht, apply_func_t apply_fu
 	HT_ASSERT(GC_REFCOUNT(ht) == 1);

 	HASH_PROTECT_RECURSION(ht);
-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		result = apply_func(&p->val);

@@ -1480,8 +1484,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply_with_argument(HashTable *ht, apply_f
 	HT_ASSERT(GC_REFCOUNT(ht) == 1);

 	HASH_PROTECT_RECURSION(ht);
-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		result = apply_func(&p->val, argument);

@@ -1509,8 +1513,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply_with_arguments(HashTable *ht, apply_

 	HASH_PROTECT_RECURSION(ht);

-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		va_start(args, num_args);
 		hash_key.h = p->h;
@@ -1543,10 +1547,9 @@ ZEND_API void ZEND_FASTCALL zend_hash_reverse_apply(HashTable *ht, apply_func_t

 	HASH_PROTECT_RECURSION(ht);
 	idx = ht->nNumUsed;
-	p = ht->arData + idx;
 	while (idx > 0) {
 		idx--;
-		p--;
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;

 		result = apply_func(&p->val);
@@ -275,10 +275,10 @@ static zend_always_inline int zend_verify_property_access(zend_property_info *pr
 		return 1;
 	} else if (property_info->flags & ZEND_ACC_PRIVATE) {
 		return (ce == EG(scope) || property_info->ce == EG(scope));
-	} else {
-		ZEND_ASSERT(property_info->flags & ZEND_ACC_PROTECTED);
+	} else if (property_info->flags & ZEND_ACC_PROTECTED) {
 		return zend_check_protected(property_info->ce, EG(scope));
 	}
+	return 0;
 }
 /* }}} */

@@ -2277,7 +2277,7 @@ try_again:
 				zval *val;

 				val = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);
-				Z_ADDREF_P(val);
+				Z_TRY_ADDREF_P(val);
 				increment_function(val);
 				Z_OBJ_HANDLER_P(op1, set)(op1, val);
 				zval_ptr_dtor(val);
@@ -2345,7 +2345,7 @@ try_again:
 				zval *val;

 				val = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);
-				Z_ADDREF_P(val);
+				Z_TRY_ADDREF_P(val);
 				decrement_function(val);
 				Z_OBJ_HANDLER_P(op1, set)(op1, val);
 				zval_ptr_dtor(val);
@@ -757,7 +757,7 @@ static zend_always_inline int fast_is_not_identical_function(zval *op1, zval *op
 		int ret;                                                                                           \
 		zval rv;                                                                                           \
 		zval *objval = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);                                      \
-		Z_ADDREF_P(objval);                                                                                \
+		Z_TRY_ADDREF_P(objval);                                                                                \
 		ret = binary_op(objval, objval, op2);                                                    \
 		Z_OBJ_HANDLER_P(op1, set)(op1, objval);                                                  \
 		zval_ptr_dtor(objval);                                                                             \
@@ -5513,8 +5513,14 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMPVAR|CV, UNUSED|CONST|VAR)
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -7118,11 +7124,12 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		}
 	}

-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);

 	if (finally_op_num && (!catch_op_num || catch_op_num >= finally_op_num)) {
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);

+		cleanup_live_vars(execute_data, op_num, finally_op_num);
 		if (in_finally && Z_OBJ_P(fast_call)) {
 			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
 		}
@@ -7132,6 +7139,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[finally_op_num]);
 		ZEND_VM_CONTINUE();
 	} else {
+		cleanup_live_vars(execute_data, op_num, catch_op_num);
 		if (in_finally) {
 			/* we are going out of current finally scope */
 			zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
@@ -7551,20 +7559,25 @@ ZEND_VM_HANDLER(163, ZEND_FAST_RET, ANY, ANY)
 		USE_OPLINE

 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
+			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 			ZEND_VM_CONTINUE();
 		} else {
 			EG(exception) = Z_OBJ_P(fast_call);
 			Z_OBJ_P(fast_call) = NULL;
 			if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 				ZEND_VM_CONTINUE();
-			} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
-				zend_generator *generator = zend_get_running_generator(execute_data);
-				zend_generator_close(generator, 1);
-				ZEND_VM_RETURN();
 			} else {
-				ZEND_VM_DISPATCH_TO_HELPER(zend_leave_helper);
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, 0);
+				if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
+					zend_generator *generator = zend_get_running_generator(execute_data);
+					zend_generator_close(generator, 1);
+					ZEND_VM_RETURN();
+				} else {
+					ZEND_VM_DISPATCH_TO_HELPER(zend_leave_helper);
+				}
 			}
 		}
 	}
@@ -1514,11 +1514,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		}
 	}

-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);

 	if (finally_op_num && (!catch_op_num || catch_op_num >= finally_op_num)) {
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);

+		cleanup_live_vars(execute_data, op_num, finally_op_num);
 		if (in_finally && Z_OBJ_P(fast_call)) {
 			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
 		}
@@ -1528,6 +1529,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[finally_op_num]);
 		ZEND_VM_CONTINUE();
 	} else {
+		cleanup_live_vars(execute_data, op_num, catch_op_num);
 		if (in_finally) {
 			/* we are going out of current finally scope */
 			zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
@@ -1639,20 +1641,25 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPC
 		USE_OPLINE

 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
+			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 			ZEND_VM_CONTINUE();
 		} else {
 			EG(exception) = Z_OBJ_P(fast_call);
 			Z_OBJ_P(fast_call) = NULL;
 			if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 				ZEND_VM_CONTINUE();
-			} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
-				zend_generator *generator = zend_get_running_generator(execute_data);
-				zend_generator_close(generator, 1);
-				ZEND_VM_RETURN();
 			} else {
-				ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, 0);
+				if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
+					zend_generator *generator = zend_get_running_generator(execute_data);
+					zend_generator_close(generator, 1);
+					ZEND_VM_RETURN();
+				} else {
+					ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+				}
 			}
 		}
 	}
@@ -6105,8 +6112,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_CONST_HAN
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -7034,8 +7047,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDL
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -7894,8 +7913,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HA
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -32128,8 +32153,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLE
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -33412,8 +33443,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -34642,8 +34679,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDL
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -41847,8 +41890,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_CONST_HA
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -42432,8 +42481,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_VAR_HAND
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -42834,8 +42889,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_UNUSED_H
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="RC6"
+PHP_EXTRA_VERSION="RC7"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -377,8 +377,10 @@ SAPI_POST_HANDLER_FUNC(php_mb_post_handler)

 	php_stream_rewind(SG(request_info).request_body);
 	post_data_str = php_stream_copy_to_mem(SG(request_info).request_body, PHP_STREAM_COPY_ALL, 0);
-	detected = _php_mb_encoding_handler_ex(&info, arg, ZSTR_VAL(post_data_str));
-	zend_string_release(post_data_str);
+	detected = _php_mb_encoding_handler_ex(&info, arg, post_data_str ? ZSTR_VAL(post_data_str) : NULL);
+	if (post_data_str) {
+		zend_string_release(post_data_str);
+	}

 	MBSTRG(http_input_identify) = detected;
 	if (detected) {
@@ -1149,8 +1149,13 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 				return 1;
 			}
 			convert_to_long(var);
+#if defined(OCI_MAJOR_VERSION) && OCI_MAJOR_VERSION > 10
+			bind_data = (ub8 *)&Z_LVAL_P(var);
+			value_sz = sizeof(ub8);
+#else
 			bind_data = (ub4 *)&Z_LVAL_P(var);
 			value_sz = sizeof(ub4);
+#endif
 			mode = OCI_DEFAULT;
 			break;
 			
