sync NEWS with entries and release date

apply missing patch for #72681
set version
2026-11-09 10:10:50 +00:00 · 2016-08-17 17:58:20 +02:00 · 2016-08-17 16:31:00 +02:00 · 2016-08-17 16:25:22 +02:00 · 2016-08-17 14:00:23 +02:00 · 2016-08-17 13:59:18 +02:00
1610 changed files with 25026 additions and 54086 deletions
@@ -1,57 +0,0 @@
-
-version: "{branch}.build.{build}"
-
-image: Visual Studio 2015
-
-branches:
-        except:
-                - PHP-5.6
-                - PHP-7.0
-
-skip_commits:
-        files:
-                - NEWS
-                - UPGRADING*
-                - README.*
-
-clone_depth: 64
-
-cache:
-        - c:\build-cache
-        - c:\build-cache\sdk -> .appveyor.yml
-
-environment:
-        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
-        PHP_BUILD_OBJ_DIR: c:\obj
-        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.4
-        # ext and env setup for tests
-        #MYSQL_TEST_PASSWD: Password12!
-        #MYSQL_TEST_USER: root
-        #PDO_MYSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=root password=Password12!"
-        #PDO_MYSQL_TEST_USER: root
-        #PDO_MYSQL_TEST_PASS: Password12!
-        #PGSQL_TEST_CONNSTR: "host=127.0.0.1 dbname=test port=5432 user=postgres password=Password12!"
-        #PDO_PGSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=postgres password=Password12!"
-        #build permutations
-        matrix:
-                - THREAD_SAFE: 0
-                  OPCACHE: 0
-                - THREAD_SAFE: 1
-                  OPCACHE: 1
-
-services:
-        # the setup scripts have to be touched, once some other db version is used
-        - mysql
-        - postgresql96
-
-platform:
-        - x64
-          #        - x86
-
-build_script:
-        - appveyor\build.bat
-
-test_script:
-        - appveyor\test.bat
-
@@ -1,16 +0,0 @@
-; http://editorconfig.org/
-
-root = true
-
-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
-indent_size              = 4
-indent_style             = tab
-insert_final_newline     = true
-tab_width                = 4
-trim_trailing_whitespace = true
-
-[*.yml]
-indent_size              = 2
-indent_style             = space
@@ -29,33 +29,22 @@ document ____executor_globals
 end

 define print_cvs
-	if $argc == 0
-		____executor_globals
-		set $cv_ex_ptr = $eg.current_execute_data
-	else
-		set $cv_ex_ptr = (zend_execute_data *)$arg0
+	____executor_globals
+	set $p = $eg.current_execute_data.CVs
+	set $c = $eg.current_execute_data.op_array.last_var
+	set $v = $eg.current_execute_data.op_array.vars
+	set $i = 0
+
+	printf "Compiled variables count: %d\n", $c
+	while $i < $c
+		printf "%d = %s\n", $i, $v[$i].name
+		if $p[$i] != 0
+			printzv *$p[$i]
+		else
+			printf "*uninitialized*\n"
+		end
+		set $i = $i + 1
 	end
-	set $cv_count = $cv_ex_ptr.func.op_array.last_var
-	set $cv = $cv_ex_ptr.func.op_array.vars
-	set $cv_idx = 0
-	set $callFrameSize = (sizeof(zend_execute_data) + sizeof(zval) - 1) / sizeof(zval)
-
-	printf "Compiled variables count: %d\n\n", $cv_count
-	while $cv_idx < $cv_count
-		printf "[%d] '%s'\n", $cv_idx, $cv[$cv_idx].val
-		set $zvalue = ((zval *) $cv_ex_ptr) + $callFrameSize + $cv_idx
-		printzv $zvalue
-		set $cv_idx = $cv_idx + 1
-	end
-end
-
-document print_cvs
-	Prints the compiled variables and their values.
-	If a zend_execute_data pointer is set this will print the compiled
-	variables of that scope. If no parameter is used it will use
-	current_execute_data for scope.
-
-	usage: print_cvs [zend_execute_data *]
 end

 define dump_bt
@@ -207,17 +196,12 @@ define ____printzv_contents
 		____executor_globals
 		set $handle = $zvalue->value.obj.handle
 		set $handlers = $zvalue->value.obj.handlers
-		set $zobj = $zvalue->value.obj
-		set $cname = $zobj->ce->name->val
+        set $zobj = $zvalue->value.obj
+        set $cname = $zobj->ce->name->val
 		printf "(%s) #%d", $cname, $handle
 		if ! $arg1
 			if $handlers->get_properties == &zend_std_get_properties
-				if $zobj->properties
-					set $ht = $zobj->properties
-				else
-					set $ht = &$zobj->ce->properties_info
-				end
-				printf "\nProperties "
+				set $ht = $zobj->properties
 				if $ht
 					set $ind = $ind + 1
 					____print_ht $ht 1
@@ -228,7 +212,7 @@ define ____printzv_contents
 						set $i = $i - 1
 					end
 				else
-					echo "not found"
+					echo "no properties found"
 				end
 			end
 		end
@@ -471,9 +455,9 @@ define print_inh
 end

 define print_pi
-	set $pi = (zend_property_info *)$arg0
+	set $pi = $arg0
 	printf "[%p] {\n", $pi
-	printf "    ce = [%p] %s\n", $pi->ce, $pi->ce->name->val
+	printf "    h     = %lu\n", $pi->h
 	printf "    flags = %d (", $pi->flags
 	if $pi->flags & 0x100
 		printf "ZEND_ACC_PUBLIC"
@@ -492,27 +476,16 @@ define print_pi
 	end
 	printf ")\n"
 	printf "    name  = "
-	print_zstr $pi->name
-	printf "}\n"
-end
-
-document print_pi
-	Takes a pointer to an object's property and prints the property information
-	usage: print_pi <ptr>
+	____print_str $pi->name $pi->name_length
+	printf "\n}\n"
 end

 define ____print_str
 	set $tmp = 0
 	set $str = $arg0
-	if $argc > 2
-		set $maxlen = $arg2
-	else
-		set $maxlen = 256
-	end
-
 	printf "\""
-	while $tmp < $arg1 && $tmp < $maxlen
-		if $str[$tmp] > 31 && $str[$tmp] < 127
+	while $tmp < $arg1 && $tmp < 256
+		if $str[$tmp] > 32 && $str[$tmp] < 127
 			printf "%c", $str[$tmp]
 		else
 			printf "\\%o", $str[$tmp]
@@ -581,23 +554,6 @@ document printzops
 	dump operands of the current opline
 end

-define print_zstr
-	set $zstr = (zend_string *)$arg0
-	if $argc == 2
-		set $maxlen = $arg1
-	else
-		set $maxlen = $zstr->len
-	end
-	printf "string(%d) ", $zstr->len
-	____print_str $zstr->val $zstr->len $maxlen
-	printf "\n"
-end
-
-document print_zstr
-	print the length and contents of a zend string
-	usage: print_zstr <ptr> [max length]
-end
-
 define zbacktrace
 	____executor_globals
 	dump_bt $eg.current_execute_data
@@ -610,6 +566,79 @@ document zbacktrace
 	> (gdb) dump_bt $eg.current_execute_data
 end

+define zmemcheck
+	set $p = alloc_globals.head
+	set $stat = "?"
+	set $total_size = 0
+	if $arg0 != 0
+		set $not_found = 1
+	else
+		set $not_found = 0
+	end
+	printf " block      size      status file:line\n"
+	printf "-------------------------------------------------------------------------------\n"
+	while $p
+		set $aptr = $p + sizeof(struct _zend_mem_header) + sizeof(align_test)
+		if $arg0 == 0 || (void *)$aptr == (void *)$arg0
+			if $p->magic == 0x7312f8dc 
+				set $stat = "OK"
+			end
+			if $p->magic == 0x99954317
+				set $stat = "FREED"
+			end
+			if $p->magic == 0xfb8277dc
+				set $stat = "CACHED"
+			end
+			set $filename = strrchr($p->filename->val, '/')
+			if !$filename
+				set $filename = $p->filename->val
+			else
+				set $filename = $filename + 1
+			end
+			printf " %p ", $aptr
+			if $p->size == sizeof(struct _zval_struct) && ((struct _zval_struct *)$aptr)->type >= 0 && ((struct _zval_struct *)$aptr)->type < 10
+				printf "ZVAL?(%-2d) ", $p->size
+			else
+				printf "%-9d ", $p->size
+			end
+			set $total_size = $total_size + $p->size
+			printf "%-06s %s:%d", $stat, $filename, $p->lineno
+			if $p->orig_filename
+				set $orig_filename = strrchr($p->orig_filename, '/')
+				if !$orig_filename
+					set $orig_filename = $p->orig_filename
+				else
+					set $orig_filename = $orig_filename + 1
+				end
+				printf " <= %s:%d\n", $orig_filename, $p->orig_lineno
+			else
+				printf "\n"
+			end
+			if $arg0 != 0
+				set $p = 0
+				set $not_found = 0
+			else
+				set $p = $p->pNext
+			end
+		else
+			set $p = $p->pNext
+		end
+	end
+	if $not_found
+		printf "no such block that begins at %p.\n", $aptr
+	end
+	if $arg0 == 0
+		printf "-------------------------------------------------------------------------------\n"
+		printf "     total: %d bytes\n", $total_size
+	end
+end
+
+document zmemcheck
+	show status of a memory block.
+	usage: zmemcheck [ptr].
+	if ptr is 0, all blocks will be listed.
+end
+
 define lookup_root
 	set $found = 0
 	if gc_globals->roots
@@ -148,7 +148,6 @@ tests/*/*/*.sh
 */tests/*/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
-*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log
@@ -108,8 +108,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
-MAINTENANCE:         Maintained
+PRIMARY MAINTAINER:  Unknown
+MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -132,7 +132,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
+PRIMARY MAINTAINER:  Unknown
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
@@ -286,7 +286,7 @@ MAINTENANCE:         Odd fixes
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           gd
-PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>, Christoph M. Becker <cmb@php.net>
+PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -1,6 +1,6 @@
 -------------------------------------------------------------------- 
                  The PHP License, version 3.01
-Copyright (c) 1999 - 2017 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2016 The PHP Group. All rights reserved.
 -------------------------------------------------------------------- 