@@ -0,0 +1,51 @@
+--TEST--
+Bug #68298 (OCI int overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only");
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+$stmtarray = array(
+	"DROP TABLE BUG68298", 
+	"CREATE TABLE BUG68298 (COL1 NUMBER(20))"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$s = oci_parse($c, "INSERT INTO BUG68298 VALUES (:INTVALUE)");
+$intvalue = 1152921504606846975;
+oci_bind_by_name($s, ":INTVALUE", $intvalue, -1, SQLT_INT);
+oci_execute($s);
+
+$s = oci_parse($c, "INSERT INTO BUG68298 VALUES (:INTVALUE)");
+$intvalue = -1152921504606846975;
+oci_bind_by_name($s, ":INTVALUE", $intvalue, -1, SQLT_INT);
+oci_execute($s);
+
+
+$s = oci_parse($c, "SELECT COL1 FROM BUG68298");
+oci_execute($s);
+oci_fetch_all($s, $r);
+var_dump($r);
+
+$stmtarray = array("DROP TABLE BUG68298");
+oci8_test_sql_execute($c, $stmtarray);
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(1) {
+  ["COL1"]=>
+  array(2) {
+    [0]=>
+    string(19) "1152921504606846975"
+    [1]=>
+    string(20) "-1152921504606846975"
+  }
+}
+===DONE===
@@ -643,13 +643,15 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			(opline->opcode != ZEND_FE_RESET_R || opline->opcode != ZEND_FE_RESET_RW) &&
 			opline->opcode != ZEND_FREE
 			) {
-			zend_op *src = VAR_SOURCE(opline->op1);
+			znode_op op1 = opline->op1;
+			zend_op *src = VAR_SOURCE(op1);
 			zval c = ZEND_OP1_LITERAL(src);
-			VAR_UNSET(opline->op1);
 			zval_copy_ctor(&c);
-			zend_optimizer_update_op1_const(op_array, opline, &c);
-			literal_dtor(&ZEND_OP1_LITERAL(src));
-			MAKE_NOP(src);
+			if (zend_optimizer_update_op1_const(op_array, opline, &c)) {
+				VAR_SOURCE(op1) = NULL;
+				literal_dtor(&ZEND_OP1_LITERAL(src));
+				MAKE_NOP(src);
+			}
 		}

 		/* T = QM_ASSIGN(C), F(T) => NOP, F(C) */
@@ -657,13 +659,15 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			VAR_SOURCE(opline->op2) &&
 			VAR_SOURCE(opline->op2)->opcode == ZEND_QM_ASSIGN &&
 			ZEND_OP1_TYPE(VAR_SOURCE(opline->op2)) == IS_CONST) {
-			zend_op *src = VAR_SOURCE(opline->op2);
+			znode_op op2 = opline->op2;
+			zend_op *src = VAR_SOURCE(op2);
 			zval c = ZEND_OP1_LITERAL(src);
-			VAR_UNSET(opline->op2);
 			zval_copy_ctor(&c);
-			zend_optimizer_update_op2_const(op_array, opline, &c);
-			literal_dtor(&ZEND_OP1_LITERAL(src));
-			MAKE_NOP(src);
+			if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
+				VAR_SOURCE(op2) = NULL;
+				literal_dtor(&ZEND_OP1_LITERAL(src));
+				MAKE_NOP(src);
+			}
 		}

 		/* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */
@@ -110,6 +110,13 @@ int zend_optimizer_add_literal(zend_op_array *op_array, zval *zv)
 	return i;
 }

+static inline int zend_optimizer_add_literal_string(zend_op_array *op_array, zend_string *str) {
+	zval zv;
+	ZVAL_STR(&zv, str);
+	zend_string_hash_val(str);
+	return zend_optimizer_add_literal(op_array, &zv);
+}
+
 int zend_optimizer_is_disabled_func(const char *name, size_t len) {
 	zend_function *fbc = (zend_function *)zend_hash_str_find_ptr(EG(function_table), name, len);

@@ -117,181 +124,226 @@ int zend_optimizer_is_disabled_func(const char *name, size_t len) {
 			fbc->internal_function.handler == ZEND_FN(display_disabled_function));
 }

-void zend_optimizer_update_op1_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val)
-{
-	if (opline->opcode == ZEND_FREE) {
-		MAKE_NOP(opline);
+static inline void drop_leading_backslash(zval *val) {
+	if (Z_STRVAL_P(val)[0] == '\\') {
+		zend_string *str = zend_string_init(Z_STRVAL_P(val) + 1, Z_STRLEN_P(val) - 1, 0);
 		zval_dtor(val);
-	} else {
-		ZEND_OP1_TYPE(opline) = IS_CONST;
-		if (Z_TYPE_P(val) == IS_STRING) {
-			switch (opline->opcode) {
-				case ZEND_INIT_STATIC_METHOD_CALL:
-				case ZEND_CATCH:
-				case ZEND_FETCH_CONSTANT:
-				case ZEND_DEFINED:
-				case ZEND_NEW:
-					opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
-					Z_CACHE_SLOT(op_array->literals[opline->op1.constant]) = op_array->cache_size;
-					op_array->cache_size += sizeof(void*);
-					zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-					zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(op_array->literals[opline->op1.constant+1]));
-					break;
-				default:
-					opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
-					break;
-			}
-		} else {
-			if (opline->opcode == ZEND_CONCAT ||
-			    opline->opcode == ZEND_FAST_CONCAT) {
-				convert_to_string(val);
-			}
-			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-		}
+		ZVAL_STR(val, str);
 	}
 }

-void zend_optimizer_update_op2_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val)
-{
-	ZEND_OP2_TYPE(opline) = IS_CONST;
-	if (opline->opcode == ZEND_INIT_FCALL) {
-		zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-		opline->op2.constant = zend_optimizer_add_literal(op_array, val);
-		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
-		Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-		op_array->cache_size += sizeof(void*);
-		return;
-	} else if (opline->opcode == ZEND_ROPE_INIT ||
-			opline->opcode == ZEND_ROPE_ADD ||
-			opline->opcode == ZEND_ROPE_END ||
-			opline->opcode == ZEND_CONCAT ||
-			opline->opcode == ZEND_FAST_CONCAT) {
-		convert_to_string(val);
-	}
-	opline->op2.constant = zend_optimizer_add_literal(op_array, val);
-	if (Z_TYPE_P(val) == IS_STRING) {
-		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
-		switch (opline->opcode) {
-			case ZEND_FETCH_R:
-			case ZEND_FETCH_W:
-			case ZEND_FETCH_RW:
-			case ZEND_FETCH_IS:
-			case ZEND_FETCH_UNSET:
-			case ZEND_FETCH_FUNC_ARG:
-			case ZEND_FETCH_CLASS:
-			case ZEND_INIT_FCALL_BY_NAME:
-			/*case ZEND_INIT_NS_FCALL_BY_NAME:*/
-			case ZEND_UNSET_VAR:
-			case ZEND_ISSET_ISEMPTY_VAR:
-			case ZEND_ADD_INTERFACE:
-			case ZEND_ADD_TRAIT:
-			case ZEND_INSTANCEOF:
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += sizeof(void*);
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				break;
-			case ZEND_INIT_DYNAMIC_CALL:
-				opline->opcode = ZEND_INIT_FCALL_BY_NAME;
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += sizeof(void*);
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				break;
-			case ZEND_INIT_METHOD_CALL:
-			case ZEND_INIT_STATIC_METHOD_CALL:
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				/* break missing intentionally */
-			/*case ZEND_FETCH_CONSTANT:*/
-			case ZEND_ASSIGN_OBJ:
-			case ZEND_FETCH_OBJ_R:
-			case ZEND_FETCH_OBJ_W:
-			case ZEND_FETCH_OBJ_RW:
-			case ZEND_FETCH_OBJ_IS:
-			case ZEND_FETCH_OBJ_UNSET:
-			case ZEND_FETCH_OBJ_FUNC_ARG:
-			case ZEND_UNSET_OBJ:
-			case ZEND_PRE_INC_OBJ:
-			case ZEND_PRE_DEC_OBJ:
-			case ZEND_POST_INC_OBJ:
-			case ZEND_POST_DEC_OBJ:
-			case ZEND_ISSET_ISEMPTY_PROP_OBJ:
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += 2 * sizeof(void*);
-				break;
-			case ZEND_ASSIGN_ADD:
-			case ZEND_ASSIGN_SUB:
-			case ZEND_ASSIGN_MUL:
-			case ZEND_ASSIGN_DIV:
-			case ZEND_ASSIGN_POW:
-			case ZEND_ASSIGN_MOD:
-			case ZEND_ASSIGN_SL:
-			case ZEND_ASSIGN_SR:
-			case ZEND_ASSIGN_CONCAT:
-			case ZEND_ASSIGN_BW_OR:
-			case ZEND_ASSIGN_BW_AND:
-			case ZEND_ASSIGN_BW_XOR:
-				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
-					Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-					op_array->cache_size += 2 * sizeof(void*);
-				}
-				break;
-			case ZEND_OP_DATA:
-				if ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
-				    ((opline-1)->extended_value == ZEND_ASSIGN_DIM &&
-				     ((opline-1)->opcode == ZEND_ASSIGN_ADD ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SUB ||
-				     (opline-1)->opcode == ZEND_ASSIGN_MUL ||
-				     (opline-1)->opcode == ZEND_ASSIGN_DIV ||
-				     (opline-1)->opcode == ZEND_ASSIGN_POW ||
-				     (opline-1)->opcode == ZEND_ASSIGN_MOD ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SL ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SR ||
-				     (opline-1)->opcode == ZEND_ASSIGN_CONCAT ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_OR ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_AND ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_XOR))) {
-					goto check_numeric;
-				}
-				break;
-			case ZEND_ISSET_ISEMPTY_DIM_OBJ:
-			case ZEND_ADD_ARRAY_ELEMENT:
-			case ZEND_INIT_ARRAY:
-			case ZEND_ASSIGN_DIM:
-			case ZEND_UNSET_DIM:
-			case ZEND_FETCH_DIM_R:
-			case ZEND_FETCH_DIM_W:
-			case ZEND_FETCH_DIM_RW:
-			case ZEND_FETCH_DIM_IS:
-			case ZEND_FETCH_DIM_FUNC_ARG:
-			case ZEND_FETCH_DIM_UNSET:
-			case ZEND_FETCH_LIST:
-check_numeric:
-				{
-					zend_ulong index;
+static inline void alloc_cache_slots_op2(zend_op_array *op_array, zend_op *opline, uint32_t num) {
+	Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
+	op_array->cache_size += num * sizeof(void *);
+}

-					if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
-						zval_dtor(val);
-						ZVAL_LONG(val, index);
-						op_array->literals[opline->op2.constant] = *val;
-		        	}
-				}
-				break;
-			default:
-				break;
-		}
+#define REQUIRES_STRING(val) do { \
+	if (Z_TYPE_P(val) != IS_STRING) { \
+		zval_dtor(val); \
+		return 0; \
+	} \
+} while (0)
+
+#define TO_STRING_NOWARN(val) do { \
+	if (Z_TYPE_P(val) >= IS_ARRAY) { \
+		zval_dtor(val); \
+		return 0; \
+	} \
+	convert_to_string(val); \
+} while (0)
+
+int zend_optimizer_update_op1_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val)
+{
+	switch (opline->opcode) {
+		case ZEND_FREE:
+			MAKE_NOP(opline);
+			zval_dtor(val);
+			break;
+		case ZEND_INIT_STATIC_METHOD_CALL:
+		case ZEND_CATCH:
+		case ZEND_FETCH_CONSTANT:
+		case ZEND_DEFINED:
+		case ZEND_NEW:
+			REQUIRES_STRING(val);
+			ZEND_OP1_TYPE(opline) = IS_CONST;
+			drop_leading_backslash(val);
+			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
+			zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
+			Z_CACHE_SLOT(op_array->literals[opline->op1.constant]) = op_array->cache_size;
+			op_array->cache_size += sizeof(void*);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			break;
+		case ZEND_CONCAT:
+		case ZEND_FAST_CONCAT:
+			TO_STRING_NOWARN(val);
+			/* break missing intentionally */
+		default:
+			ZEND_OP1_TYPE(opline) = IS_CONST;
+			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
+			if (Z_TYPE_P(val) == IS_STRING) {
+				zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
+			}
+			break;
 	}
+
+	return 1;
+}
+
+int zend_optimizer_update_op2_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val)
+{
+	switch (opline->opcode) {
+		case ZEND_ASSIGN_REF:
+			zval_dtor(val);
+			return 0;
+		case ZEND_FETCH_R:
+		case ZEND_FETCH_W:
+		case ZEND_FETCH_RW:
+		case ZEND_FETCH_IS:
+		case ZEND_FETCH_UNSET:
+		case ZEND_FETCH_FUNC_ARG:
+		case ZEND_FETCH_CLASS:
+		case ZEND_INIT_FCALL_BY_NAME:
+		/*case ZEND_INIT_NS_FCALL_BY_NAME:*/
+		case ZEND_UNSET_VAR:
+		case ZEND_ISSET_ISEMPTY_VAR:
+		case ZEND_ADD_INTERFACE:
+		case ZEND_ADD_TRAIT:
+		case ZEND_INSTANCEOF:
+			REQUIRES_STRING(val);
+			drop_leading_backslash(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			alloc_cache_slots_op2(op_array, opline, 1);
+			break;
+		case ZEND_INIT_FCALL:
+			REQUIRES_STRING(val);
+			zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			alloc_cache_slots_op2(op_array, opline, 1);
+			break;
+		case ZEND_INIT_DYNAMIC_CALL:
+			if (Z_TYPE_P(val) == IS_STRING) {
+				if (zend_memrchr(Z_STRVAL_P(val), ':', Z_STRLEN_P(val))) {
+					zval_dtor(val);
+					return 0;
+				}
+
+				opline->opcode = ZEND_INIT_FCALL_BY_NAME;
+				drop_leading_backslash(val);
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+				alloc_cache_slots_op2(op_array, opline, 1);
+			} else {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			}
+			break;
+		case ZEND_INIT_METHOD_CALL:
+		case ZEND_INIT_STATIC_METHOD_CALL:
+			REQUIRES_STRING(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			alloc_cache_slots_op2(op_array, opline, 2);
+			break;
+		/*case ZEND_FETCH_CONSTANT:*/
+		case ZEND_ASSIGN_OBJ:
+		case ZEND_FETCH_OBJ_R:
+		case ZEND_FETCH_OBJ_W:
+		case ZEND_FETCH_OBJ_RW:
+		case ZEND_FETCH_OBJ_IS:
+		case ZEND_FETCH_OBJ_UNSET:
+		case ZEND_FETCH_OBJ_FUNC_ARG:
+		case ZEND_UNSET_OBJ:
+		case ZEND_PRE_INC_OBJ:
+		case ZEND_PRE_DEC_OBJ:
+		case ZEND_POST_INC_OBJ:
+		case ZEND_POST_DEC_OBJ:
+		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+			TO_STRING_NOWARN(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			alloc_cache_slots_op2(op_array, opline, 2);
+			break;
+		case ZEND_ASSIGN_ADD:
+		case ZEND_ASSIGN_SUB:
+		case ZEND_ASSIGN_MUL:
+		case ZEND_ASSIGN_DIV:
+		case ZEND_ASSIGN_POW:
+		case ZEND_ASSIGN_MOD:
+		case ZEND_ASSIGN_SL:
+		case ZEND_ASSIGN_SR:
+		case ZEND_ASSIGN_CONCAT:
+		case ZEND_ASSIGN_BW_OR:
+		case ZEND_ASSIGN_BW_AND:
+		case ZEND_ASSIGN_BW_XOR:
+			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
+				TO_STRING_NOWARN(val);
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				alloc_cache_slots_op2(op_array, opline, 2);
+			} else {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			}
+			break;
+		case ZEND_OP_DATA:
+			if ((opline-1)->opcode != ZEND_ASSIGN_DIM &&
+				((opline-1)->extended_value != ZEND_ASSIGN_DIM ||
+				 ((opline-1)->opcode != ZEND_ASSIGN_ADD &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SUB &&
+				 (opline-1)->opcode != ZEND_ASSIGN_MUL &&
+				 (opline-1)->opcode != ZEND_ASSIGN_DIV &&
+				 (opline-1)->opcode != ZEND_ASSIGN_POW &&
+				 (opline-1)->opcode != ZEND_ASSIGN_MOD &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SL &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SR &&
+				 (opline-1)->opcode != ZEND_ASSIGN_CONCAT &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_OR &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_AND &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_XOR))
+			) {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				break;
+			}
+			/* break missing intentionally */
+		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
+		case ZEND_ADD_ARRAY_ELEMENT:
+		case ZEND_INIT_ARRAY:
+		case ZEND_ASSIGN_DIM:
+		case ZEND_UNSET_DIM:
+		case ZEND_FETCH_DIM_R:
+		case ZEND_FETCH_DIM_W:
+		case ZEND_FETCH_DIM_RW:
+		case ZEND_FETCH_DIM_IS:
+		case ZEND_FETCH_DIM_FUNC_ARG:
+		case ZEND_FETCH_DIM_UNSET:
+		case ZEND_FETCH_LIST:
+			if (Z_TYPE_P(val) == IS_STRING) {
+				zend_ulong index;
+				if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
+					zval_dtor(val);
+					ZVAL_LONG(val, index);
+				}
+			}
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			break;
+		case ZEND_ROPE_INIT:
+		case ZEND_ROPE_ADD:
+		case ZEND_ROPE_END:
+		case ZEND_CONCAT:
+		case ZEND_FAST_CONCAT:
+			TO_STRING_NOWARN(val);
+			/* break missing intentionally */
+		default:
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			break;
+	}
+
+	ZEND_OP2_TYPE(opline) = IS_CONST;
+	if (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING) {
+		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
+	}
+	return 1;
 }