 Redistribution and use in source and binary forms, with or without
@@ -53,7 +53,7 @@ install-headers:
 			paths="$$paths $(INSTALL_ROOT)$(phpincludedir)/$$i"; \
 		done; \
 		$(mkinstalldirs) $$paths && \
-		echo "Installing header files:          $(INSTALL_ROOT)$(phpincludedir)/" && \
+		echo "Installing header files:           $(INSTALL_ROOT)$(phpincludedir)/" && \
 		for i in `echo $(INSTALL_HEADERS)`; do \
 			if test "$(PHP_PECL_EXTENSION)"; then \
 				src=`echo $$i | $(SED) -e "s#ext/$(PHP_PECL_EXTENSION)/##g"`; \
@@ -1,771 +1,5 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-8 Jun 2017 PHP 7.0.20
-
- Core:
-  . Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
-    (Laruence)
-  . Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
-    (Laruence)
-
- intl:
-  . Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys). (villfa)
-
- MySQLi:
-  . Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database
-    argument w/strict_types). (Anatol)
-
- Opcache:
-  . Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled). (Laruence)
-
- phar:
-  . Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT
-    and DELETE method). (Christian Weiske)
-
- Standard:
-  . Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
-    (Damian Wadley, Anatol)
-
- xmlreader:
-  . Fixed bug #74457 (Wrong reflection on XMLReader::expand). (villfa)
-
-11 May 2017 PHP 7.0.19
-
- Core:
-  . Fixed bug #74188 (Null coalescing operator fails for undeclared static
-    class properties). (tpunt)
-  . Fixed bug #74408 (Endless loop bypassing execution time limit). (Laruence)
-  . Fixed bug #74410 (stream_select() is broken on Windows Nanoserver).
-    (Matt Ficken)
-  . Fixed bug #74337 (php-cgi.exe crash on facebook callback).
-    (Anton Serbulov)
-  . Patch for bug #74216 was reverted. (Anatol)
-
- Date:
-  . Fixed bug #74404 (Wrong reflection on DateTimeZone::getTransitions).
-    (krakjoe)
-  . Fixed bug #74080 (add constant for RFC7231 format datetime). (duncan3dc)
-
- DOM:
-  . Fixed bug #74416 (Wrong reflection on DOMNode::cloneNode).
-    (Remi, Fabien Villepinte)
-
- Fileinfo:
-  . Fixed bug #74379 (syntax error compile error in libmagic/apprentice.c).
-    (Laruence)
-
- GD:
-  . Fixed bug #74343 (compile fails on solaris 11 with system gd2 library).
-    (krakjoe)
-
- intl:
-  . Fixed bug #74433 (wrong reflection for Normalizer methods). (villfa)
-  . Fixed bug #74439 (wrong reflection for Locale methods). (villfa)
-
- MySQLi:
-  . Fixed bug #74432 (mysqli_connect adding ":3306" to $host if $port parameter
-    not given). (Anatol)
-
- MySQLnd:
-  . Added support for MySQL 8.0 types. (Johannes)
-  . Fixed bug #74376 (Invalid free of persistent results on error/connection
-    loss). (Yussuf Khalil)
-
- OpenSSL:
-  . Fixed bug #73833 (null character not allowed in openssl_pkey_get_private).
-    (Jakub Zelenka)
-  . Fixed bug #73711 (Segfault in openssl_pkey_new when generating DSA or DH
-    key). (Jakub Zelenka)
-  . Fixed bug #74341 (openssl_x509_parse fails to parse ASN.1 UTCTime without
-    seconds). (Moritz Fain)
-  . Added OpenSSL 1.1.0 support. (Jakub Zelenka)
-
- phar:
-  . Fixed bug #74383 (phar method parameters reflection correction). 
-    (mhagstrand)
-
- Standard:
-  . Fixed bug #74409 (Reflection information for ini_get_all() is incomplete).
-    (Sebastian Bergmann)
-  . Fixed bug #72071 (setcookie allows max-age to be negative). (Craig Duncan)
-
- Streams:
-  . Fixed bug #74429 (Remote socket URI with unique persistence identifier
-    broken). (Sara)
-
- SQLite3:
-  . Fixed bug #74413 (incorrect reflection for SQLite3::enableExceptions).
-    (krakjoe)
-
-13 Apr 2017 PHP 7.0.18
-
- Core:
-  . Fixed bug #73370 (falsely exits with "Out of Memory" when using
-    USE_ZEND_ALLOC=0). (Nikita)
-  . Fixed bug #73960 (Leak with instance method calling static method with
-    referenced return). (Nikita)
-  . Fixed bug #74265 (Build problems after 7.0.17 release: undefined reference
-    to `isfinite'). (Nikita)
-  . Fixed bug #74302 (yield fromLABEL is over-greedy). (Sara)
-
- Apache:
-  . Reverted patch for bug #61471, fixes bug #74318. (Anatol)
-
- Date:
-  . Fixed bug #72096 (Swatch time value incorrect for dates before 1970). (mcq8)
-
- DOM:
-  . Fixed bug #74004 (LIBXML_NOWARNING flag ingnored on loadHTML*).
-    (somedaysummer)
-
- iconv:
-  . Fixed bug #74230 (iconv fails to fail on surrogates). (Anatol)
-
- OCI8:
-  . Fixed uninitialized data causing random crash. (Dmitry)
-
- OpenSSL:
-  . Fixed bug #72333 (fwrite() on non-blocking SSL sockets doesn't work).
-    (Jakub Zelenka)
-
- PDO MySQL:
-  . Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO
-    interface). (Thomas Orozco)
-
- Streams:
-  . Fixed bug #74216 (Correctly fail on invalid IP address ports). (Sara)
-
- Zlib:
-  . Fixed bug #74240 (deflate_add can allocate too much memory). (Matt Bonneau)
-
-16 Mar 2017 PHP 7.0.17
-
- Core:
-  . Fixed bug #73989 (PHP 7.1 Segfaults within Symfony test suite).
-    (Dmitry, Laruence)
-  . Fixed bug #74084 (Out of bound read - zend_mm_alloc_small). (Laruence)
-  . Fixed bug #73807 (Performance problem with processing large post request).
-    (Nikita)
-  . Fixed bug #73998 (array_key_exists fails on arrays created by
-    get_object_vars). (mhagstrand)
-  . Fixed bug #73954 (NAN check fails on Alpine Linux with musl). (Andrea)
-  . Fixed bug #74039 (is_infinite(-INF) returns false). (Christian Schmidt)
-  . Fixed bug #73677 (Generating phar.phar core dump with gcc ASAN enabled
-    build). (ondrej)
-
- Apache:
-  . Fixed bug #61471 (Incomplete POST does not timeout but is passed to PHP).
-    (Zheng Shao)
-
- Date:
-  . Fixed bug #72719 (Relative datetime format ignores weekday on sundays
-    only). (Derick)
-  . Fixed bug #73294 (DateTime wrong when date string is negative). (Derick)
-  . Fixed bug #73489 (wrong timestamp when call setTimeZone multi times with
-    UTC offset). (xiami, Derick)
-  . Fixed bug #73858 (first/last day of' flag is not being reset). (Derick)
-  . Fixed bug #73942 ($date->modify('Friday this week') doesn't return a Friday
-    if $date is a Sunday). (Derick)
-  . Fixed bug #74057 (wrong day when using "this week" in strtotime). (Derick)
-
- FPM:
-  . Fixed bug #69860 (php-fpm process accounting is broken with keepalive).
-    (Denis Yeldandi)
-
- Hash:
-  . Fixed bug #73127 (gost-crypto hash incorrect if input data contains long
-    0xFF sequence). (Grundik)
-
- GD:
-  . Fixed bug #74031 (ReflectionFunction for imagepng is missing last two
-    parameters). (finwe)
-
- Mysqlnd:
-  . Fixed bug #74021 (fetch_array broken data. Data more then MEDIUMBLOB).
-    (Andrew Nester, Nikita)
-
- Opcache:
-  . Fixed bug #74152 (if statement says true to a null variable). (Laruence)
-  . Fixed bug #74019 (Segfault with list). (Laruence)
-
- OpenSSL:
-  . Fixed bug #74022 (PHP Fast CGI crashes when reading from a pfx file).
-    (Anatol)
-
- PDO_OCI:
-  . Fixed bug #54379 (PDO_OCI: UTF-8 output gets truncated). (gureedo / Oracle)
-
- Standard:
-  . Fixed bug #74148 (ReflectionFunction incorrectly reports the number of
-    arguments). (Laruence)
-  . Fixed bug #74005 (mail.add_x_header causes RFC-breaking lone line feed).
-    (Anatol)
-  . Fixed bug #73118 (is_callable callable name reports misleading value for
-    anonymous classes). (Adam Saponara)
-  . Fixed bug #74105 (PHP on Linux should use /dev/urandom when getrandom is
-    not available). (Benjamin Robin)
-
- Streams:
-  . Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
-    (Laruence)
-  . Fixed bug #74090 (stream_get_contents maxlength>-1 returns empty string).
-    (Anatol)
-
-
-16 Feb 2017 PHP 7.0.16
-
- Core:
-  . Fixed bug #73916 (zend_print_flat_zval_r doesn't consider reference).
-    (Laruence)
-  . Fixed bug #73876 (Crash when exporting **= in expansion of assign op).
-    (Sara)
-  . Fixed bug #73969 (segfault in debug_print_backtrace). (andrewnester)
-  . Fixed bug #73973 (assertion error in debug_zval_dump). (andrewnester)
-
- DOM:
-  . Fixed bug #54382 (getAttributeNodeNS doesn't get xmlns* attributes).
-    (aboks)
-
- DTrace:
-  . Fixed bug #73965 (DTrace reported as enabled when disabled). (Remi)
-
- FPM:
-  . Fixed bug #67583 (double fastcgi_end_request on max_children limit).
-    (Dmitry Saprykin)
-  . Fixed bug #69865 (php-fpm does not close stderr when using syslog). 
-    (m6w6)
-
- GD:
-  . Fixed bug #73968 (Premature failing of XBM reading). (cmb)
-
- GMP:
-  . Fixed bug #69993 (test for gmp.h needs to test machine includes).
-    (Jordan Gigov) 
-
- Intl:
-  . Fix bug #73956 (Link use CC instead of CXX). (Remi)
-
- LDAP:
-  . Fixed bug #73933 (error/segfault with ldap_mod_replace and opcache).
-    (Laruence)
-
- MySQLi:
-  . Fixed bug #73949 (leak in mysqli_fetch_object). (krakjoe)
-
- Mysqlnd:
-  . Fixed bug #69899 (segfault on close() after free_result() with mysqlnd).
-    (Richard Fussenegger)
-
- Opcache:
-  . Fixed bug #73983 (crash on finish work with phar in cli + opcache).
-    (Anatol)
-
- OpenSSL:
-  . Fixed bug #71519 (add serial hex to return value array). (xrobau)
-
- PDO_Firebird:
-  . Implemented FR #72583 (All data are fetched as strings). (Dorin Marcoci)
-
- PDO_PgSQL:
-  . Fixed bug #73959 (lastInsertId fails to throw an exception for wrong 
-    sequence name). (andrewnester)
-
- Phar:
-  . Fixed bug #70417 (PharData::compress() doesn't close temp file). (cmb)
-
- posix:
-  . Fixed bug #71219 (configure script incorrectly checks for ttyname_r). (atoth)
-
- Session:
-  . Fixed bug #69582 (session not readable by root in CLI). (EvgeniySpinov)
-
- SPL:
-  . Fixed bug #73896 (spl_autoload() crashes when calls magic _call()). (Dmitry)
-
- Standard:
-  . Fixed bug #69442 (closing of fd incorrect when PTS enabled). (jaytaph)
-  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
-    "Transfer-Encoding: chunked"). (Rowan Collins)
-  . Fixed bug #72974 (imap is undefined service on AIX). (matthieu.sarter)
-  . Fixed bug #72979 (money_format stores wrong length AIX). (matthieu.sarter)
-
- ZIP:
-  . Fixed bug #70103 (ZipArchive::addGlob ignores remove_all_path option). (cmb,
-    Mitch Hagstrand)
-
-19 Jan 2017 PHP 7.0.15
-
- Core:
-  . Fixed bug #73792 (invalid foreach loop hangs script). (Dmitry)
-  . Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created
-    with list()). (Laruence)
-  . Fixed bug #73585 (Logging of "Internal Zend error - Missing class
-    information" missing class name). (Laruence)
-  . Fixed bug #73753 (unserialized array pointer not advancing). (David Walker)
-  . Fixed bug #73825 (Heap out of bounds read on unserialize in
-    finish_nested_data()). (Stas)
-  . Fixed bug #73831 (NULL Pointer Dereference while unserialize php object).
-    (Stas)
-  . Fixed bug #73832 (Use of uninitialized memory in unserialize()). (Stas)
-  . Fixed bug #73092 (Unserialize use-after-free when resizing object's
-    properties hash table). (Nikita)
-  . Fixed bug #69425 (Use After Free in unserialize()). (Nikita)
-  . Fixed bug #72731 (Type Confusion in Object Deserialization). (Nikita)
-
- COM:
-  . Fixed bug #73679 (DOTNET read access violation using invalid codepage).
-    (Anatol)
-
- DOM:
-  . Fixed bug #67474 (getElementsByTagNameNS filter on default ns). (aboks)
-
- EXIF:
-  . Bug bug #73737 (FPE when parsing a tag format). (Stas)
-
- GD:
-  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
-  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
-
- GMP:
-  . Fixed bug #70513 (GMP Deserialization Type Confusion Vulnerability).
-    (Nikita)
-
- Mysqli:
-  . Fixed bug #73462 (Persistent connections don't set $connect_errno).
-    (darkain)
-
- Mysqlnd:
-  . Fixed issue with decoding BIT columns when having more than one rows in the
-    result set. 7.0+ problem. (Andrey)
-  . Fixed bug #73800 (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE). 
-	(vanviegen)
-
- PCRE:
-  . Fixed bug #73612 (preg_*() may leak memory). (cmb)
-
- PDO_Firebird:
-  . Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning
-    statement). (Dorin Marcoci)
-
- Phar:
-  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
-  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
-  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
-
- Phpdbg:
-  . Fixed bug #73615 (phpdbg without option never load .phpdbginit at startup).
-    (Bob)
-  . Fixed issue getting executable lines from custom wrappers. (Bob)
-  . Fixed bug #73704 (phpdbg shows the wrong line in files with shebang). (Bob)
-
- Reflection:
-  . Fixed bug #46103 (ReflectionObject memory leak). (Nikita)
-
- Streams:
-  . Fixed bug #73586 (php_user_filter::$stream is not set to the stream the
-    filter is working on). (Dmitry)
-
- SQLite3:
-  . Reverted fix for bug #73530	(Unsetting result set may reset other result
-    set). (cmb)
-
- Standard:
-  . Fixed bug #73594 (dns_get_record does not populate $additional out
-    parameter). (Bruce Weirdan)
-  . Fixed bug #70213 (Unserialize context shared on double class lookup).
-    (Taoguang Chen)
-  . Fixed bug #73154 (serialize object with __sleep function crash). (Nikita)
-  . Fixed bug #70490 (get_browser function is very slow). (Nikita)
-  . Fixed bug #73265 (Loading browscap.ini at startup causes high memory usage).
-    (Nikita)
-  . Fixed bug #31875 (get_defined_functions additional param to exclude
-	disabled functions). (willianveiga)
-
- Zlib:
-  . Fixed bug #73373 (deflate_add does not verify that output was not truncated).
-    (Matt Bonneau)
-
-08 Dec 2016 PHP 7.0.14
-
- Core:
-  . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre)
-  . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli
-    / PDO). (Dmitry)
-
- Calendar:
-  . Fix integer overflows (Joshua Rogers)
-
- Date:
-  . Fixed bug #69587 (DateInterval properties and isset). (jhdxr)
-
- DTrace:
-  . Disabled PHP call tracing by default (it makes significant overhead).
-    This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
-    (Dmitry)
-
- JSON:
-  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
-
- Mysqlnd:
-  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
-
- ODBC:
-  . Fixed bug #73448 (odbc_errormsg returns trash, always 513 bytes).
-    (Anatol)
-
- Opcache:
-  . Fixed bug #69090 (check cached files permissions). (dmitry)
-  . Fixed bug #73546 (Logging for opcache has an empty file name). (mhagstrand)
-
- PCRE:
-  . Fixed bug #73483 (Segmentation fault on pcre_replace_callback). (Laruence)
-  . Fixed bug #73392 (A use-after-free in zend allocator management). 
-    (Laruence)
-
- PDO_Firebird:
-  . Fixed bug #73087, #61183, #71494 (Memory corruption in bindParam).
-    (Dorin Marcoci)
-
- Postgres:
-  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
-
- Phar:
-  . Fixed bug #73580 (Phar::isValidPharFilename illegal memory access). (Stas)
-
- Soap:
-  . Fixed bug #73538 (SoapClient::__setSoapHeaders doesn't overwrite SOAP
-    headers). (duncan3dc)
-  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
-
- SPL:
-  . Fixed bug #73423 (Reproducible crash with GDB backtrace). (Laruence)
-
- SQLite3:
-  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
-
- Standard:
-  . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
-    (rowan dot collins at gmail dot com)
-  . Fixed bug #73645 (version_compare illegal write access). (Stas)
-
- Wddx:
-  . Fixed bug #73631 (Invalid read when wddx decodes empty boolean element).
-  (Stas)
-
- XML:
-  . Fixed bug #72135 (malformed XML causes fault) (edgarsandi)
-
-10 Nov 2016 PHP 7.0.13
-
- Core:
-  . Fixed bug #73350 (Exception::__toString() cause circular references).
-    (Laruence)
-  . Fixed bug #73181 (parse_str() without a second argument leads to crash).
-    (Nikita)
-  . Fixed bug #66773 (Autoload with Opcache allows importing conflicting class
-    name to namespace). (Nikita)
-  . Fixed bug #66862 ((Sub-)Namespaces unexpected behaviour). (Nikita)
-  . Fix pthreads detection when cross-compiling (ffontaine)
-  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
-    operation). (Dmitry)
-  . Fixed bug #73338 (Exception thrown from error handler causes valgrind
-    warnings (and crashes)). (Bob, Dmitry)
-  . Fixed bug #73329 ((Float)"Nano" == NAN). (Anatol)
-
- GD:
-  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
-  . Fixed bug #73272 (imagescale() is not affected by, but affects
-    imagesetinterpolation()). (cmb)
-  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
-  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
-  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
-    overflow). (cmb)
-  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
-    (cmb)
-
- IMAP:
-  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
-    (Anatol)
-
- OCI8
-  . Fixed bug #71148 (Bind reference overwritten on PHP 7). (Oracle Corp.)
-
- phpdbg:
-  . Properly allow for stdin input from a file. (Bob)
-  . Add -s command line option / stdin command for reading script from stdin.
-    (Bob)
-  . Ignore non-executable opcodes in line mode of phpdbg_end_oplog(). (Bob)
-  . Fixed bug #70776 (Simple SIGINT does not have any effect with -rr). (Bob)
-  . Fixed bug #71234 (INI files are loaded even invoked as -n --version). (Bob)
-
- Session:
-  . Fixed bug #73273 (session_unset() empties values from all variables in which
-    is $_session stored). (Nikita)
-
- SOAP:
-  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
-  . Fixed bug #73237 (Nested object in "any" element overwrites other fields).
-    (Keith Smiley)
-  . Fixed bug #69137 (Peer verification fails when using a proxy with SoapClient)
-    (Keith Smiley)
-
- SQLite3:
-  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
-
- Standard:
-  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
-  . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
-    (adsr)
-  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
-
- Wddx:
-  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
-    with PDORow). (Stas)
-
-13 Oct 2016 PHP 7.0.12
-
- Core:
-  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
-    zend_virtual_cwd.c). (cmb)
-  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
-    password_verify). (Anatol)
-  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
-  . Fixed bug #69579 (Invalid free in extension trait). (John Boehr)
-  . Fixed bug #73156 (segfault on undefined function). (Dmitry)
-  . Fixed bug #73163 (PHP hangs if error handler throws while accessing undef
-    const in default value). (Nikita)
-  . Fixed bug #73172 (parse error: Invalid numeric literal). (Nikita, Anatol)
-  . Fixed for #73240 (Write out of bounds at number_format). (Stas)
-  . Fixed bug #73147 (Use After Free in PHP7 unserialize()). (Stas)
-  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
-
- BCmath:
-  . Fix bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
-
- COM:
-  . Fixed bug #73126 (Cannot pass parameter 1 by reference). (Anatol)
-
- Date:
-  . Fixed bug #73091 (Unserializing DateInterval object may lead to __toString
-    invocation). (Stas)
-
- DOM:
-  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
-
- Filter:
-  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
-    FILTER_FLAG_NO_PRIV_RANGE). (julien)
-  . Fixed bug #73054 (default option ignored when object passed to int filter).
-    (cmb)
-
- GD:
-  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
-    (cmb)
-  . Fixed bug #50194 (imagettftext broken on transparent background w/o
-    alphablending). (cmb)
-  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
-    cmb)
-  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
-    (Mark Plomer, cmb)
-  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
-  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
-  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
-    files). (cmb)
-  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
-
- Intl:
-  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
-
- Mbstring:
-  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
-  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion) (Yasuo)
-  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
-    (Yasuo)
-
- Mysqlnd:
-  . Fixed bug #72489 (PHP Crashes When Modifying Array Containing MySQLi Result
-    Data). (Nikita)
-
- Opcache:
-  . Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp()
-    function). (Laruence)
-
- OpenSSL:
-  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
-    (Jakub Zelenka)
-  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)
-  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
-
- PCRE:
-  . Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported
-    on s390). (Anatol)
-  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)
-
- PDO_DBlib:
-  . Fixed bug #72414 (Never quote values as raw binary data). (Adam Baratz)
-  . Allow \PDO::setAttribute() to set query timeouts. (Adam Baratz)
-  . Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
-    (Adam Baratz)
-  . Add common PDO test suite. (Adam Baratz)
-  . Free error and message strings when cleaning up PDO instances.
-    (Adam Baratz)
-  . Fixed bug #67130 (\PDOStatement::nextRowset() should succeed when all rows
-    in current rowset haven't been fetched). (Peter LeBrun)
-  . Ignore potentially misleading dberr values. (Chris Kings-Lynne)
-
- phpdbg:
-  . Fixed bug #72996 (phpdbg_prompt.c undefined reference to DL_LOAD). (Nikita)
-  . Fixed next command not stopping when leaving function. (Bob)
-
- Session:
-  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
-    (Yasuo)
-  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
-    (cmb)
-
- SimpleXML:
-  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
-    (Stas)
-
- SOAP:
-  . Fixed bug #71711 (Soap Server Member variables reference bug). (Nikita)
-  . Fixed bug #71996 (Using references in arrays doesn't work like expected).
-    (Nikita)
-
- SPL:
-  . Fixed bug #73257, #73258 (SplObjectStorage unserialize allows use of
-    non-object as key). (Stas)
-
- SQLite3:
-  . Updated bundled SQLite3 to 3.14.2. (cmb)
-
- Zip:
-  . Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
-    (cmb)
-
-15 Sep 2016 PHP 7.0.11
-
- Core:
-  . Fixed bug #72944 (Null pointer deref in zval_delref_p). (Dmitry)
-  . Fixed bug #72943 (assign_dim on string doesn't reset hval). (Laruence)
-  . Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper). (Laruence)
-  . Fixed bug #72813 (Segfault with __get returned by ref). (Laruence)
-  . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
-    (Nikita)
-  . Fixed bug #72854 (PHP Crashes on duplicate destructor call). (Nikita)
-  . Fixed bug #72857 (stream_socket_recvfrom read access violation). (Anatol)
-
- COM:
-  . Fixed bug #72922 (COM called from PHP does not return out parameters).
-    (Anatol)
-
- Dba:
-  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
-    (cmb)
-
- FTP:
-  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
-    require_ssl_reuse). (Benedict Singer)
-
- GD:
-  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
-  . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
-    images). (cmb)
-  . Fixed bug #72913 (imagecopy() loses single-color transparency on palette
-    images). (cmb)
-  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)
-
- iconv:
-  . Fixed bug #72320 (iconv_substr returns false for empty strings). (cmb)
-
- IMAP:
-  . Fixed bug #72852 (imap_mail null dereference). (Anatol)
-
- Intl:
-  . Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF
-    sequence). (cmb)
-  . Fixed bug #73007 (add locale length check). (Stas)
-
- Mysqlnd:
-  . Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)
-
- OCI8
-  . Fixed invalid handle error with Implicit Result Sets. (Chris Jones)
-  . Fixed bug #72524 (Binding null values triggers ORA-24816 error). (Chris Jones)
-
- Opcache:
-  . Fixed bug #72949 (Typo in opcache error message). (cmb)
-
- PDO:
-  . Fixed bug #72788 (Invalid memory access when using persistent PDO
-    connection). (Keyur)
-  . Fixed bug #72791 (Memory leak in PDO persistent connection handling). (Keyur)
-  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
-    returns false). (cmb)
-
- PDO_DBlib:
-  . Implemented stringify 'uniqueidentifier' fields.
-    (Alexander Zhuravlev, Adam Baratz)
-
- PDO_pgsql:
-  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
-    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
-  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)
-
- Phar:
-  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
-    phar_parse_zipfile). (Stas)
-  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
-    phar_parse_tarfile). (Stas)
-
- Reflection:
-  . Fixed bug #72846 (getConstant for a array constant with constant values
-    returns NULL/NFC/UKNOWN). (Laruence)
-
- Session:
-  . Fixed bug #72724 (PHP7: session-uploadprogress kills httpd). (Nikita)
-  . Fixed bug #72940 (SID always return "name=ID", even if session
-    cookie exist). (Yasuo)
-
- SimpleXML:
-  . Fixed bug #72971 (SimpleXML isset/unset do not respect namespace). (Nikita)
-  . Fixed bug #72957 (Null coalescing operator doesn't behave as expected with
-    SimpleXMLElement). (Nikita)
-
- SPL:
-  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)
-
- Standard:
-  . Fixed bug #55451 (substr_compare NULL length interpreted as 0). (Lauri
-    Kenttä)
-  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
-  . Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
-    (cmb)
-
- Streams:
-  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)
-  . Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails
-    with IIS FTP 7.5, 8.5). (vhuk)
-  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
-    (cmb)
-
- SQLite3:
-  . Downgraded bundled SQLite to 3.8.10.2. (Anatol);
-
- Sysvshm:
-  . Fixed bug #72858 (shm_attach null dereference). (Anatol)
-
- XML:
-  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
-  . Fixed bug #72714 (_xml_startElementHandler() segmentation fault). (cmb)
-
- Wddx:
-  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
-  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)
-
- ZIP:
-  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
-
 18 Aug 2016 PHP 7.0.10