 int zend_optimizer_replace_by_const(zend_op_array *op_array,
@@ -312,6 +364,8 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 				case ZEND_FETCH_DIM_UNSET:
 				case ZEND_ASSIGN_DIM:
 				case ZEND_SEPARATE:
+				case ZEND_RETURN_BY_REF:
+					zval_dtor(val);
 					return 0;
 				case ZEND_SEND_VAR:
 					opline->extended_value = 0;
@@ -334,6 +388,9 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 						opline->opcode = ZEND_SEND_VAL;
 					}
 					break;
+				case ZEND_SEND_USER:
+					opline->opcode = ZEND_SEND_VAL_EX;
+					break;
 				/* In most cases IS_TMP_VAR operand may be used only once.
 				 * The operands are usually destroyed by the opcode handler.
 				 * ZEND_CASE is an exception, that keeps operand unchanged,
@@ -399,21 +456,12 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 				default:
 					break;
 			}
-			zend_optimizer_update_op1_const(op_array, opline, val);
-			break;
+			return zend_optimizer_update_op1_const(op_array, opline, val);
 		}

 		if (ZEND_OP2_TYPE(opline) == type &&
 			ZEND_OP2(opline).var == var) {
-			switch (opline->opcode) {
-				case ZEND_ASSIGN_REF:
-					zval_dtor(val);
-					return 0;
-				default:
-					break;
-			}
-			zend_optimizer_update_op2_const(op_array, opline, val);
-			break;
+			return zend_optimizer_update_op2_const(op_array, opline, val);
 		}
 		opline++;
 	}
@@ -118,12 +118,12 @@ int  zend_optimizer_get_persistent_constant(zend_string *name, zval *result, int
 void zend_optimizer_collect_constant(zend_optimizer_ctx *ctx, zval *name, zval* value);
 int  zend_optimizer_get_collected_constant(HashTable *constants, zval *name, zval* value);
 int  zend_optimizer_lookup_cv(zend_op_array *op_array, zend_string* name);
-void zend_optimizer_update_op1_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val);
-void zend_optimizer_update_op2_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val);
+int zend_optimizer_update_op1_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val);
+int zend_optimizer_update_op2_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val);
 int  zend_optimizer_replace_by_const(zend_op_array *op_array,
                                     zend_op       *opline,
                                     zend_uchar     type,
@@ -249,6 +249,8 @@ static void accel_interned_strings_restore_state(void)
    uint nIndex;
    Bucket *p;

+	memset(ZCSG(interned_strings_saved_top),
+			0, ZCSG(interned_strings_top) - ZCSG(interned_strings_saved_top));
 	ZCSG(interned_strings_top) = ZCSG(interned_strings_saved_top);
    while (idx > 0) {
    	idx--;
@@ -20,6 +20,7 @@
 #include "zend_virtual_cwd.h"
 #include "zend_compile.h"
 #include "zend_vm.h"
+#include "zend_interfaces.h"

 #include "php.h"

@@ -35,6 +36,10 @@
 #include <sys/stat.h>
 #include <fcntl.h>

+#if HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
 #ifdef HAVE_SYS_UIO_H
 # include <sys/uio.h>
 #endif
@@ -801,10 +806,12 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 static void zend_file_cache_unserialize_hash(HashTable               *ht,
                                             zend_persistent_script  *script,
                                             void                    *buf,
-                                             unserialize_callback_t   func)
+                                             unserialize_callback_t   func,
+                                             dtor_func_t              dtor)
 {
 	Bucket *p, *end;

+	ht->pDestructor = dtor;
 	if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
 		HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 		return;
@@ -869,7 +876,8 @@ static void zend_file_cache_unserialize_zval(zval                    *zv,

 				UNSERIALIZE_PTR(Z_ARR_P(zv));
 				ht = Z_ARR_P(zv);
-				zend_file_cache_unserialize_hash(ht, script, buf, zend_file_cache_unserialize_zval);
+				zend_file_cache_unserialize_hash(ht,
+						script, buf, zend_file_cache_unserialize_zval, ZVAL_PTR_DTOR);
 			}
 			break;
 		case IS_REFERENCE:
@@ -904,7 +912,8 @@ static void zend_file_cache_unserialize_op_array(zend_op_array           *op_arr

 		UNSERIALIZE_PTR(op_array->static_variables);
 		ht = op_array->static_variables;
-		zend_file_cache_unserialize_hash(ht, script, buf, zend_file_cache_unserialize_zval);
+		zend_file_cache_unserialize_hash(ht,
+				script, buf, zend_file_cache_unserialize_zval, ZVAL_PTR_DTOR);
 	}

 	if (op_array->literals && !IS_UNSERIALIZED(op_array->literals)) {
@@ -1056,7 +1065,8 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 	ce = Z_PTR_P(zv);

 	UNSERIALIZE_STR(ce->name);
-	zend_file_cache_unserialize_hash(&ce->function_table, script, buf, zend_file_cache_unserialize_func);
+	zend_file_cache_unserialize_hash(&ce->function_table,
+			script, buf, zend_file_cache_unserialize_func, ZEND_FUNCTION_DTOR);
 	if (ce->default_properties_table) {
 		zval *p, *end;

@@ -1079,10 +1089,12 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 			p++;
 		}
 	}
-	zend_file_cache_unserialize_hash(&ce->constants_table, script, buf, zend_file_cache_unserialize_zval);
+	zend_file_cache_unserialize_hash(&ce->constants_table,
+			script, buf, zend_file_cache_unserialize_zval, NULL);
 	UNSERIALIZE_STR(ZEND_CE_FILENAME(ce));
 	UNSERIALIZE_STR(ZEND_CE_DOC_COMMENT(ce));
-	zend_file_cache_unserialize_hash(&ce->properties_info, script, buf, zend_file_cache_unserialize_prop_info);
+	zend_file_cache_unserialize_hash(&ce->properties_info,
+			script, buf, zend_file_cache_unserialize_prop_info, ZVAL_PTR_DTOR);

 	if (ce->trait_aliases) {
 		zend_trait_alias **p, *q;
@@ -1168,6 +1180,11 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 	UNSERIALIZE_PTR(ce->__tostring);
 	UNSERIALIZE_PTR(ce->__callstatic);
 	UNSERIALIZE_PTR(ce->__debugInfo);
+
+	if (UNEXPECTED((ce->ce_flags & ZEND_ACC_ANON_CLASS))) {
+		ce->serialize = zend_class_serialize_deny;
+		ce->unserialize = zend_class_unserialize_deny;
+	}
 }

 static void zend_file_cache_unserialize(zend_persistent_script  *script,
@@ -1177,8 +1194,10 @@ static void zend_file_cache_unserialize(zend_persistent_script  *script,

 	UNSERIALIZE_STR(script->full_path);

-	zend_file_cache_unserialize_hash(&script->class_table, script, buf, zend_file_cache_unserialize_class);
-	zend_file_cache_unserialize_hash(&script->function_table, script, buf, zend_file_cache_unserialize_func);
+	zend_file_cache_unserialize_hash(&script->class_table,
+			script, buf, zend_file_cache_unserialize_class, ZEND_CLASS_DTOR);
+	zend_file_cache_unserialize_hash(&script->function_table,
+			script, buf, zend_file_cache_unserialize_func, ZEND_FUNCTION_DTOR);
 	zend_file_cache_unserialize_op_array(&script->main_op_array, script, buf);

 	UNSERIALIZE_PTR(script->arena_mem);
@@ -575,6 +575,9 @@ safe:
 						zend_string *buf;

 						buf = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+						if (!buf) {
+							buf = ZSTR_EMPTY_ALLOC();
+						}
 						if (!stmt->dbh->methods->quoter(stmt->dbh, ZSTR_VAL(buf), ZSTR_LEN(buf), &plc->quoted, &plc->qlen,
 								param->param_type)) {
 							/* bork */
@@ -217,6 +217,9 @@ safe:
 						zend_string *buf;

 						buf = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+						if (!buf) {
+							buf = ZSTR_EMPTY_ALLOC();
+						}
 						if (!stmt->dbh->methods->quoter(stmt->dbh, ZSTR_VAL(buf), ZSTR_LEN(buf), &plc->quoted, &plc->qlen,
 								param->param_type)) {
 							/* bork */
@@ -523,12 +523,13 @@ static int firebird_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_dat
 			}

 			if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-				php_stream *stm;
+				php_stream *stm = NULL;

 				php_stream_from_zval_no_verify(stm, parameter);
 				if (stm) {
+					zend_string *mem =  php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
 					zval_ptr_dtor(parameter);
-					ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+					ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 				} else {
 					pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 					return 0;
@@ -523,10 +523,12 @@ static int pdo_mysql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_da
 							parameter = Z_REFVAL(param->parameter);
 						}
 						if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-							php_stream *stm;
+							php_stream *stm = NULL;
 							php_stream_from_zval_no_verify(stm, parameter);
 							if (stm) {
-								ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+								zend_string *mem = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+								zval_ptr_dtor(parameter);
+								ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 							} else {
 								pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 								return 0;
@@ -0,0 +1,46 @@
+--TEST--
+MySQL Prepared Statements and BLOBs
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+	require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+	$db = MySQLPDOTest::factory();
+
+	$db->exec('DROP TABLE IF EXISTS test');
+	$db->exec(sprintf('CREATE TABLE test(id INT, label BLOB)'));
+
+	$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 0);
+	$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+	class HelloWrapper {
+		public function stream_open() { return true; }
+		public function stream_eof() { return true; }
+		public function stream_read() { return NULL; }
+		public function stream_stat() { return array(); }
+	}
+	stream_wrapper_register("hello", "HelloWrapper");
+
+	$f = fopen("hello://there", "r");
+
+	$stmt = $db->prepare('INSERT INTO test(id, label) VALUES (1, :para)');
+	$stmt->bindParam(":para", $f, PDO::PARAM_LOB);
+	$stmt->execute();
+
+	var_dump($f);
+
+	print "done!";
+?>
+--CLEAN--
+<?php
+require dirname(__FILE__) . '/mysql_pdo_test.inc';
+$db = MySQLPDOTest::factory();
+$db->exec('DROP TABLE IF EXISTS test');
+?>
+--EXPECTF--
+string(0) ""
+done!
@@ -0,0 +1,46 @@
+--TEST--
+Bug #70861 Segmentation fault in pdo_parse_params() during Drupal 8 test suite
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+try {
+	@$db->query("SET bytea_output = 'escape'");
+} catch (Exception $e) {
+}
+
+$db->query('DROP TABLE IF EXISTS test_blob_crash CASCADE');
+$db->query('CREATE TABLE test_blob_crash (id SERIAL NOT NULL, blob1 BYTEA)');
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+$stmt = $db->prepare("INSERT INTO test_one_blob (blob1) VALUES (:foo)", array(PDO::ATTR_CURSOR => PDO::CURSOR_SCROLL));
+
+$stmt->bindparam(':foo', $f, PDO::PARAM_LOB);
+$stmt->execute();
+
+fclose($f);
+
+?>
+++DONE+++
+--EXPECTF--
+%a
+++DONE+++
@@ -138,11 +138,12 @@ static int pdo_sqlite_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_d
 							parameter = &param->parameter;
 						}
 						if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-							php_stream *stm;
+							php_stream *stm = NULL;
 							php_stream_from_zval_no_verify(stm, parameter);
 							if (stm) {
+								zend_string *mem = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
 								zval_ptr_dtor(parameter);
-								ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+								ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 							} else {
 								pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 								return 0;
@@ -0,0 +1,36 @@
+--TEST--
+PDO_sqlite: Testing sqliteCreateCollation()
+--SKIPIF--
+<?php if (!extension_loaded('pdo_sqlite')) print 'skip not loaded'; ?>
+--FILE--
+<?php
+
+$db = new pdo('sqlite::memory:');
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+$db->exec('CREATE TABLE test(field BLOB)');
+
+$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 0);
+$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+$stmt = $db->prepare('INSERT INTO test(field) VALUES (:para)');
+$stmt->bindParam(":para", $f, PDO::PARAM_LOB);
+$stmt->execute();
+
+var_dump($f);
+
+?>
+++DONE+++
+--EXPECTF--
+string(0) ""
+++DONE+++
@@ -5,7 +5,7 @@ Stefan Koopmanschap <stefan@phpgg.nl>
 TestFest PHP|Tek
 --SKIPIF--
 <?php
-if (!extension_loaded('reflection)) print 'skip';
+if (!extension_loaded('reflection')) print 'skip';
 ?>
 --FILE-- 
 <?php
@@ -443,7 +443,7 @@ PS_CLOSE_FUNC(files)

 	efree(data->basedir);
 	efree(data);
-	*mod_data = NULL;
+	PS_SET_MOD_DATA(NULL);

 	return SUCCESS;
 }
@@ -2077,6 +2077,11 @@ static PHP_FUNCTION(session_regenerate_id)
 		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
 		RETURN_FALSE;
 	}
+	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
+		PS(session_status) = php_session_none;
+		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+		RETURN_FALSE;
+	}
 	if (PS(use_strict_mode) && PS(mod)->s_validate_sid &&
 		PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) {
 		zend_string_release(PS(id));
@@ -2087,11 +2092,6 @@ static PHP_FUNCTION(session_regenerate_id)
 			RETURN_FALSE;
 		}
 	}
-	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
-		PS(session_status) = php_session_none;
-		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
-		RETURN_FALSE;
-	}
 	/* Read is required to make new session data at this point. */
 	if (PS(mod)->s_read(&PS(mod_data), PS(id), &data, PS(gc_maxlifetime)) == FAILURE) {
 		PS(session_status) = php_session_none;
@@ -0,0 +1,17 @@
+--TEST--
+Bug #70876 Segmentation fault when regenerating session id with strict mode
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--INI--
+html_errors=0
+session.save_handler=files
+--FILE--
+<?php
+ini_set('session.use_strict_mode', true);
+session_start();
+session_regenerate_id();
+
+echo "ok";
+?>
+--EXPECT--
+ok
@@ -112,7 +112,7 @@ encodePtr get_encoder(sdlPtr sdl, const char *ns, const char *type)
 {
 	encodePtr enc = NULL;
 	char *nscat;
-	int ns_len = strlen(ns);
+	int ns_len = ns ? strlen(ns) : 0;
 	int type_len = strlen(type);
 	int len = ns_len + type_len + 1;