 - Core:
@@ -789,13 +23,11 @@ PHP                                                                        NEWS
  . Fixed potential segfault in object storage freeing in shutdown sequence.
    (Bob)
  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
-   __wakeup() in Deserialization). (Stas)
+      __wakeup() in Deserialization). (Stas)
  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)
  . Fixed bug #72683 (getmxrr broken). (Anatol)
  . Fixed bug #72742 (memory allocator fails to realloc small block to large
    one). (Stas)
-  . Fixed URL rewriter partially. It would not rewrite '//example.com/' URL
-    unconditionally. Only requested host(HTTP_HOST) is rewritten. (Yasuo)

 - Bz2:
  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
@@ -841,8 +73,6 @@ PHP                                                                        NEWS
  . Fixed bug #68712 (suspicious if-else statements). (cmb)
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
-  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
-    cmb)

 - Intl:
  . Fixed bug #72639 (Segfault when instantiating class that extends
@@ -2064,8 +1294,6 @@ PHP                                                                        NEWS

 - Filter:
  . New FILTER_VALIDATE_DOMAIN and better RFC conformance for FILTER_VALIDATE_URL. (Kevin Dunglas)
-  . Fixed bug #67167 (Wrong return value from FILTER_VALIDATE_BOOLEAN,
-    FILTER_NULL_ON_FAILURE). (levim)

 - FPM:
  . Fixed bug #70538 ("php-fpm -i" crashes). (rainer dot jung at
@@ -93,27 +93,24 @@ Commit the changes to the main branch.
 12. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure
 and build three tarballs (gz, bz2 and xz).

-13. run ``scripts/dev/gen_verify_stub <version> [identity]``, this will sign the tarballs
-and output verification information to be included in announcement email
-
-14. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
+13. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
 directory "downloads/". Copy them into there, so that the system can generate
 MD5 sums. If you do not have this directory, talk to Derick or Dan.

-15. Now the RC can be found on http://downloads.php.net/yourname,
+14. Now the RC can be found on http://downloads.php.net/yourname,
 f.e. http://downloads.php.net/derick/

-16. Once the release has been tagged, contact the PHP Windows development team
+15. Once the release has been tagged, contact the PHP Windows development team
 (internals-win@lists.php.net) so that Windows binaries can be created. Once
 those are made, they should be placed into the same directory as the source snapshots.

 Getting the non stable release (alpha/beta/RC) announced
 --------------------------------------------------------

-1. Send an email **To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` 
-lists pointing out "the location of the release" and "the possible release date of
-either the next RC, or the final release". Include in this information the verification
-information output by ``gen_verify_stub``.
+1. Send an email (see example here: http://news.php.net/php.internals/19486)
+**To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` lists
+pointing out "the location of the release" and "the possible release date of
+either the next RC, or the final release".

 2. Send an email (see example here http://news.php.net/php.pear.qa/5201) **To**
 ``php-qa@lists.php.net`` and ``primary-qa-tester@lists.php.net``.
@@ -193,8 +190,8 @@ Check if the pear files are updated (phar).
 This is to fetch the last commit id from php-distributions.git and commit this
 last commit id to web/php.git, then, mirrors will now sync

-12. Once the release has been tagged, contact release managers, windows builders, and package maintainers
-so that they can build releases. Do not send this announcement to any public lists.
+12. Once the release has been tagged, contact the PHP Windows development team
+(internals-win@lists.php.net) so that Windows binaries can be created.

 Getting the stable release announced
 ------------------------------------
@@ -5,7 +5,6 @@ This is the github mirror of the official PHP repository located at
 http://git.php.net.

 [![Build Status](https://secure.travis-ci.org/php/php-src.svg?branch=master)](http://travis-ci.org/php/php-src)
-[![Build status](https://ci.appveyor.com/api/projects/status/meyur6fviaxgdwdy?svg=true)](https://ci.appveyor.com/project/php/php-src)

 Pull Requests
 =============
@@ -66,7 +66,7 @@ dnl
 dnl Check whether the current setup can use POSIX threads calls
 dnl
 AC_DEFUN([PTHREADS_CHECK_COMPILE], [
-AC_LINK_IFELSE([ AC_LANG_SOURCE([
+AC_TRY_RUN( [
 #include <pthread.h>
 #include <stddef.h>

@@ -80,11 +80,18 @@ int main() {
    int data = 1;
    pthread_mutexattr_init(&mattr);
    return pthread_create(&thd, NULL, thread_routine, &data);
-} ]) ], [
-  pthreads_checked=yes
+} ], [
+  pthreads_working=yes
  ], [
-  pthreads_checked=no
-  ]
+  pthreads_working=no
+  ], [
+  dnl For cross compiling running this test is of no use. NetWare supports pthreads
+  pthreads_working=no
+  case $host_alias in
+  *netware*)
+    pthreads_working=yes
+  esac
+]
 ) ] )dnl
 dnl
 dnl PTHREADS_CHECK()
@@ -122,34 +129,30 @@ else
      CFLAGS="$CFLAGS $flag"
      PTHREADS_CHECK_COMPILE
      CFLAGS=$ac_save
-      if test "$pthreads_checked" = "yes"; then
+      if test "$pthreads_working" = "yes"; then
        ac_cv_pthreads_cflags=$flag
        break
      fi
    done
  fi
-  ])
-
-  AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
-  ac_cv_pthreads_lib=
-  if test "$pthreads_working" != "yes"; then
-   for lib in pthread pthreads c_r; do
-      ac_save=$LIBS
-      LIBS="$LIBS -l$lib"
-      PTHREADS_CHECK_COMPILE
-      LIBS=$ac_save
-      if test "$pthreads_checked" = "yes"; then
-        ac_cv_pthreads_lib=$lib
-        break
-      fi
-    done
-  fi
-  ])
-
-  if test "x$ac_cv_pthreads_cflags" != "x" -o "x$ac_cv_pthreads_lib" != "x"; then
-    pthreads_working="yes"
-  fi
 fi
+])
+
+AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
+ac_cv_pthreads_lib=
+if test "$pthreads_working" != "yes"; then
+  for lib in pthread pthreads c_r; do
+    ac_save=$LIBS
+    LIBS="$LIBS -l$lib"
+    PTHREADS_CHECK_COMPILE
+    LIBS=$ac_save
+    if test "$pthreads_working" = "yes"; then
+      ac_cv_pthreads_lib=$lib
+      break
+    fi
+  done
+fi
+])

 if test "$pthreads_working" = "yes"; then
  threads_result="POSIX-Threads found"
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2017 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2017 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2017 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -622,12 +622,6 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
-			if (shm_handle) {
-				CloseHandle(shm_handle);
-			}
-			if (info_handle) {
-				CloseHandle(info_handle);
-			}
 			return -1;
 		}
 	}
@@ -676,21 +670,12 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 		return (void*)-1;
 	}

-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
-	if (NULL == shm->addr) {
-		int err = GetLastError();
-		/* Catch more errors */
-		if (ERROR_NOT_ENOUGH_MEMORY == err) {
-			_set_errno(ENOMEM);
-		}
-		return (void*)-1;
-	}
-
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;

+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
 	return shm->addr;
 }

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2017 The PHP Group                                |
+   | Copyright (c) 1997-2016 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -484,7 +484,6 @@ Other
    is defined in the interface.
  . session.lazy_write(default=On) INI setting enables only write session data when
    session data is updated.
-  . session_regenerate_id() saves current $_SESSION before creating new session ID.