@@ -0,0 +1,50 @@
+--TEST--
+SOAP Bug #70875 - Segmentation fault if wsdl has no targetNamespace attribute
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+
+class bug70875 extends SOAPClient
+{
+	public function __doRequest($request, $location, $action, $version, $one_way = 0)
+	{
+		die("no SIGSEGV");
+	}
+}
+
+$c = new bug70875(__DIR__.'/bug70875.wsdl', [
+	'trace' => 1,
+	'classmap' => [
+		'TestService' => 'TestService',
+		'TestServiceRQ' => 'TestServiceRQ',
+		'RqHeader' => 'RqHeader',
+	],
+]);
+
+
+class TestService
+{
+    public $TestServiceRQ;
+}
+
+class TestServiceRQ
+{
+	public $RqHeader;
+}
+
+class RqHeader
+{
+}
+
+$r = new TestService();
+$r->TestServiceRQ = new TestServiceRQ();
+$r->TestServiceRQ->RqHeader = new RqHeader();
+
+$c->testService($r);
+
+?>
+--EXPECT--
+no SIGSEGV
@@ -0,0 +1,156 @@
+<?xml version="1.0" encoding="utf-8"?>
+<wsdl:definitions name="BookingService" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
+                  xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy"
+                  xmlns:wsa10="http://www.w3.org/2005/08/addressing"
+                  xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract"
+                  xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
+                  xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex"
+                  xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+                  xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata"
+                  xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
+                  xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
+                  xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl"
+                  xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/"
+                  xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                  xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+    <wsdl:types>
+        <xs:schema elementFormDefault="unqualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+            <xs:element name="TestService">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element minOccurs="0" maxOccurs="1" name="TestServiceRQ" type="TestServiceRQ"/>
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+            <xs:complexType name="TestServiceRQ">
+                <xs:complexContent mixed="false">
+                    <xs:extension base="BaseRequest"/>
+                </xs:complexContent>
+            </xs:complexType>
+            <xs:complexType name="BaseRequest">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="RqHeader" type="RequestHeader"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="RequestHeader">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="AvesAutoLogin" type="AutoLogin"/>
+                </xs:sequence>
+                <xs:attribute name="HostID" type="xs:string"/>
+                <xs:attribute name="Xtoken" type="xs:string"/>
+                <xs:attribute name="Interface" type="xs:string"/>
+                <xs:attribute name="UserName" type="xs:string"/>
+            </xs:complexType>
+            <xs:complexType name="AutoLogin">
+                <xs:attribute name="VatCode" type="xs:string"/>
+                <xs:attribute name="ZipCode" type="xs:string"/>
+                <xs:attribute name="HashCode" type="xs:string"/>
+            </xs:complexType>
+            <xs:element name="TestServiceResponse">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element minOccurs="0" maxOccurs="1" name="TestServiceRS" type="TestServiceRS"/>
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+            <xs:complexType name="TestServiceRS">
+                <xs:complexContent mixed="false">
+                    <xs:extension base="BaseResponse"/>
+                </xs:complexContent>
+            </xs:complexType>
+            <xs:complexType name="BaseResponse">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="RsStatus" type="ResponseStatus"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="ResponseStatus">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ErrorCode" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ErrorDescription" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="unbounded" name="Warnings" type="ResponseWarning"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="InternalLog" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ProviderLogs" type="ArrayOfProviderLog"/>
+                </xs:sequence>
+                <xs:attribute name="Status" type="ResponseStatusType" use="required"/>
+            </xs:complexType>
+            <xs:complexType name="ResponseWarning">
+                <xs:attribute name="WarnType" type="ResponseWarningTypes" use="required"/>
+                <xs:attribute name="Description" type="xs:string"/>
+            </xs:complexType>
+            <xs:simpleType name="ResponseWarningTypes">
+                <xs:restriction base="xs:string">
+                    <xs:enumeration value="Unknown"/>
+                    <xs:enumeration value="DataNotFound"/>
+                    <xs:enumeration value="InactiveAgency"/>
+                </xs:restriction>
+            </xs:simpleType>
+            <xs:complexType name="ArrayOfProviderLog">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="unbounded" name="ProviderLog" nillable="true"
+                                type="ProviderLog"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="ProviderLog">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="OtaReqContent">
+                        <xs:complexType mixed="true">
+                            <xs:sequence>
+                                <xs:any/>
+                            </xs:sequence>
+                        </xs:complexType>
+                    </xs:element>
+                    <xs:element minOccurs="0" maxOccurs="1" name="OtaResContent">
+                        <xs:complexType mixed="true">
+                            <xs:sequence>
+                                <xs:any/>
+                            </xs:sequence>
+                        </xs:complexType>
+                    </xs:element>
+                </xs:sequence>
+                <xs:attribute name="ProviderCode" type="xs:string"/>
+                <xs:attribute name="RequestTime" type="xs:string"/>
+                <xs:attribute name="PostRequestTime" type="xs:string"/>
+                <xs:attribute name="ResponseCount" type="xs:string"/>
+                <xs:attribute name="ResponseMessage" type="xs:string"/>
+            </xs:complexType>
+            <xs:simpleType name="ResponseStatusType">
+                <xs:restriction base="xs:string">
+                    <xs:enumeration value="OK"/>
+                    <xs:enumeration value="ERROR"/>
+                    <xs:enumeration value="WARNING"/>
+                    <xs:enumeration value="TIMEOUT"/>
+                </xs:restriction>
+            </xs:simpleType>
+        </xs:schema>
+    </wsdl:types>
+    <wsdl:message name="IBookingService_TestService_InputMessage">
+        <wsdl:part name="parameters" element="TestService"/>
+    </wsdl:message>
+    <wsdl:message name="IBookingService_TestService_OutputMessage">
+        <wsdl:part name="parameters" element="TestServiceResponse"/>
+    </wsdl:message>
+    <wsdl:portType name="IBookingService">
+        <wsdl:operation name="TestService">
+            <wsdl:input wsaw:Action="urn:IBookingService/TestService"
+                        message="IBookingService_TestService_InputMessage"/>
+            <wsdl:output wsaw:Action="urn:IBookingService/TestServiceResponse"
+                         message="IBookingService_TestService_OutputMessage"/>
+        </wsdl:operation>
+    </wsdl:portType>
+    <wsdl:binding name="interop_booking_v2" type="IBookingService">
+        <wsdl:operation name="TestService">
+            <soap:operation soapAction="urn:IBookingService/TestService" style="document"/>
+            <wsdl:input>
+                <soap:body use="literal"/>
+            </wsdl:input>
+            <wsdl:output>
+                <soap:body use="literal"/>
+            </wsdl:output>
+        </wsdl:operation>
+    </wsdl:binding>
+    <wsdl:service name="BookingService">
+        <wsdl:port name="interop_booking_v2" binding="interop_booking_v2">
+            <soap:address location="http://localhost/foobar/soap"/>
+        </wsdl:port>
+    </wsdl:service>
+</wsdl:definitions>
@@ -42,6 +42,7 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */
 {
 	zend_ulong idx;

+try_again:
 	switch (Z_TYPE_P(offset)) {
 	case IS_STRING:
 		if (ZEND_HANDLE_NUMERIC(Z_STR_P(offset), idx)) {
@@ -56,6 +57,9 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */
 		return 0;
 	case IS_TRUE:
 		return 1;
+	case IS_REFERENCE:
+		offset = Z_REFVAL_P(offset);
+		goto try_again;
 	case IS_RESOURCE:
 		return Z_RES_HANDLE_P(offset);
 	}
@@ -2059,6 +2059,11 @@ SPL_METHOD(RegexIterator, accept)
 	{
 		case REGIT_MODE_MAX: /* won't happen but makes compiler happy */
 		case REGIT_MODE_MATCH:
+#ifdef PCRE_EXTRA_MARK
+			if (intern->u.regex.pce->extra) {
+				intern->u.regex.pce->extra->flags &= ~PCRE_EXTRA_MARK;
+			}
+#endif
 			count = pcre_exec(intern->u.regex.pce->re, intern->u.regex.pce->extra, ZSTR_VAL(subject), ZSTR_LEN(subject), 0, 0, NULL, 0);
 			RETVAL_BOOL(count >= 0);
 			break;
@@ -0,0 +1,15 @@
+--TEST--
+Bug #70853 (SplFixedArray throws exception when using ref variable as index)
+--FILE--
+<?php
+
+$list = new SplFixedArray(10);
+$ndx = 1;
+$ndx2 =& $ndx;
+$list[$ndx] = 123;	// This throws an exception;
+$list[$ndx2] = 123;	// as does this, to.
+echo 'ok';
+
+?>
+--EXPECT--
+ok
@@ -0,0 +1,32 @@
+--TEST--
+Bug #70868, with PCRE JIT
+--INI--
+pcre.jit=1
+--SKIPIF--
+<?php if (!extension_loaded("pcre")) die("skip"); ?>
+--FILE--
+<?php
+
+namespace X;
+
+$iterator =
+    new \RegexIterator(
+        new \ArrayIterator(['A.phpt', 'B.phpt', 'C.phpt']),
+        '/\.phpt$/'
+    )
+;
+
+foreach ($iterator as $foo) {
+    var_dump($foo);
+    preg_replace('/\.phpt$/', '', '');
+}
+
+echo "Done", PHP_EOL;
+
+?>
+--EXPECTF--
+
+string(6) "A.phpt"
+string(6) "B.phpt"
+string(6) "C.phpt"
+Done
@@ -1527,7 +1527,7 @@ PHP_METHOD(sqlite3stmt, execute)
 				case SQLITE_BLOB:
 				{
 					php_stream *stream = NULL;
-					zend_string *buffer;
+					zend_string *buffer = NULL;
 					if (Z_TYPE_P(parameter) == IS_RESOURCE) {
 						php_stream_from_zval_no_verify(stream, parameter);
 						if (stream == NULL) {
@@ -1540,10 +1540,11 @@ PHP_METHOD(sqlite3stmt, execute)
 						buffer = Z_STR_P(parameter);
 					}

-					sqlite3_bind_blob(stmt_obj->stmt, param->param_number, ZSTR_VAL(buffer), ZSTR_LEN(buffer), SQLITE_TRANSIENT);
-
-					if (stream) {
+					if (buffer) {
+						sqlite3_bind_blob(stmt_obj->stmt, param->param_number, ZSTR_VAL(buffer), ZSTR_LEN(buffer), SQLITE_TRANSIENT);
 						zend_string_release(buffer);
+					} else {
+						sqlite3_bind_null(stmt_obj->stmt, param->param_number);
 					}
 					break;
 				}
@@ -0,0 +1,39 @@
+--TEST--
+SQLite3::execute() with a resource bound for blob param
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+require_once(dirname(__FILE__) . '/new_db.inc');
+require_once(dirname(__FILE__) . '/stream_test.inc');
+
+var_dump($db->exec('CREATE TABLE test (id STRING, data BLOB)'));
+$insert_stmt = $db->prepare("INSERT INTO test (id, data) VALUES (1, ?)");
+
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+var_dump($insert_stmt->bindParam(1, $f, SQLITE3_BLOB));
+var_dump($insert_stmt->execute());
+
+var_dump($insert_stmt->close());
+fclose($f);
+
+?>
+++DONE+++
+--EXPECTF--
+bool(true)
+bool(true)
+object(SQLite3Result)#%d (%d) {
+}
+bool(true)
+++DONE+++
@@ -2967,6 +2967,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
 					convert_to_array_ex(dest_zval);
 					add_next_index_null(dest_zval);
+				} else if (Z_TYPE_P(dest_zval) == IS_ARRAY) {
+					if (UNEXPECTED(Z_ARRVAL_P(dest_zval)->nNextFreeElement > Z_ARRVAL_P(dest_zval)->nNumUsed)) {
+						Z_ARRVAL_P(dest_zval)->nNextFreeElement = Z_ARRVAL_P(dest_zval)->nNumUsed;
+					}
 				} else {
 					convert_to_array_ex(dest_zval);
 				}
@@ -217,11 +217,16 @@ static struct gfxinfo *php_handle_swc(php_stream * stream)

 	if (uncompress(b, &len, a, sizeof(a)) != Z_OK) {
 		/* failed to decompress the file, will try reading the rest of the file */
-		if (php_stream_seek(stream, 8, SEEK_SET))
+		if (php_stream_seek(stream, 8, SEEK_SET)) {
 			return NULL;
+		}

 		bufz = php_stream_copy_to_mem(stream, PHP_STREAM_COPY_ALL, 0);

+		if (!bufz) {
+			return NULL;
+		}
+
 		/*
 		 * zlib::uncompress() wants to know the output data length
 		 * if none was given as a parameter
@@ -0,0 +1,23 @@
+--TEST--
+Bug #70808 (array_merge_recursive corrupts memory of unset items)
+--FILE--
+<?php
+
+$arr1 = array("key" => array(0, 1));
+$arr2 = array("key" => array(2));
+
+unset($arr1["key"][1]);
+
+$result = array_merge_recursive($arr1, $arr2);
+print_r($result);
+?>
+--EXPECT--
+Array
+(
+    [key] => Array
+        (
+            [0] => 0
+            [1] => 2
+        )
+
+)
@@ -0,0 +1,28 @@
+--TEST--
+Bug #70249 (Segmentation fault while running PHPUnit tests on phpBB 3.2-dev)
+--FILE--
+<?php
+
+class Logger {
+    public function __construct() {
+        register_shutdown_function(function () {
+            // make regular flush before other shutdown functions, which allows session data collection and so on
+            $this->flush();
+            // make sure log entries written by shutdown functions are also flushed
+            // ensure "flush()" is called last when there are multiple shutdown functions
+            register_shutdown_function([$this, 'flush'], true);
+        });
+    }
+
+    public function flush($final = false) {
+        return 1;
+    }
+}
+
+for ($i = 0; $i < 200; $i++) {
+    $a = new Logger();
+}
+?>
+okey
+--EXPECT--
+okey
@@ -351,7 +351,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 				nodep = dom_object_get_node(obj);
 				valuePush(ctxt, xmlXPathNewNodeSet(nodep));
 			} else if (Z_TYPE(retval) == IS_TRUE || Z_TYPE(retval) == IS_FALSE) {
-				valuePush(ctxt, xmlXPathNewBoolean(Z_LVAL(retval)));
+				valuePush(ctxt, xmlXPathNewBoolean(Z_TYPE(retval) == IS_TRUE));
 			} else if (Z_TYPE(retval) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "A PHP Object cannot be converted to a XPath-string");
 				valuePush(ctxt, xmlXPathNewString((const xmlChar *) ""));
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 0
 #define PHP_RELEASE_VERSION 0
-#define PHP_EXTRA_VERSION "RC6"
-#define PHP_VERSION "7.0.0RC6"
+#define PHP_EXTRA_VERSION "RC7"
+#define PHP_VERSION "7.0.0RC7"
 #define PHP_VERSION_ID 70000
@@ -84,6 +84,7 @@ fprintf(stderr, "forget_persistent: %s:%p\n", stream->ops->label, stream);

 	if (stream->ctx) {
 		zend_list_delete(stream->ctx);
+		stream->ctx = NULL;
 	}

 	return 0;
@@ -1842,7 +1842,7 @@ ldap.max_links = -1

 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
 ; This should improve performance, but requires appropriate OS configuration.
-opcache.huge_code_pages=1
+;opcache.huge_code_pages=1

 [curl]
 ; A default value for the CURLOPT_CAINFO option. This is required to be an
@@ -31,7 +31,6 @@
 #include "SAPI.h"

 #include <stdio.h>
-#include "php.h"

 #ifdef PHP_WIN32
 # include "win32/time.h"
@@ -25,7 +25,7 @@ string(44) "Exception: Extension unknown does not exist
 "
 string(37) "Exception: Extension  does not exist
 "
-string(%d) "Extension [ <persistent> extension #%d pcre version %d.%d.%d%a ] {
+string(%d) "Extension [ <persistent> extension #%d pcre version %s ] {

  - INI {
    Entry [ pcre.backtrack_limit <ALL> ]
@@ -1,7 +1,22 @@
 --TEST--
 FPM: Test multi pool (dynamic + ondemand + static) (bug #68423)
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php
+include "skipif.inc"; 
+
+$cfg = <<<EOT
+[global]
+[poold_ondemand]
+listen=127.0.0.1:9000
+pm = ondemand
+pm.max_children = 2
+pm.process_idle_timeout = 10
+EOT;
+
+if (test_fpm_conf($cfg, $msg) == false) {
+	die("skip " .  $msg);
+}
+?>
 --FILE--
 <?php

@@ -1,7 +1,22 @@
 --TEST--
 FPM: Test splited configuration and load order #68391
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php
+include "skipif.inc";
+
+$cfg = <<<EOT
+[global]
+[poold_ondemand]
+listen=127.0.0.1:9000
+pm = ondemand
+pm.max_children = 2
+pm.process_idle_timeout = 10
+EOT;
+
+if (test_fpm_conf($cfg, $msg) == false) {
+	die("skip " .  $msg);
+}
+?>
 --FILE--
 <?php

@@ -84,4 +99,4 @@ Done
 		unlink($name);
 	}
 	@rmdir($logdir);
-?>
+?>
@@ -4,9 +4,16 @@ FPM: Test Unix Domain Socket with Posix ACL
 <?php
 include "skipif.inc";
 if (!(file_exists('/usr/bin/getfacl') && file_exists('/etc/passwd') && file_exists('/etc/group'))) die ("skip missing getfacl command");
+$cfg = <<<EOT
+[global]
+[unconfined]
+listen = 127.0.0.1:9999
+listen.acl_users = nobody
+listen.acl_groups = nobody
+listen.mode = 0600
+EOT;
+if (test_fpm_conf($cfg, $msg) == false) { die("skip " .  $msg); }
 ?>
--XFAIL--
-Mark as XFAIL because --with-fpm-acl is not enabled in default build
 --FILE--
 <?php

@@ -52,6 +52,18 @@ function run_fpm($config, &$out = false, $extra_args = '') /* {{{ */
 }
 /* }}} */

+function test_fpm_conf($config, &$msg = NULL) { /* {{{ */
+	$cfg = dirname(__FILE__).'/test-fpm-config.tmp';
+	file_put_contents($cfg, $config);
+	exec(get_fpm_path() . ' -t -y ' . $cfg . ' 2>&1', $output, $code);	
+	if ($code) {
+		$msg = preg_replace("/\[.+?\]/", "", $output[0]);
+		return false;
+	}
+	return true;
+}
+/* }}} */
+
 function run_fpm_till($needle, $config, $max = 10) /* {{{ */
 {
    $i = 0;
@@ -76,7 +88,7 @@ function run_fpm_till($needle, $config, $max = 10) /* {{{ */
 }
 /* }}} */

-function fpm_display_log($tail, $n=1, $ignore='systemd') {
+function fpm_display_log($tail, $n=1, $ignore='systemd') { /* {{{ */
 	while ($n) {
 		$a = fgets($tail);
 		if (empty($ignore) || !strpos($a, $ignore)) {
@@ -84,9 +96,9 @@ function fpm_display_log($tail, $n=1, $ignore='systemd') {
 			$n--;
 		}
 	}
-}
+} /* }}} */

-function run_request($host, $port, $uri='/ping', $query='') {
+function run_request($host, $port, $uri='/ping', $query='') { /* {{{ */
 	require_once 'fcgi.inc';
 	$client = new Adoy\FastCGI\Client($host, $port);
 	$params = array(
@@ -109,3 +121,4 @@ function run_request($host, $port, $uri='/ping', $query='') {
 	);
 	return $client->request($params, false)."\n";
 }
+/* }}} */
@@ -234,7 +234,7 @@ void phpdbg_list_function_byname(const char *str, size_t len) /* {{{ */

 zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	phpdbg_file_source data, *dataptr;
-	zend_file_handle fake = {{0}};
+	zend_file_handle fake;
 	zend_op_array *ret;
 	char *filename = (char *)(file->opened_path ? ZSTR_VAL(file->opened_path) : file->filename);
 	uint line;
@@ -253,11 +253,11 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	data.filename = filename;
 	data.line[0] = 0;