 - Opcache
  . Removed opcache.load_comments configuration directive. Now doc comments
@@ -518,10 +517,6 @@ Other
 - Stream:
  . Removed set_socket_blocking() in favor of its alias stream_set_blocking().

- XML:
-  . xml_set_object() now requires to manually unset the $parser when finished,
-    to avoid memory leaks.
-
 - XSL:
  . Removed xsl.security_prefs ini option. Use XsltProcessor::setSecurityPrefs()
    instead.
@@ -652,11 +647,6 @@ Other
  Since 7.0.9, getenv() has optional second parameter, making it only
  consider local environment and not SAPI environment if true.

- fopen()
-  Since 7.0.16, mode 'e' was added, which sets the close-on-exec flag
-  on the opened file descriptor. This mode is only available in PHP compiled on
-  POSIX.1-2008 conform systems.
-
 ========================================
 6. New Functions
 ========================================
@@ -727,22 +717,12 @@ out, that the corresponding SDK isn't available anymore.
  Mhash is not an extension anymore, use function_exists("mhash") to check whether
  it is avaliable.

- PDO_Firebird
-  As of PHP 7.0.16, the fetched data for integer fields is aware of the Firebird
-  datatypes. Previously all integers was fetched as strings, starting with the
-  aforementioned PHP version integer fields are translated to the PHP integer
-  datatype. The 64-bit integers are still fetched as strings in 32-bit PHP
-  builds.
-
 - GD
  The bundled libgd requires libwebp instead of libvpx for the WebP functionality.

 - Openssl
  minimum supported OpenSSL version series was raised to 0.9.8

- Shmop
-  The shmop identifiers have been changed from ints to resources of type shmop.
-
 ========================================
 10. New Global Constants
 ========================================
@@ -800,7 +780,6 @@ out, that the corresponding SDK isn't available anymore.
  . Removed asp_tags ini directive. Trying to enable it will result in a fatal
    error.
  . Removed always_populate_raw_post_data ini directive.
-  . realpath_cache_size set to 4096k by default

 ========================================
 12. Windows Support
@@ -100,7 +100,7 @@ AC_FUNC_ALLOCA
 AC_CHECK_FUNCS(memcpy strdup getpid kill strtod strtol finite fpclass sigsetjmp)
 AC_ZEND_BROKEN_SPRINTF

-AC_CHECK_DECLS([isfinite, isnan, isinf], [], [], [[#include <math.h>]])
+AC_CHECK_FUNCS(finite isfinite isinf isnan)

 ZEND_FP_EXCEPT

@@ -64,33 +64,33 @@ int zend_sprintf(char *buffer, const char *format, ...);

 /* To enable the is_nan, is_infinite and is_finite PHP functions */
 #ifdef NETWARE
-	#define HAVE_DECL_ISNAN 1
-	#define HAVE_DECL_ISINF 1
-	#define HAVE_DECL_ISFINITE 1
+	#define HAVE_ISNAN 1
+	#define HAVE_ISINF 1
+	#define HAVE_ISFINITE 1
 #endif

 #ifndef zend_isnan
-#if HAVE_DECL_ISNAN
+#ifdef HAVE_ISNAN
 #define zend_isnan(a) isnan(a)
 #elif defined(HAVE_FPCLASS)
 #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
 #else
-#define zend_isnan(a) ((a) != (a))
+#define zend_isnan(a) 0
 #endif
 #endif

-#if HAVE_DECL_ISINF
+#ifdef HAVE_ISINF
 #define zend_isinf(a) isinf(a)
 #elif defined(INFINITY)
 /* Might not work, but is required by ISO C99 */
-#define zend_isinf(a) (((a)==INFINITY || (a)==-INFINITY)?1:0)
+#define zend_isinf(a) (((a)==INFINITY)?1:0)
 #elif defined(HAVE_FPCLASS)
 #define zend_isinf(a) ((fpclass(a) == FP_PINF) || (fpclass(a) == FP_NINF))
 #else
 #define zend_isinf(a) 0
 #endif

-#if HAVE_DECL_ISFINITE
+#if defined(HAVE_ISFINITE) || defined(isfinite)
 #define zend_finite(a) isfinite(a)
 #elif defined(HAVE_FINITE)
 #define zend_finite(a) finite(a)
@@ -26,6 +26,7 @@ var_dump(count(get_defined_constants()));
 function test () {
 }

+var_dump(get_defined_functions(true));
 var_dump(gettype(get_defined_functions()));
 var_dump(count(get_defined_functions()));

@@ -64,6 +65,9 @@ NULL
 string(5) "array"
 string(5) "array"
 int(%d)
+
+Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
+NULL
 string(5) "array"
 int(%d)

@@ -1,25 +0,0 @@
--TEST--
-Next free element may overflow in array literals
--FILE--
-<?php
-
-$i = PHP_INT_MAX;
-$array = [$i => 42, new stdClass];
-var_dump($array);
-
-const FOO = [PHP_INT_MAX => 42, "foo"];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
-
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1,12 +0,0 @@
--TEST--
-Assign to $this leaks when $this not defined
--FILE--
-<?php
-
-try {
-	$this->a = new stdClass;
-} catch (Error $e) { echo $e->getMessage(), "\n"; }
-
-?>
--EXPECT--
-Using $this when not in object context
@@ -1,11 +0,0 @@
--TEST--
-ZEND_POW_ASSIGN
--INI--
-zend.assertions=1
--FILE--
-<?php
-
-assert_options(ASSERT_WARNING);
-assert(false && ($a **= 2));
--EXPECTF--
-Warning: assert(): assert(false && ($a **= 2)) failed in %s%ezend-pow-assign.php on line %d
@@ -79,7 +79,7 @@ Stack trace:
 #0 %sbug72101.php(8): {closure}(2, 'Parameter 1 to ...', '%s', 8, Array)
 #1 %sbug72101.php(27): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #2 %sbug72101.php(19): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#3 %sbug72101.php(52): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(51): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #4 %sbug72101.php(72): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
 #5 {main}
  thrown in %sbug72101.php on line 61
@@ -1,16 +0,0 @@
--TEST--
-Bug #72767: PHP Segfaults when trying to expand an infinite operator
--FILE--
-<?php
-
-function test() {}
-$iterator = new LimitIterator(
-    new InfiniteIterator(new ArrayIterator([42])),
-    0, 17000
-);
-test(...$iterator);
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,43 +0,0 @@
--TEST--
-Bug #72813 (Segfault with __get returned by ref)
--FILE--
-<?php
-class Test
-{
-    private $props = ['a' => 'text', 'b' => 1];
-
-    public function &__get($prop)
-    {
-        return $this->props[$prop];
-    }
-    
-    public function __set($prop, $value)
-    {
-        if ($prop === 'b') $value = [$value];
-        $this->props[$prop] = $value;
-    }
-    
-    public function getProperties()
-    {
-        return [$this->props];
-    }
-}
-
-$obj = new Test;
-$obj->b = $obj->b;
-print_r($obj->getProperties());
-?>
--EXPECT--
-Array
-(
-    [0] => Array
-        (
-            [a] => text
-            [b] => Array
-                (
-                    [0] => 1
-                )
-
-        )
-
-)
@@ -1,18 +0,0 @@
--TEST--
-Bug #72854: PHP Crashes on duplicate destructor call
--FILE--
-<?php
-
-function get() {
-    $t = new stdClass;
-    $t->prop = $t;
-    return $t;
-}
-
-$i = 42;
-get()->prop =& $i;
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,17 +0,0 @@
--TEST--
-Bug #72911 (Memleak in zend_binary_assign_op_obj_helper)
--FILE--
-<?php
-
-$a = 0;
-
-$b = $a->b->i -= 0;
-
-var_dump($b);
-
-?>
--EXPECTF--
-Warning: Attempt to modify property of non-object in %sbug72911.php on line %d
-
-Warning: Attempt to assign property of non-object in %sbug72911.php on line %d
-NULL
@@ -1,20 +0,0 @@
--TEST--
-Bug #72943 (assign_dim on string doesn't reset hval)
--FILE--
-<?php
-$array = array("test" => 1);
-
-$a = "lest";
-var_dump($array[$a]);
-$a[0] = "f";
-var_dump($array[$a]);
-$a[0] = "t";
-var_dump($array[$a]);
-?>
--EXPECTF--
-Notice: Undefined index: lest in %sbug72943.php on line %d
-NULL
-
-Notice: Undefined index: fest in %sbug72943.php on line %d
-NULL
-int(1)
@@ -1,12 +0,0 @@
--TEST--
-Bug #72944 (Null pointer deref in zval_delref_p).
--FILE--
-<?php
-"a"== e & $A = $A? 0 : 0 ?:0;
-echo "OK\n";
-?>
--EXPECTF--
-Notice: Use of undefined constant e - assumed 'e' in %sbug72944.php on line 2
-
-Notice: Undefined variable: A in %sbug72944.php on line 2
-OK
@@ -1,50 +0,0 @@
--TEST--
-Bug #73156 (segfault on undefined function)
--FILE--
-<?php
-class A {
-    public function __call($name, $args) {
-        eval('$args = array(); var_dump(debug_backtrace());');
-    }
-}
-
-$a = new A();
-
-$a->test("test");
-?>
--EXPECTF--
-array(2) {
-  [0]=>
-  array(3) {
-    ["file"]=>
-    string(%d) "%sbug73156.php"
-    ["line"]=>
-    int(4)
-    ["function"]=>
-    string(4) "eval"
-  }
-  [1]=>
-  array(7) {
-    ["file"]=>
-    string(%d) "%sbug73156.php"
-    ["line"]=>
-    int(10)
-    ["function"]=>
-    string(6) "__call"
-    ["class"]=>
-    string(1) "A"
-    ["object"]=>
-    object(A)#%d (0) {
-    }
-    ["type"]=>
-    string(2) "->"
-    ["args"]=>
-    array(2) {
-      [0]=>
-      string(4) "test"
-      [1]=>
-      array(0) {
-      }
-    }
-  }
-}
@@ -1,22 +0,0 @@
--TEST--
-Bug #73163 (PHP hangs if error handler throws while accessing undef const in default value)
--FILE--
-<?php
-
-function doSomething(string $value = UNDEFINED) {
-}
-
-set_error_handler(function($errno, $errstr) {
-    throw new Exception($errstr);
-});
-
-doSomething();
-
-?>
--EXPECTF--
-Fatal error: Uncaught Exception: Use of undefined constant UNDEFINED - assumed 'UNDEFINED' in %s:%d
-Stack trace:
-#0 %s(%d): {closure}(%s)
-#1 %s(%d): doSomething()
-#2 {main}
-  thrown in %s on line %d
@@ -1,20 +0,0 @@
--TEST--
-Bug #73181: parse_str() without a second argument leads to crash
--FILE--
-<?php
-
-function x() {
-    parse_str("1&x");
-    var_dump(get_defined_vars());
-}
-
-x();
-
-?>
--EXPECT--
-array(2) {
-  [1]=>
-  string(0) ""
-  ["x"]=>
-  string(0) ""
-}
@@ -1,12 +0,0 @@
--TEST--
-Bug #73337 (try/catch not working with two exceptions inside a same operation)
--FILE--
-<?php
-class d { function __destruct() { throw new Exception; } }
-try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
-?>
--EXPECTF--
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-Exception properly caught
@@ -1,18 +0,0 @@
--TEST--
-Bug #73338: Ensure exceptions in function init opcodes are cleaned properly
--FILE--
-<?php
-
-try { call_user_func(new class { function __destruct () { throw new Error; } }); } catch (Error $e) {}
-
-set_error_handler(function() { throw new Error; });
-
-try { var_dump(new stdClass, call_user_func("fail")); } catch (Error $e) {}
-
-try { (function() { call_user_func("fail"); })(); } catch (Error $e) {}
-
-try { [new class { static function foo() {} function __destruct () { throw new Error; } }, "foo"](); } catch (Error $e) {}
-
-?>
--EXPECTF--
-Warning: call_user_func() expects parameter 1 to be a valid callback, no array or string given in %s on line %d
@@ -1,27 +0,0 @@
--TEST--
-Bug #73350 (Exception::__toString() cause circular references)
--FILE--
-<?php
-$e = new Exception();
-
-// This line cause problem :(
-// Comment it to see the difference.
-(string) $e;
-
-// This line show the clue (PHP Warning: ...).
-var_export($e);
-?>
--EXPECTF--
-Exception::__set_state(array(
-   'message' => '',
-   'string' => 'Exception in %sbug73350.php:%d
-Stack trace:
-#0 {main}',
-   'code' => 0,
-   'file' => '%sbug73350.php',
-   'line' => %d,
-   'trace' => 
-  array (
-  ),
-   'previous' => NULL,
-))
@@ -1,73 +0,0 @@
--TEST--
-Bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list())
--FILE--
-<?php
-function change(&$ref) {
-	$ref = range(1, 10);
-	return;
-}
-
-$func = function (&$ref) {
-	return change($ref);
-};
-
-$array = [1];
-var_dump(list($val) = $array); // NG: Invalid opcode
-
-change(list($val) = $array);
-var_dump($array);
-
-$array = [1];
-
-$func(list($val) = $array);
-var_dump($array);
-?>
--EXPECT--
-array(1) {
-  [0]=>
-  int(1)
-}
-array(10) {
-  [0]=>
-  int(1)
-  [1]=>
-  int(2)
-  [2]=>
-  int(3)
-  [3]=>
-  int(4)
-  [4]=>
-  int(5)
-  [5]=>
-  int(6)
-  [6]=>
-  int(7)
-  [7]=>
-  int(8)
-  [8]=>
-  int(9)
-  [9]=>
-  int(10)
-}
-array(10) {
-  [0]=>
-  int(1)
-  [1]=>
-  int(2)
-  [2]=>
-  int(3)
-  [3]=>
-  int(4)
-  [4]=>
-  int(5)
-  [5]=>
-  int(6)
-  [6]=>
-  int(7)
-  [7]=>
-  int(8)
-  [8]=>
-  int(9)
-  [9]=>
-  int(10)
-}
@@ -1,29 +0,0 @@
--TEST--
-Bug #73753 Non packed arrays and duplication
--FILE--
-<?php
-function iterate($current, $a, $result = null) {
-    if (!$current) {
-        return $result;
-    }
-
-    return iterate(getNext($a), $a, $current);
-}
-
-function getNext(&$a) {
-    return next($a);
-}
-
-function getCurrent($a) {
-    return current($a);
-}
-
-function traverse($a) {
-    return iterate(getCurrent($a), $a);
-}
-
-$arr = array(1 => 'foo', 'b' => 'bar', 'baz');
-var_dump(traverse($arr));
-?>
--EXPECTF--
-string(3) "baz"
@@ -1,20 +0,0 @@
--TEST--
-Bug #73792 (invalid foreach loop hangs script)
--FILE--
-<?php
-$a = 'aaa';
-
-foreach ($a['bbb'] as &$value) {
-	echo 'loop';
-}
-
-unset($value);
-echo 'done';
-?>
--EXPECTF--
-Warning: Illegal string offset 'bbb' in %sbug73792.php on line 4
-
-Fatal error: Uncaught Error: Cannot iterate on string offsets by reference in %sbug73792.php:4
-Stack trace:
-#0 {main}
-  thrown in %sbug73792.php on line 4
@@ -1,16 +0,0 @@
--TEST--
-Bug #73916 (zend_print_flat_zval_r doesn't consider reference)
--FILE--
-<?php
-$a = array('a');
-class b{};
-$b = new b;
-$test[] =& $a;
-$test[] =& $b;
-test($test);
-function test() {
-	debug_print_backtrace();
-}
-?>
--EXPECTF--
-#0  test(Array ([0] => Array ([0] => a),[1] => b Object ())) called at [%sbug73916.php:%d]
@@ -1,23 +0,0 @@
--TEST--
-Bug #73954 (NAN check fails on Alpine Linux with musl)
--FILE--
-<?php
-
-var_dump(NAN);
-var_dump(is_nan(NAN));
-
-function takes_int(int $int) {
-}
-
-takes_int(log(tan(3.14)));
-
-?>
--EXPECTF--
-float(NAN)
-bool(true)
-
-Fatal error: Uncaught TypeError: Argument 1 passed to takes_int() must be of the type integer, float given, called in %s on line 9 and defined in %s:6
-Stack trace:
-#0 %s(9): takes_int(NAN)
-#1 {main}
-  thrown in %s on line 6
@@ -1,16 +0,0 @@
--TEST--
-Bug #73960: Leak with instance method calling static method with referenced return
--FILE--
-<?php
-
-$value = 'one';
-$array = array($value);
-$array = $ref =& $array;
-var_dump($array);
-
-?>
--EXPECT--
-array(1) {
-  [0]=>
-  string(3) "one"
-}
@@ -1,28 +0,0 @@
--TEST--
-Bug #73989 (PHP 7.1 Segfaults within Symfony test suite)
--FILE--
-<?php
-class Cycle
-{
-    private $thing;
-
-    public function __construct()
-    {
-		$obj = $this;
-        $this->thing = function() use($obj) {};
-    }
-
-    public function __destruct()
-    {
-		($this->thing)();
-    }
-
-}
-
-for ($i = 0; $i < 10000; ++$i) {
-    $obj = new Cycle();
-}
-echo "OK\n";
-?>
--EXPECT--
-OK
@@ -1,19 +0,0 @@
--TEST--
-Bug #73998 (array_key_exists fails on arrays created by get_object_vars)
--DESCRIPTION--
-Properties of objects with numeric names should be accessible
--FILE--
-<?php
-$a = new stdClass;
-$a->{1234} = "Numeric";
-$a->a1234 = "String";
-
-$properties = get_object_vars($a);
-var_dump(array_key_exists(1234, $properties));
-echo "Value: {$properties[1234]}\n";
-
-?>
--EXPECT--
-bool(true)
-Value: Numeric
-
@@ -1,19 +0,0 @@
--TEST--
-Bug #74084 (Out of bound read - zend_mm_alloc_small)
--INI--
-error_reporting=0
--FILE--
-<?php
-$$A += $$B->a = &$$C; 
-unset($$A);
-$$A -= $$B->a = &$$C; 
-unset($$A);
-$$A *= $$B->a = &$$C; 
-unset($$A);
-$$A /= $$B->a = &$$C; 
-unset($$A);
-$$A **= $$B->a = &$$C; 
-var_dump($$A);
-?>
--EXPECT--
-int(1)
@@ -1,14 +0,0 @@
--TEST--
-Fixes bug 74188 (undeclared static variables emit a warning with ?? operator)
--FILE--
-<?php
-abstract class Test
-{
-	public static function get()
-	{
-		static::$a ?? true;
-	}
-}
-Test::get();
-?>
--EXPECT--
@@ -1,38 +0,0 @@
--TEST--
-Bug #74408 (Endless loop bypassing execution time limit)
--INI--
-error_reporting = E_ALL | E_DEPRECATED | E_STRICT
--FILE--
-<?php
-
- //php.ini: error_reporting = E_ALL | E_DEPRECATED | E_STRICT
-
- class ErrorHandling {
-
-  public  function error_handler($errno, $errstr, $errfile, $errline) {
-	  $bla = new NonExistingClass2();
-  }
-
-  public function exception_handler(Error $e) { 
-	  echo "Caught, exception: " . $e->getMessage();
-  }
- }
-
- set_error_handler('ErrorHandling::error_handler');
- set_exception_handler('ErrorHandling::exception_handler');
-
- $blubb = new NonExistingClass();
-?>
--EXPECTF--
-Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
-
-Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
-
-Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in Unknown on line 0
-
-Fatal error: Uncaught Error: Class 'NonExistingClass2' not found in %sbug74408.php:%d
-Stack trace:
-#0 [internal function]: ErrorHandling::error_handler(8192, 'Non-static meth...', '%s', %d, Array)
-#1 %sbug74408.php(%d): set_exception_handler('ErrorHandling::...')
-#2 {main}
-  thrown in %sbug74408.php on line %d
@@ -1,11 +0,0 @@
--TEST--
-Bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())
--FILE--
-<?php 
-"000000"[0]::d;
-?>
--EXPECTF--
-Fatal error: Uncaught Error: Class '0' not found in %sbug74546.php:%d
-Stack trace:
-#0 {main}
-  thrown in %sbug74546.php on line %d
@@ -1,184 +0,0 @@
--TEST--
-Behavior of failing compound assignment
--INI--
-opcache.optimization_level=0
--FILE--
-<?php
-
-try {
-	$a = 1;
-	$a %= 0;
-} catch (Error $e) { var_dump($a); }
-
-try {
-	$a = 1;
-	$a >>= -1;
-} catch (Error $e) { var_dump($a); }
-
-try {
-	$a = 1;
-	$a <<= -1;
-} catch (Error $e) { var_dump($a); }
-
-set_error_handler(function($type, $msg) { throw new Exception($msg); });
-
-try {
-	$a = [];
-	$a .= "foo";
-} catch (Throwable $e) { var_dump($a); }
-
-try {
-	$a = "foo";
-	$a .= [];
-} catch (Throwable $e) { var_dump($a); }
-
-$x = new stdClass;
-try { $x += 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x += new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x -= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x -= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x *= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x *= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x /= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x /= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x %= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x %= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x **= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x **= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x ^= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x ^= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x &= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x &= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x |= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x |= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x <<= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x <<= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = new stdClass;
-try { $x >>= 1; }
-catch (Exception $e) {}
-var_dump($x);
-
-$x = 1;
-try { $x >>= new stdClass; }
-catch (Exception $e) {}
-var_dump($x);
-?>
--EXPECTF--
-int(1)
-int(1)
-int(1)
-array(0) {
-}
-string(3) "foo"
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
-object(stdClass)#%d (0) {
-}
-int(1)
@@ -2,37 +2,51 @@
 Concatenating many small strings should not slowdown allocations
 --SKIPIF--
 <?php if (PHP_DEBUG) { die ("skip debug version is slow"); } ?>
+--INI--
+memory_limit=256m
 --FILE--
 <?php

+/* To note is that memory usage can vary depending on whether opcache is on. The actual
+  measuring that matters is timing here. */
+
 $time = microtime(TRUE);

 /* This might vary on Linux/Windows, so the worst case and also count in slow machines. */
-$t_max = 1.0;
+$t0_max = 0.1;
+$t1_max = 0.4;
+
+$datas = [];
+for ($i = 0; $i < 220000; $i++)
+{
+    $datas[] = [
+        '000.000.000.000',
+        '000.255.255.255',
+        '保留地址',
+        '保留地址',
+        '保留地址',
+        '保留地址',
+        '保留地址',
+        '保留地址',
+    ];
+}
+
+$t0 = microtime(TRUE) - $time;
+var_dump($t0 < $t0_max);

-$datas = array_fill(0, 220000, [
-    '000.000.000.000',
-    '000.255.255.255',
-    '保留地址',
-    '保留地址',
-    '保留地址',
-    '保留地址',
-    '保留地址',
-    '保留地址',
-]);

-$time = microtime(TRUE);
 $texts = '';
 foreach ($datas AS $data)
 {
    $texts .= implode("\t", $data) . "\r\n";
 }

-$t = microtime(TRUE) - $time;
-var_dump($t < $t_max);
+$t1 = microtime(TRUE) - $time;
+var_dump($t1 < $t1_max);

 ?>
 +++DONE+++
 --EXPECT--
 bool(true)
+bool(true)
 +++DONE+++
@@ -1,15 +0,0 @@
--TEST--
-Constexpr arrays should be able to handle resource keys
--FILE--
-<?php
-
-const FOO = [STDIN => 42];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Notice: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1,7 +1,5 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
--INI--
-allow_url_fopen=1
 --FILE--
 <?php

@@ -1,10 +0,0 @@
--TEST--
-Use of non-literals in declare ticks values crashes compiler
--FILE--
-<?php
-declare(ticks = UNKNOWN_CONST) {
-  echo 'Done';
-}
--EXPECTF--
-
-Fatal error: declare(ticks) value must be a literal in %sdeclare_006.php on line 2
@@ -1,24 +0,0 @@
--TEST--
-Calling generator through magic __call()
--FILE--
-<?php
-class A {
-    public function __call($name, $args) {
-        for ($i = 0; $i < 5; $i++) {
-            yield $i;
-        }
-    }
-}
-
-$a = new A();
-foreach ($a->gen() as $n) {
-    var_dump($n);
-}
-$a->gen();
-?>
--EXPECT--
-int(0)
-int(1)
-int(2)
-int(3)
-int(4)
@@ -1,24 +0,0 @@
--TEST--
-yield from parses too greedily
--FILE--
-<?php
-
-function from1234($x) {
-  return $x;
-}
-
-function bar() {
-  yield 24;
-}
-
-function foo() {
-  yield from1234(42);
-  yield from(bar());
-}
-
-foreach (foo() as $value) {
-  var_dump($value);
-}
--EXPECT--
-int(42)
-int(24)
@@ -3,7 +3,7 @@ Test get_defined_functions() function : error conditions
 --FILE--
 <?php

-/* Prototype  : array get_defined_functions  ( $exclude_disabled = false )
+/* Prototype  : array get_defined_functions  ( void  )
 * Description: Gets an array of all defined functions.
 * Source code: Zend/zend_builtin_functions.c
 */
@@ -14,8 +14,7 @@ echo "*** Testing get_defined_functions() : error conditions ***\n";

 echo "\n-- Testing get_defined_functions() function with more than expected no. of arguments --\n";
 $extra_arg = 10;
-$extra_arg2 = 20;
-var_dump( get_defined_functions($extra_arg, $extra_arg2) );
+var_dump( get_defined_functions($extra_arg) );

 ?> 
 ===Done===
@@ -24,7 +23,7 @@ var_dump( get_defined_functions($extra_arg, $extra_arg2) );

 -- Testing get_defined_functions() function with more than expected no. of arguments --

-Warning: get_defined_functions() expects at most 1 parameter, 2 given in %s on line %d
+Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
 NULL
 
 ===Done===
@@ -6,8 +6,6 @@ ANDing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
-$s3 = str_repeat("f", 1);
-$s4 = str_repeat("f", 2);

 $s &= 22;
 var_dump($s);
@@ -18,18 +16,10 @@ var_dump($s1);
 $s2 &= 33;
 var_dump($s2);

-$s3 &= " ";
-var_dump($s3);
-
-$s4 &= "  ";
-var_dump($s4);
-
 echo "Done\n";
 ?>
 --EXPECTF--	
 int(18)
 int(0)
 int(33)
-string(1) " "
-string(2) "  "
 Done
@@ -6,8 +6,6 @@ ORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
-$s3 = str_repeat("f", 1);
-$s4 = str_repeat("f", 2);