+	memset(&fake, 0, sizeof(fake));
 	fake.type = ZEND_HANDLE_MAPPED;
 	fake.handle.stream.mmap.buf = data.buf;
 	fake.handle.stream.mmap.len = data.len;
 	fake.free_filename = 0;
-	fake.opened_path = file->opened_path;
 	fake.filename = filename;
 	fake.opened_path = file->opened_path;
Author	SHA1	Message	Date
Anatol Belski	3183ece929	sync NEWS	2015-11-11 10:59:11 +01:00
Xinchen Hui	524d777188	Re-Fixed bug #70249 (Segmentation fault while running PHPUnit tests on phpBB 3.2-dev) Let's fixed this in the root instead	2015-11-11 10:58:36 +01:00
Reeze Xia	7beb0d449f	C99 complain fix	2015-11-11 10:56:56 +01:00
Dmitry Stogov	2f8b6ebddc	Fixed incorrect order of free/finally on exception	2015-11-10 12:09:45 +01:00
Dmitry Stogov	17d9bc9222	Added tests	2015-11-10 12:09:30 +01:00
Anatol Belski	bf9d2d47d8	additional catch to bug #70863	2015-11-10 00:47:55 +01:00
Xinchen Hui	78ccf76822	Fixed bug #70624 opcache.huge_code_pages	2015-11-08 09:49:19 +01:00
Colin O'Dell	88790a3607	Fix description of a BC break	2015-11-08 09:48:34 +01:00
Xinchen Hui	3b5d5caf14	manually apply the typo fix in master	2015-11-08 09:48:07 +01:00
Lynn	fbfc4e930d	rm duplicate include	2015-11-08 09:47:48 +01:00
James Titcumb	dc6b74ae2d	Fixed typo in reflection phpt	2015-11-08 09:47:26 +01:00
Nikita Popov	3c05c82a19	Fix various update_opN_const issues	2015-11-08 09:47:11 +01:00
Nikita Popov	788aaafaff	Refactor update_op2_const Combines both switches into one, to avoid having to maintain the same opcode list twice. This also makes most of the bugs fixed by the next commit pretty obvious. No functional change here.	2015-11-08 09:46:59 +01:00
Nikita Popov	e5072a7841	Don't propagate into ops that error on non-string To properly support this make update_opN_const fallible -- they are not always called through replace_with_const.	2015-11-08 09:45:00 +01:00
Nikita Popov	e4f7dd720e	Strip leading backslash in update_opN_const	2015-11-08 09:44:10 +01:00
Nikita Popov	45a9d15897	Fix update_opX_const lowercasing It was lowering in-place.	2015-11-08 09:43:57 +01:00
Xinchen Hui	40e5e54713	Use defined macro	2015-11-08 09:31:28 +01:00
Anatol Belski	33b9f70e95	sync NEWS	2015-11-08 09:29:10 +01:00
Felipe Pena	23e625b3ad	Fixed bug #70678 (PHP7 returns true when false is expected) Cherry-pick from master.	2015-11-08 09:27:41 +01:00
Anatol Belski	320afaee32	add missing news entry	2015-11-08 09:26:21 +01:00
Christopher Jones	9bc819d943	Fix bug 68298 (PHP OCI8 OCI int overflow) (Senthil)	2015-11-08 09:20:33 +01:00
Anatol Belski	3c8fac95b0	bump version	2015-11-08 07:17:22 +01:00
Anatol Belski	bf791f4744	sync NEWS	2015-11-08 06:37:27 +01:00
Xinchen Hui	10cd3b69f8	Fixed bug #70873 (Regression on private static properties access)	2015-11-08 06:36:40 +01:00
Anatol Belski	36e35b9a23	sync NEWS	2015-11-08 06:10:48 +01:00
Matteo Beccati	1522b898b0	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix bug #70875 Segmentation fault if wsdl has no targetNamespace attribute	2015-11-08 06:08:38 +01:00
Anatol Belski	769343d7be	sync NEWS	2015-11-08 06:07:11 +01:00
Xinchen Hui	1cada8e050	Fixed bug #70323 (Regression in zend_fetch_debug_backtrace() can cause segfaults)	2015-11-08 06:05:41 +01:00
Anatol Belski	94c9f54f16	sync NEWS	2015-11-08 05:14:18 +01:00
Caleb Champlin	5645bbb9db	Make sure context is set to null to prevent use after free	2015-11-08 05:13:31 +01:00
Anatol Belski	d61b7a6de4	sync NEWS	2015-11-08 04:37:22 +01:00
Xinchen Hui	22d3033ec6	Fixed bug #70876 (Segmentation fault when regenerating session id with strict mode)	2015-11-08 04:36:22 +01:00
Anatol Belski	7d398b1fa8	sync NEWS	2015-11-08 04:30:21 +01:00
Anatol Belski	da296e2cd0	fix decrement_function regarding bug #70863	2015-11-08 04:29:23 +01:00
Anatol Belski	68910e314f	Fixed bug #70863 Incorect logic to increment_function for proxy objects	2015-11-08 04:29:11 +01:00
Anatol Belski	4b48b29718	no more dev ZEND_VERSION	2015-11-08 04:28:50 +01:00
Anatol Belski	35746aba3e	sync NEWS	2015-11-08 04:28:14 +01:00
Xinchen Hui	3d8c4a37a5	Fixed bug #70868 (PCRE JIT and pattern reuse segfault)	2015-11-08 04:27:25 +01:00
Márcio Almada	973a64e17d	add failing test for bug #70868	2015-11-08 04:27:10 +01:00
Anatol Belski	c1119e31f7	sync NEWS	2015-11-08 04:26:40 +01:00
Anatol Belski	b6fc98b833	fix NULL deref in mbstring post handler	2015-11-08 04:24:40 +01:00
Anatol Belski	7554b10a77	fix NULL deref in pdo_firebird ref #70862	2015-11-08 04:24:29 +01:00
Anatol Belski	12208dc8fc	fix pdo_sqlite crash with empty bound stream	2015-11-08 04:24:16 +01:00
Anatol Belski	5fad120885	fix leak	2015-11-08 04:24:04 +01:00
Anatol Belski	682dae60dd	fix pdo_mysql crash with empty bound stream param rel #70862	2015-11-08 04:23:51 +01:00
Anatol Belski	75807f7b00	add test for bug #70861	2015-11-08 04:23:39 +01:00
Anatol Belski	7f3ba1fe6f	fix possible NULL deref in image functions	2015-11-08 04:23:26 +01:00
Anatol Belski	352117b728	fix crash in sqlite when executing with bound stream param rel #70862	2015-11-08 04:23:10 +01:00
Fabian Franz	3bdb7cf56c	Fix setting of empty string resource.	2015-11-08 04:22:51 +01:00
Anatol Belski	84abd7f7bd	update the actual sql parser file for #70861	2015-11-08 04:22:31 +01:00
Anatol Belski	602e57e1c6	Fix bug #70861 Segmentation fault in pdo_parse_params() during Drupal 8 test suite	2015-11-08 04:22:18 +01:00
Anatol Belski	40326fef9d	sync NEWS	2015-11-08 04:18:58 +01:00
Xinchen Hui	b48738f00b	Fixed bug #70853 (SplFixedArray throws exception when using ref variable as index)	2015-11-08 03:25:49 +01:00
Anatol Belski	aa5c9f932a	sync NEWS	2015-11-08 03:23:53 +01:00
Xinchen Hui	849ef6db44	Fixed bug #70843 (Segmentation fault on MacOSX with opcache.file_cache_only=1)	2015-11-08 03:21:35 +01:00
Anatol Belski	ee7e5533e8	sync NEWS	2015-11-08 02:55:51 +01:00
Xinchen Hui	46bb5a8cc9	Fixed bug #70805 (Segmentation faults whilst running Drupal 8 test suite)	2015-11-08 02:55:02 +01:00
Xinchen Hui	20b773438d	Fixed bug #70540 (sapi/fpm/tests/008.phpt and 016.phpt should be skipped on some platforms)	2015-11-08 02:54:24 +01:00
Xinchen Hui	ddda9b3455	Add test_fpm_conf to skip some tests ranth than mark --xfail--	2015-11-08 02:48:53 +01:00
Anatol Belski	589bd6bc6c	sync NEWS	2015-11-08 02:33:32 +01:00
Xinchen Hui	c600bdcb79	Fixed bug #70656 (require() statement broken after opcache_reset() or a few hours of use)	2015-11-08 02:32:58 +01:00
Dmitry Stogov	b29501f587	Fixed incomplete initialization.	2015-11-08 02:28:04 +01:00
Anatol Belski	17c1fe254c	sync NEWS	2015-11-08 02:22:12 +01:00
Xinchen Hui	51f9948b2b	Fixed bug #70808 (array_merge_recursive corrupts memory of unset items) I knew, this fix seems ugly	2015-11-08 02:17:20 +01:00