 $s |= 22;
 var_dump($s);
@@ -18,18 +16,10 @@ var_dump($s1);
 $s2 |= 33;
 var_dump($s2);

-$s3 |= " ";
-var_dump($s3);
-
-$s4 |= "  ";
-var_dump($s4);
-
 echo "Done\n";
 ?>
 --EXPECTF--
 int(127)
 int(11)
 int(45345)
-string(1) "f"
-string(2) "ff"
 Done
@@ -6,8 +6,6 @@ XORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
-$s3 = str_repeat("f", 1);
-$s4 = str_repeat("f", 2);

 $s ^= 22;
 var_dump($s);
@@ -18,18 +16,10 @@ var_dump($s1);
 $s2 ^= 33;
 var_dump($s2);

-$s3 ^= " ";
-var_dump($s3);
-
-$s4 ^= "  ";
-var_dump($s4);
-
 echo "Done\n";
 ?>
 --EXPECTF--
 int(109)
 int(11)
 int(45312)
-string(1) "F"
-string(2) "FF"
 Done
@@ -1,20 +0,0 @@
--TEST--
-Bug #69579 (Internal trait double-free)
--SKIPIF--
-<?php
-if (!PHP_DEBUG) die("skip only run in debug version");
-?>
--FILE--
-<?php
-
-class Bar{
-  use _ZendTestTrait;
-}
-
-$bar = new Bar();
-var_dump($bar->testMethod());
-// destruction causes a double-free and explodes
-
-?>
--EXPECT--
-bool(true)
@@ -12,8 +12,8 @@ final class e { }
 var_dump(get_declared_traits());

 ?>
--EXPECTF--
-array(%d) {%A
-  [%d]=>
+--EXPECT--
+array(1) {
+  [0]=>
  string(1) "c"
 }
@@ -13,8 +13,8 @@ namespace test {
 }

 ?>
--EXPECTF--
-array(%d) {%A
-  [%d]=>
+--EXPECT--
+array(1) {
+  [0]=>
  string(6) "test\c"
 }
@@ -13,15 +13,13 @@ var_dump(get_declared_traits());

 ?>
 --EXPECTF--
-array(%d) {%A
-  [%d]=>
-  string(1) "a"
+%astring(1) "a"
  [%d]=>
  string(1) "d"
  [%d]=>
  string(1) "e"
 }
-array(%d) {%A
-  [%d]=>
+array(1) {
+  [0]=>
  string(1) "c"
 }
@@ -1,15 +0,0 @@
--TEST--
-"use function" should not conflict with class names
--FILE--
-<?php
-
-namespace Foo;
-
-class Bar {}
-
-use function bar;
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,12 +0,0 @@
--TEST--
-Use conflicts should not occur across files
--FILE--
-<?php
-
-require __DIR__ . '/use_no_file_conflict_1.inc';
-require __DIR__ . '/use_no_file_conflict_2.inc';
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,4 +0,0 @@
-<?php
-
-namespace Foo;
-class A {}
@@ -1,4 +0,0 @@
-<?php
-
-namespace Foo;
-use A;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -152,12 +152,11 @@ ZEND_TSRMLS_CACHE_DEFINE()
 #endif

 ZEND_API zend_utility_values zend_uv;
-ZEND_API zend_bool zend_dtrace_enabled;

 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2017 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2016 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4

 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object) /* {{{ */
@@ -313,9 +312,6 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			ZEND_PUTS(")");
 			break;
 		}
-		case IS_REFERENCE:
-			zend_print_flat_zval_r(Z_REFVAL_P(expr));
-			break;
 		default:
 			zend_print_variable(expr);
 			break;
@@ -567,7 +563,6 @@ static void executor_globals_ctor(zend_executor_globals *executor_globals) /* {{
 #ifdef ZEND_WIN32
 	zend_get_windows_version_info(&executor_globals->windows_version_info);
 #endif
-	executor_globals->valid_symbol_table = 0;
 }
 /* }}} */

@@ -683,20 +678,9 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /

 #if HAVE_DTRACE
 /* build with dtrace support */
-	{
-		char *tmp = getenv("USE_ZEND_DTRACE");
-
-		if (tmp && zend_atoi(tmp, 0)) {
-			zend_dtrace_enabled = 1;
-			zend_compile_file = dtrace_compile_file;
-			zend_execute_ex = dtrace_execute_ex;
-			zend_execute_internal = dtrace_execute_internal;
-		} else {
-			zend_compile_file = compile_file;
-			zend_execute_ex = execute_ex;
-			zend_execute_internal = NULL;
-		}
-	}
+	zend_compile_file = dtrace_compile_file;
+	zend_execute_ex = dtrace_execute_ex;
+	zend_execute_internal = dtrace_execute_internal;
 #else
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -299,8 +299,6 @@ extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
 extern ZEND_API zval zval_used_for_init;

-/* If DTrace is available and enabled */
-extern ZEND_API zend_bool zend_dtrace_enabled;
 END_EXTERN_C()

 #define ZEND_UV(name) (zend_uv.name)
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -197,6 +197,7 @@ ZEND_API char *zend_zval_type_name(const zval *arg) /* {{{ */
 }
 /* }}} */

+#ifdef FAST_ZPP
 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_paramers_count_error(int num_args, int min_num_args, int max_num_args) /* {{{ */
 {
 	zend_function *active_function = EG(current_execute_data)->func;
@@ -290,6 +291,7 @@ ZEND_API int ZEND_FASTCALL zend_parse_arg_class(zval *arg, zend_class_entry **pc
 	return 1;
 }
 /* }}} */
+#endif

 ZEND_API int ZEND_FASTCALL zend_parse_arg_bool_weak(zval *arg, zend_bool *dest) /* {{{ */
 {
@@ -1859,7 +1861,7 @@ static int zend_startup_module_zval(zval *zv) /* {{{ */
 {
 	zend_module_entry *module = Z_PTR_P(zv);

-	return (zend_startup_module_ex(module) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
+	return zend_startup_module_ex(module);
 }
 /* }}} */

@@ -3847,24 +3849,6 @@ ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, c
 }
 /* }}} */

-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length) /* {{{ */
-{
-	zval property;
-	zend_class_entry *old_scope = EG(scope);
-
-	EG(scope) = scope;
-
-	if (!Z_OBJ_HT_P(object)->unset_property) {
-		zend_error_noreturn(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, ZSTR_VAL(Z_OBJCE_P(object)->name));
-	}
-	ZVAL_STRINGL(&property, name, name_length);
-	Z_OBJ_HT_P(object)->unset_property(object, &property, 0);
-	zval_ptr_dtor(&property);
-
-	EG(scope) = old_scope;
-}
-/* }}} */
-
 ZEND_API void zend_update_property_bool(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_long value) /* {{{ */
 {
 	zval tmp;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -343,7 +343,6 @@ ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object,
 ZEND_API void zend_update_property_str(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_string *value);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value, size_t value_length);
-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, size_t name_length, zval *value);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, size_t name_length);
@@ -666,11 +665,13 @@ END_EXTERN_C()

 /* Fast parameter parsing API */

-/* Fast ZPP is always enabled now; this define is left in for compatibility
- * with any existing conditional compilation blocks.
+/* This API should be used only for really often used functions.
+ * (Keep the original parsing code and wrap usage with #ifndef FAST_ZPP)
 */
 #define FAST_ZPP 1

+#ifdef FAST_ZPP
+
 #define Z_EXPECTED_TYPES(_) \
 	_(Z_EXPECTED_LONG,		"integer") \
 	_(Z_EXPECTED_BOOL,		"boolean") \
@@ -1033,6 +1034,8 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 #define Z_PARAM_VARIADIC(spec, dest, dest_num) \
 	Z_PARAM_VARIADIC_EX(spec, dest, dest_num, 0)

+#endif /* FAST_ZPP */
+
 /* End of new parameter parsing API */

 /* Inlined implementations shared by new and old parameter parsing APIs */
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -897,7 +897,6 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, int pages_count ZEND_FILE_L
 {
 	zend_mm_chunk *chunk = heap->main_chunk;
 	int page_num, len;
-	int steps = 0;

 	while (1) {
 		if (UNEXPECTED(chunk->free_pages < pages_count)) {
@@ -1074,20 +1073,10 @@ get_chunk:
 			goto found;
 		} else {
 			chunk = chunk->next;
-			steps++;
 		}
 	}

 found:
-	if (steps > 2 && pages_count < 8) {
-		/* move chunk into the head of the linked-list */
-		chunk->prev->next = chunk->next;
-		chunk->next->prev = chunk->prev;
-		chunk->next = heap->main_chunk->next;
-		chunk->prev = heap->main_chunk;
-		chunk->prev->next = chunk;
-		chunk->next->prev = chunk;
-	}
 	/* mark run as allocated */
 	chunk->free_pages -= pages_count;
 	zend_mm_bitset_set_range(chunk->free_map, page_num, pages_count);
@@ -1483,7 +1472,7 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 #endif
 #ifdef ZEND_WIN32
 			/* On Windows we don't have ability to extend huge blocks in-place.
-			 * We allocate them with 2MB size granularity, to avoid many
+			 * We allocate them with 2MB size granularity, to avoid many 
 			 * reallocations when they are extended by small pieces
 			 */
 			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -1751,7 +1740,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 {
 #ifdef ZEND_WIN32
 	/* On Windows we don't have ability to extend huge blocks in-place.
-	 * We allocate them with 2MB size granularity, to avoid many
+	 * We allocate them with 2MB size granularity, to avoid many 
 	 * reallocations when they are extended by small pieces
 	 */
 	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -2343,7 +2332,7 @@ ZEND_API int is_zend_mm(void)
 #endif
 }

-#if !ZEND_DEBUG && defined(HAVE_BUILTIN_CONSTANT_P)
+#if !ZEND_DEBUG && (!defined(_WIN32) || defined(__clang__))
 #undef _emalloc

 #if ZEND_MM_CUSTOM
@@ -2511,24 +2500,37 @@ ZEND_API size_t ZEND_FASTCALL _zend_mem_block_size(void *ptr ZEND_FILE_LINE_DC Z
 	return zend_mm_size(AG(mm_heap), ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 }

+static zend_always_inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+{
+	int overflow;
+	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+	if (UNEXPECTED(overflow)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		return 0;
+	}
+	return ret;
+}
+
+
 ZEND_API void* ZEND_FASTCALL _safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return emalloc_rel(zend_safe_address_guarded(nmemb, size, offset));
+	return emalloc_rel(safe_address(nmemb, size, offset));
 }

 ZEND_API void* ZEND_FASTCALL _safe_malloc(size_t nmemb, size_t size, size_t offset)
 {
-	return pemalloc(zend_safe_address_guarded(nmemb, size, offset), 1);
+	return pemalloc(safe_address(nmemb, size, offset), 1);
 }

 ZEND_API void* ZEND_FASTCALL _safe_erealloc(void *ptr, size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return erealloc_rel(ptr, zend_safe_address_guarded(nmemb, size, offset));
+	return erealloc_rel(ptr, safe_address(nmemb, size, offset));
 }

 ZEND_API void* ZEND_FASTCALL _safe_realloc(void *ptr, size_t nmemb, size_t size, size_t offset)
 {
-	return perealloc(ptr, zend_safe_address_guarded(nmemb, size, offset), 1);
+	return perealloc(ptr, safe_address(nmemb, size, offset), 1);
 }


@@ -2644,9 +2646,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(zend_mm_heap));
 		alloc_globals->mm_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
-		alloc_globals->mm_heap->custom_heap.std._malloc = __zend_malloc;
+		alloc_globals->mm_heap->custom_heap.std._malloc = malloc;
 		alloc_globals->mm_heap->custom_heap.std._free = free;
-		alloc_globals->mm_heap->custom_heap.std._realloc = __zend_realloc;
+		alloc_globals->mm_heap->custom_heap.std._realloc = realloc;
 		return;
 	}
 #endif
@@ -2862,7 +2864,7 @@ static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
 ZEND_API void * __zend_malloc(size_t len)
 {
 	void *tmp = malloc(len);
-	if (EXPECTED(tmp || !len)) {
+	if (EXPECTED(tmp)) {
 		return tmp;
 	}
 	zend_out_of_memory();
@@ -2878,7 +2880,7 @@ ZEND_API void * __zend_calloc(size_t nmemb, size_t len)
 ZEND_API void * __zend_realloc(void *p, size_t len)
 {
 	p = realloc(p, len);
-	if (EXPECTED(p || !len)) {
+	if (EXPECTED(p)) {
 		return p;
 	}
 	zend_out_of_memory();
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -57,21 +57,17 @@ ZEND_API zend_ast *zend_ast_create_znode(znode *node) {
 	return (zend_ast *) ast;
 }

-ZEND_API zend_ast *zend_ast_create_zval_with_lineno(zval *zv, zend_ast_attr attr, uint32_t lineno) {
+ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr) {
 	zend_ast_zval *ast;

 	ast = zend_ast_alloc(sizeof(zend_ast_zval));
 	ast->kind = ZEND_AST_ZVAL;
 	ast->attr = attr;
 	ZVAL_COPY_VALUE(&ast->val, zv);
-	ast->val.u2.lineno = lineno;
+	ast->val.u2.lineno = CG(zend_lineno);
 	return (zend_ast *) ast;
 }

-ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr) {
-	return zend_ast_create_zval_with_lineno(zv, attr, CG(zend_lineno));
-}
-
 ZEND_API zend_ast *zend_ast_create_decl(
 	zend_ast_kind kind, uint32_t flags, uint32_t start_lineno, zend_string *doc_comment,
 	zend_string *name, zend_ast *child0, zend_ast *child1, zend_ast *child2, zend_ast *child3
@@ -159,14 +155,7 @@ ZEND_API zend_ast *zend_ast_create_list(uint32_t init_children, zend_ast_kind ki
 		uint32_t i;
 		va_start(va, kind);
 		for (i = 0; i < init_children; ++i) {
-			zend_ast *child = va_arg(va, zend_ast *);
-			ast = zend_ast_list_add(ast, child);
-			if (child != NULL) {
-				uint32_t lineno = zend_ast_get_lineno(child);
-				if (lineno < ast->lineno) {
-					ast->lineno = lineno;
-				}
-			}
+			ast = zend_ast_list_add(ast, va_arg(va, zend_ast *));
 		}
 		va_end(va);
 	}
@@ -192,11 +181,7 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 {
 	switch (Z_TYPE_P(offset)) {
 		case IS_UNDEF:
-			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), expr)) {
-				zend_error(E_WARNING,
-					"Cannot add element to the array as the next element is already occupied");
-				zval_ptr_dtor(expr);
-			}
+			zend_hash_next_index_insert(Z_ARRVAL_P(result), expr);
 			break;
 		case IS_STRING:
 			zend_symtable_update(Z_ARRVAL_P(result), Z_STR_P(offset), expr);
@@ -217,10 +202,6 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 		case IS_DOUBLE:
 			zend_hash_index_update(Z_ARRVAL_P(result), zend_dval_to_lval(Z_DVAL_P(offset)), expr);
 			break;
-		case IS_RESOURCE:
-			zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(offset), Z_RES_HANDLE_P(offset));
-			zend_hash_index_update(Z_ARRVAL_P(result), Z_RES_HANDLE_P(offset), expr);
-			break;
 		default:
 			zend_throw_error(NULL, "Illegal offset type");
 			return FAILURE;
@@ -1355,7 +1336,7 @@ simple_list:
 				case ZEND_ASSIGN_BW_OR:  BINARY_OP(" |= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_AND: BINARY_OP(" &= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_XOR: BINARY_OP(" ^= ",  90, 91, 90);
-				case ZEND_ASSIGN_POW:    BINARY_OP(" **= ", 90, 91, 90);
+				case ZEND_POW:           BINARY_OP(" **= ", 90, 91, 90);
 				EMPTY_SWITCH_DEFAULT_CASE();
 			}
 			break;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -190,7 +190,6 @@ typedef struct _zend_ast_decl {
 typedef void (*zend_ast_process_t)(zend_ast *ast);
 extern ZEND_API zend_ast_process_t zend_ast_process;

-ZEND_API zend_ast *zend_ast_create_zval_with_lineno(zval *zv, zend_ast_attr attr, uint32_t lineno);
 ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr);

 ZEND_API zend_ast *zend_ast_create_ex(zend_ast_kind kind, zend_ast_attr attr, ...);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -31,10 +31,6 @@

 #undef ZEND_TEST_EXCEPTIONS

-#if ZEND_DEBUG
-static zend_class_entry *zend_test_trait;
-#endif
-
 static ZEND_FUNCTION(zend_version);
 static ZEND_FUNCTION(func_num_args);
 static ZEND_FUNCTION(func_get_arg);
@@ -261,18 +257,6 @@ ZEND_END_ARG_INFO()

 /* }}} */

-#if ZEND_DEBUG
-static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
-	RETURN_TRUE;
-}
-/* }}} */
-
-static zend_function_entry zend_test_trait_methods[] = {
-    ZEND_ME(_ZendTestTrait, testMethod, arginfo_zend__void, ZEND_ACC_PUBLIC)
-    ZEND_FE_END
-};
-#endif
-
 static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(zend_version,		arginfo_zend__void)
 	ZEND_FE(func_num_args,		arginfo_zend__void)
@@ -355,13 +339,6 @@ ZEND_MINIT_FUNCTION(core) { /* {{{ */

 	zend_register_default_classes();

-#if ZEND_DEBUG
-	INIT_CLASS_ENTRY(class_entry, "_ZendTestTrait", zend_test_trait_methods);
-	zend_test_trait = zend_register_internal_class(&class_entry);
-	zend_test_trait->ce_flags |= ZEND_ACC_TRAIT;
-	zend_declare_property_null(zend_test_trait, "testProp", sizeof("testProp")-1, ZEND_ACC_PUBLIC);
-#endif
-
 	return SUCCESS;
 }
 /* }}} */
@@ -567,9 +544,15 @@ ZEND_FUNCTION(strlen)
 {
 	zend_string *s;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &s) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(s)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	RETVAL_LONG(ZSTR_LEN(s));
 }
@@ -709,10 +692,16 @@ ZEND_FUNCTION(error_reporting)
 	zval *err;
 	int old_error_reporting;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|z", &err) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(0, 1)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_ZVAL(err)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	old_error_reporting = EG(error_reporting);
 	if (ZEND_NUM_ARGS() != 0) {
@@ -808,6 +797,9 @@ static void copy_constant_array(zval *dst, zval *src) /* {{{ */
 			}
 		} else if (Z_REFCOUNTED_P(val)) {
 			Z_ADDREF_P(val);
+			if (UNEXPECTED(Z_TYPE_INFO_P(val) == IS_RESOURCE_EX)) {
+				Z_TYPE_INFO_P(new_val) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
+			}
 		}
 	} ZEND_HASH_FOREACH_END();
 }
@@ -823,12 +815,18 @@ ZEND_FUNCTION(define)
 	int case_sensitive = CONST_CS;
 	zend_constant c;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sz|b", &name, &val, &non_cs) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_STR(name)
 		Z_PARAM_ZVAL(val)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(non_cs)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (non_cs) {
 		case_sensitive = 0;
@@ -850,7 +848,12 @@ repeat:
 		case IS_FALSE:
 		case IS_TRUE:
 		case IS_NULL:
+			break;
 		case IS_RESOURCE:
+			ZVAL_COPY(&val_free, val);
+			/* TODO: better solution than this tricky disable dtor on resource? */
+			Z_TYPE_INFO(val_free) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
+			val = &val_free;
 			break;
 		case IS_ARRAY:
 			if (!Z_IMMUTABLE_P(val)) {
@@ -904,9 +907,15 @@ ZEND_FUNCTION(defined)
 {
 	zend_string *name;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (zend_get_constant_ex(name, NULL, ZEND_FETCH_CLASS_SILENT)) {
 		RETURN_TRUE;
@@ -1002,12 +1011,18 @@ static void is_a_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool only_subclass) /*
 	zend_bool allow_string = only_subclass;
 	zend_bool retval;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS|b", &obj, &class_name, &allow_string) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_ZVAL(obj)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(allow_string)
 	ZEND_PARSE_PARAMETERS_END();
+#endif
 	/*
 	 * allow_string - is_a default is no, is_subclass_of is yes.
 	 *   if it's allowed, then the autoloader will be called if the class does not exist.
@@ -1146,12 +1161,16 @@ ZEND_FUNCTION(get_object_vars)
 	HashTable *properties;
 	zend_string *key;
 	zend_object *zobj;
-	zend_ulong index;
-	zend_bool fast_copy = 0;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "o", &obj) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (Z_OBJ_HT_P(obj)->get_properties == NULL) {
 		RETURN_FALSE;
@@ -1166,17 +1185,7 @@ ZEND_FUNCTION(get_object_vars)
 	zobj = Z_OBJ_P(obj);

 	if (!zobj->ce->default_properties_count && properties == zobj->properties && !ZEND_HASH_GET_APPLY_COUNT(properties)) {
-		fast_copy = 1;
-		/* Check if the object has a numeric property, See Bug 73998 */
-		ZEND_HASH_FOREACH_STR_KEY(properties, key) {
-			if (key && ZEND_HANDLE_NUMERIC(key, index)) {
-				fast_copy = 0;
-				break;
-			}
-		} ZEND_HASH_FOREACH_END();
-	}
-
-	if (fast_copy) {
+		/* fast copy */
 		if (EXPECTED(zobj->handlers == &std_object_handlers)) {
 			if (EXPECTED(!(GC_FLAGS(properties) & IS_ARRAY_IMMUTABLE))) {
 				GC_REFCOUNT(properties)++;
@@ -1202,7 +1211,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_symbtable_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_hash_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}
@@ -1297,11 +1306,16 @@ ZEND_FUNCTION(method_exists)
 	zend_string *lcname;
 	zend_class_entry * ce;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS", &klass, &method_name) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(2, 2)
 		Z_PARAM_ZVAL(klass)
 		Z_PARAM_STR(method_name)
 	ZEND_PARSE_PARAMETERS_END();
-	
+#endif
 	if (Z_TYPE_P(klass) == IS_OBJECT) {
 		ce = Z_OBJCE_P(klass);
 	} else if (Z_TYPE_P(klass) == IS_STRING) {
@@ -1397,11 +1411,17 @@ ZEND_FUNCTION(class_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &class_name, &autoload) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (!autoload) {
 		if (ZSTR_VAL(class_name)[0] == '\\') {
@@ -1434,11 +1454,17 @@ ZEND_FUNCTION(interface_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &iface_name, &autoload) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(iface_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (!autoload) {
 		if (ZSTR_VAL(iface_name)[0] == '\\') {
@@ -1470,11 +1496,17 @@ ZEND_FUNCTION(trait_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &trait_name, &autoload) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(trait_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (!autoload) {
 		if (ZSTR_VAL(trait_name)[0] == '\\') {
@@ -1507,9 +1539,15 @@ ZEND_FUNCTION(function_exists)
 	zend_function *func;
 	zend_string *lcname;

+#ifndef FAST_ZPP
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
+		return;
+	}
+#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
+#endif

 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Ignore leading "\" */
@@ -1872,22 +1910,13 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 	zend_function *func = Z_PTR_P(zv);
 	zval *internal_ar = va_arg(args, zval *),
 	     *user_ar     = va_arg(args, zval *);
-	zend_bool *exclude_disabled = va_arg(args, zend_bool *);

 	if (hash_key->key == NULL || ZSTR_VAL(hash_key->key)[0] == 0) {
 		return 0;
 	}

 	if (func->type == ZEND_INTERNAL_FUNCTION) {
-		char *disable_functions = INI_STR("disable_functions");
-
-		if ((*exclude_disabled == 1) && (disable_functions != NULL)) {
-			if (strstr(disable_functions, func->common.function_name->val) == NULL) {
-				add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-			}
-		} else {
-			add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-		}
+		add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
 	} else if (func->type == ZEND_USER_FUNCTION) {
 		add_next_index_str(user_ar, zend_string_copy(hash_key->key));
 	}
@@ -1901,9 +1930,8 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 ZEND_FUNCTION(get_defined_functions)
 {
 	zval internal, user;
-	zend_bool exclude_disabled = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|b", &exclude_disabled) == FAILURE) {
+	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}

@@ -1911,7 +1939,7 @@ ZEND_FUNCTION(get_defined_functions)
 	array_init(&user);
 	array_init(return_value);

-	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 3, &internal, &user, &exclude_disabled);
+	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 2, &internal, &user);

 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "internal", sizeof("internal")-1, &internal);
 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "user", sizeof("user")-1, &user);
@@ -2225,33 +2253,9 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(arg_array)) {
 			if (call->func->type == ZEND_USER_FUNCTION) {
-				uint32_t first_extra_arg = MIN(num_args, call->func->op_array.num_args);
+				uint32_t first_extra_arg = call->func->op_array.num_args;

-				if (UNEXPECTED(call->symbol_table)) {
-					/* In case of attached symbol_table, values on stack may be invalid
-					 * and we have to access them through symbol_table
-					 * See: https://bugs.php.net/bug.php?id=73156
-					 */
-					zend_string *arg_name;
-					zval *arg;
-
-					while (i < first_extra_arg) {
-						arg_name = call->func->op_array.vars[i];
-						arg = zend_hash_find_ind(call->symbol_table, arg_name);
-						if (arg) {
-							if (Z_OPT_REFCOUNTED_P(arg)) {
-								Z_ADDREF_P(arg);
-							}
-							n++;
-							ZEND_HASH_FILL_ADD(arg);
-						} else {
-							zval tmp;
-							ZVAL_UNDEF(&tmp);
-							ZEND_HASH_FILL_ADD(&tmp);
-						}
-						i++;
-					}
-				} else {
+				if (ZEND_CALL_NUM_ARGS(call) > first_extra_arg) {
 					while (i < first_extra_arg) {
 						if (EXPECTED(Z_TYPE_INFO_P(p) != IS_UNDEF)) {
 							if (Z_OPT_REFCOUNTED_P(p)) {
@@ -2263,8 +2267,8 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 						p++;
 						i++;
 					}
+					p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 				}
-				p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 			}

 			while (i < num_args) {
@@ -2368,19 +2372,13 @@ ZEND_FUNCTION(debug_print_backtrace)
 		object = Z_OBJ(call->This);

 		if (call->func) {
-			zend_string *zend_function_name;
-
 			func = call->func;
-            if (func->common.scope && func->common.scope->trait_aliases) {
-                zend_function_name = zend_resolve_method_name(object ? object->ce : func->common.scope, func);
-            } else {
-                zend_function_name = func->common.function_name;
-            }
-            if (zend_function_name != NULL) {
-                function_name = ZSTR_VAL(zend_function_name);
-            } else {
-                function_name = NULL;
-            }
+			function_name = (func->common.scope &&
+			                 func->common.scope->trait_aliases) ?
+				ZSTR_VAL(zend_resolve_method_name(
+					(object ? object->ce : func->common.scope), func)) :
+				(func->common.function_name ?
+					ZSTR_VAL(func->common.function_name) : NULL);
 		} else {
 			func = NULL;
 			function_name = NULL;
@@ -2622,6 +2620,7 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 				} else {
 					zend_string *class_name = object->handlers->get_class_name(object);
 					add_assoc_str_ex(&stack_frame, "class", sizeof("class")-1, class_name);
+					zend_string_release(class_name);
 				}
 				if ((options & DEBUG_BACKTRACE_PROVIDE_OBJECT) != 0) {
 					zval zv;
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -1002,8 +1002,10 @@ ZEND_API zend_class_entry *do_bind_class(const zend_op_array* op_array, const ze
 		op1 = RT_CONSTANT(op_array, opline->op1);
 		op2 = RT_CONSTANT(op_array, opline->op2);
 	}
-	ce = zend_hash_find_ptr(class_table, Z_STR_P(op1));
-	ZEND_ASSERT(ce);
+	if ((ce = zend_hash_find_ptr(class_table, Z_STR_P(op1))) == NULL) {
+		zend_error_noreturn(E_COMPILE_ERROR, "Internal Zend error - Missing class information for %s", Z_STRVAL_P(op1));
+		return NULL;
+	}
 	ce->refcount++;
 	if (zend_hash_add_ptr(class_table, Z_STR_P(op2), ce) == NULL) {
 		ce->refcount--;
@@ -1574,7 +1576,6 @@ int zendlex(zend_parser_stack_elem *elem) /* {{{ */
 {
 	zval zv;
 	int retval;
-	uint32_t start_lineno;

 	if (CG(increment_lineno)) {
 		CG(zend_lineno)++;
@@ -1583,7 +1584,6 @@ int zendlex(zend_parser_stack_elem *elem) /* {{{ */

 again:
 	ZVAL_UNDEF(&zv);
-	start_lineno = CG(zend_lineno);
 	retval = lex_scan(&zv);
 	if (EG(exception)) {
 		return T_ERROR;
@@ -1607,7 +1607,7 @@ again:
 			break;
 	}
 	if (Z_TYPE(zv) != IS_UNDEF) {
-		elem->ast = zend_ast_create_zval_with_lineno(&zv, 0, start_lineno);
+		elem->ast = zend_ast_create_zval(&zv);
 	}

 	return retval;
@@ -1944,42 +1944,10 @@ static inline uint32_t zend_emit_jump(uint32_t opnum_target) /* {{{ */
 }
 /* }}} */

-ZEND_API int zend_is_smart_branch(zend_op *opline) /* {{{ */
-{
-	switch (opline->opcode) {
-		case ZEND_IS_IDENTICAL:
-		case ZEND_IS_NOT_IDENTICAL:
-		case ZEND_IS_EQUAL:
-		case ZEND_IS_NOT_EQUAL:
-		case ZEND_IS_SMALLER:
-		case ZEND_IS_SMALLER_OR_EQUAL:
-		case ZEND_CASE:
-		case ZEND_ISSET_ISEMPTY_VAR:
-		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
-		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
-		case ZEND_INSTANCEOF:
-		case ZEND_TYPE_CHECK:
-		case ZEND_DEFINED:
-			return 1;
-		default:
-			return 0;
-	}
-}
-/* }}} */
-
 static inline uint32_t zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target) /* {{{ */
 {
 	uint32_t opnum = get_next_op_number(CG(active_op_array));
-	zend_op *opline;
-
-	if ((cond->op_type & (IS_CV|IS_CONST))
-	 && opnum > 0
-	 && zend_is_smart_branch(CG(active_op_array)->opcodes + opnum - 1)) {
-		/* emit extra NOP to avoid incorrect SMART_BRANCH in very rare cases */
-		zend_emit_op(NULL, ZEND_NOP, NULL, NULL);
-		opnum = get_next_op_number(CG(active_op_array));
-	}
-	opline = zend_emit_op(NULL, opcode, cond, NULL);
+	zend_op *opline = zend_emit_op(NULL, opcode, cond, NULL);
 	opline->op2.opline_num = opnum_target;
 	return opnum;
 }
@@ -2783,21 +2751,12 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
 			}
 		} else {
 			zend_compile_expr(&arg_node, arg);
+			ZEND_ASSERT(arg_node.op_type != IS_CV);
 			if (arg_node.op_type == IS_VAR) {
 				opcode = ZEND_SEND_VAR_NO_REF;
 				if (fbc && ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
 					flags |= ZEND_ARG_SEND_BY_REF;
 				}
-			} else if (arg_node.op_type == IS_CV) {
-				if (fbc) {
-					if (ARG_SHOULD_BE_SENT_BY_REF(fbc, arg_num)) {
-						opcode = ZEND_SEND_REF;
-					} else {
-						opcode = ZEND_SEND_VAR;
-					}
-				} else {
-					opcode = ZEND_SEND_VAR_EX;
-				}
 			} else {
 				if (fbc) {
 					opcode = ZEND_SEND_VAL;
@@ -4368,12 +4327,8 @@ void zend_compile_declare(zend_ast *ast) /* {{{ */
 		zend_ast *declare_ast = declares->child[i];
 		zend_ast *name_ast = declare_ast->child[0];
 		zend_ast *value_ast = declare_ast->child[1];
+
 		zend_string *name = zend_ast_get_str(name_ast);
-
-		if (value_ast->kind != ZEND_AST_ZVAL) {
-			zend_error_noreturn(E_COMPILE_ERROR, "declare(%s) value must be a literal", ZSTR_VAL(name));
-		}
-
 		if (zend_string_equals_literal_ci(name, "ticks")) {
 			zval value_zv;
 			zend_const_expr_to_zval(&value_zv, value_ast);
@@ -5512,41 +5467,6 @@ static void zend_check_already_in_use(uint32_t type, zend_string *old_name, zend
 }
 /* }}} */

-static void zend_check_use_conflict(
-		uint32_t type, zend_string *old_name, zend_string *new_name, zend_string *lookup_name) {
-	switch (type) {
-		case T_CLASS:
-		{
-			zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
-			if (ce && ce->type == ZEND_USER_CLASS
-				&& ce->info.user.filename == CG(compiled_filename)
-			) {
-				zend_check_already_in_use(type, old_name, new_name, lookup_name);
-			}
-			break;
-		}
-		case T_FUNCTION:
-		{
-			zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
-			if (fn && fn->type == ZEND_USER_FUNCTION
-				&& fn->op_array.filename == CG(compiled_filename)
-			) {
-				zend_check_already_in_use(type, old_name, new_name, lookup_name);
-			}
-			break;
-		}
-		case T_CONST:
-		{
-			zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
-			if (filename && filename == CG(compiled_filename)) {
-				zend_check_already_in_use(type, old_name, new_name, lookup_name);
-			}
-			break;
-		}
-		EMPTY_SWITCH_DEFAULT_CASE()
-	}
-}
-
 void zend_compile_use(zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
@@ -5603,11 +5523,43 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
 			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));

-			zend_check_use_conflict(type, old_name, new_name, ns_name);
+			if (zend_hash_exists(CG(class_table), ns_name)) {
+				zend_check_already_in_use(type, old_name, new_name, ns_name);
+			}

 			zend_string_free(ns_name);
 		} else {
-			zend_check_use_conflict(type, old_name, new_name, lookup_name);
+			switch (type) {
+				case T_CLASS:
+				{
+					zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
+					if (ce && ce->type == ZEND_USER_CLASS
+						&& ce->info.user.filename == CG(compiled_filename)
+					) {
+						zend_check_already_in_use(type, old_name, new_name, lookup_name);
+					}
+					break;
+				}
+				case T_FUNCTION:
+				{
+					zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
+					if (fn && fn->type == ZEND_USER_FUNCTION
+						&& fn->op_array.filename == CG(compiled_filename)
+					) {
+						zend_check_already_in_use(type, old_name, new_name, lookup_name);
+					}
+					break;
+				}
+				case T_CONST:
+				{
+					zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
+					if (filename && filename == CG(compiled_filename)) {
+						zend_check_already_in_use(type, old_name, new_name, lookup_name);
+					}
+					break;
+				}
+				EMPTY_SWITCH_DEFAULT_CASE()
+			}
 		}

 		zend_string_addref(old_name);
@@ -5966,11 +5918,7 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 					break;
 			}
 		} else {
-			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), value)) {
-				zval_ptr_dtor_nogc(value);
-				zval_ptr_dtor(result);
-				return 0;
-			}
+			zend_hash_next_index_insert(Z_ARRVAL_P(result), value);
 		}
 	}

@@ -6669,11 +6617,8 @@ void zend_compile_class_const(znode *result, zend_ast *ast) /* {{{ */
 		return;
 	}

-	zend_eval_const_expr(&ast->child[0]);
-	zend_eval_const_expr(&ast->child[1]);
-
-	class_ast = ast->child[0];
-	const_ast = ast->child[1];
+	zend_eval_const_expr(&class_ast);
+	zend_eval_const_expr(&const_ast);

 	if (class_ast->kind == ZEND_AST_ZVAL) {
 		resolved_name = zend_resolve_class_name_ast(class_ast);
@@ -7317,8 +7262,6 @@ void zend_compile_expr(znode *result, zend_ast *ast) /* {{{ */

 void zend_compile_var(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 {
-	CG(zend_lineno) = zend_ast_get_lineno(ast);
-
 	switch (ast->kind) {
 		case ZEND_AST_VAR:
 			zend_compile_simple_var(result, ast, type, 0);
@@ -7615,11 +7558,8 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				break;
 			}

-			zend_eval_const_expr(&ast->child[0]);
-			zend_eval_const_expr(&ast->child[1]);
-
-			class_ast = ast->child[0];
-			name_ast = ast->child[1];
+			zend_eval_const_expr(&class_ast);
+			zend_eval_const_expr(&name_ast);

 			if (name_ast->kind == ZEND_AST_ZVAL && zend_string_equals_literal_ci(zend_ast_get_str(name_ast), "class")) {
 				zend_error_noreturn(E_COMPILE_ERROR,
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -761,7 +761,6 @@ ZEND_API char *zend_make_compiled_string_description(const char *name);
 ZEND_API void zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers);
 uint32_t zend_get_class_fetch_type(zend_string *name);
 ZEND_API zend_uchar zend_get_call_op(zend_uchar init_op, zend_function *fbc);
-ZEND_API int zend_is_smart_branch(zend_op *opline);

 typedef zend_bool (*zend_auto_global_callback)(zend_string *name);
 typedef struct _zend_auto_global {
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -186,9 +186,7 @@ ZEND_API void zend_clear_exception(void) /* {{{ */
 	}
 	OBJ_RELEASE(EG(exception));
 	EG(exception) = NULL;
-	if (EG(current_execute_data)) {
-		EG(current_execute_data)->opline = EG(opline_before_exception);
-	}
+	EG(current_execute_data)->opline = EG(opline_before_exception);
 #if ZEND_DEBUG
 	EG(opline_before_exception) = NULL;
 #endif
@@ -295,7 +293,10 @@ ZEND_METHOD(exception, __construct)
 #define CHECK_EXC_TYPE(name, type) \
 	pvalue = zend_read_property(i_get_exception_base(object), (object), name, sizeof(name) - 1, 1, &value); \
 	if (Z_TYPE_P(pvalue) != IS_NULL && Z_TYPE_P(pvalue) != type) { \
-		zend_unset_property(i_get_exception_base(object), object, name, sizeof(name)-1); \
+		zval tmp; \
+		ZVAL_STRINGL(&tmp, name, sizeof(name) - 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, &tmp, NULL); \
+		zval_ptr_dtor(&tmp); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -308,12 +309,7 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	pvalue = zend_read_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1, 1, &value);
-	if (pvalue && Z_TYPE_P(pvalue) != IS_NULL && (Z_TYPE_P(pvalue) != IS_OBJECT ||
-			!instanceof_function(Z_OBJCE_P(pvalue), i_get_exception_base(object)) ||
-			pvalue == object)) {
-		zend_unset_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1);
-	}
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
 }
 /* }}} */

@@ -556,8 +552,8 @@ static void _build_trace_args(zval *arg, smart_str *str) /* {{{ */
 			break;
 		case IS_DOUBLE: {
 			double dval = Z_DVAL_P(arg);
-			char *s_tmp;
-			size_t l_tmp = zend_spprintf(&s_tmp, MAX_LENGTH_OF_DOUBLE + EG(precision) + 1, "%.*G", (int) EG(precision), dval);  /* SAFE */
+			char *s_tmp = emalloc(MAX_LENGTH_OF_DOUBLE + EG(precision) + 1);
+			int l_tmp = zend_sprintf(s_tmp, "%.*G", (int) EG(precision), dval);  /* SAFE */
 			smart_str_appendl(str, s_tmp, l_tmp);
 			smart_str_appends(str, ", ");
 			efree(s_tmp);
@@ -775,25 +771,10 @@ ZEND_METHOD(exception, __toString)
 		zend_string_release(file);
 		zval_ptr_dtor(&trace);

-		Z_OBJPROP_P(exception)->u.v.nApplyCount++;
 		exception = GET_PROPERTY(exception, "previous");
-		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->u.v.nApplyCount > 0) {
-			break;
-		}
 	}
 	zval_dtor(&fname);

-	exception = getThis();
-	/* Reset apply counts */
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT && (base_ce = i_get_exception_base(exception)) && instanceof_function(Z_OBJCE_P(exception), base_ce)) {
-		if (Z_OBJPROP_P(exception)->u.v.nApplyCount) {
-			Z_OBJPROP_P(exception)->u.v.nApplyCount--;
-		} else {
-			break;
-		}
-		exception = GET_PROPERTY(exception, "previous");
-	}
-
 	exception = getThis();
 	base_ce = i_get_exception_base(exception);

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -145,8 +145,7 @@ static const zend_internal_function zend_pass_function = {
 	((ZEND_VM_STACK_PAGE_SLOTS(gen) - ZEND_VM_STACK_HEADER_SLOTS) * sizeof(zval))

 #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(gen, size) \
-	(((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
-	  + (ZEND_VM_STACK_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1))
+	(((size) + (ZEND_VM_STACK_FREE_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1))

 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
 	zend_vm_stack page = (zend_vm_stack)emalloc(size);
@@ -585,17 +584,7 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v

 	ref = Z_REF_P(value_ptr);
 	GC_REFCOUNT(ref)++;
-	if (Z_REFCOUNTED_P(variable_ptr)) {
-		zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
-
-		if (--GC_REFCOUNT(garbage) == 0) {
-			ZVAL_REF(variable_ptr, ref);
-			zval_dtor_func_for_ptr(garbage);
-			return;
-		} else {
-			GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr);
-		}
-	}
+	zval_ptr_dtor(variable_ptr);
 	ZVAL_REF(variable_ptr, ref);
 }

@@ -603,9 +592,7 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v
 static inline int make_real_object(zval *object)
 {
 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
-		if (UNEXPECTED(object == &EG(error_zval))) {
-			return 0;
-		} else if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) {
+		if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) {
 			/* nothing to destroy */
 		} else if (EXPECTED((Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0))) {
 			zval_ptr_dtor_nogc(object);
@@ -835,8 +822,11 @@ static zend_always_inline int zend_verify_arg_type(zend_function *zf, uint32_t a
 				} else {
 					ce = zend_verify_arg_class_kind(cur_arg_info);
 					if (UNEXPECTED(!ce)) {
-						ZEND_ASSERT(Z_TYPE_P(arg) != IS_OBJECT);
-						zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "", zend_zval_type_name(arg), arg);
+						if (Z_TYPE_P(arg) == IS_OBJECT) {
+							zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name), arg);
+						} else {
+							zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "", zend_zval_type_name(arg), arg);
+						}
 						return 0;
 					}
 					*cache_slot = (void*)ce;
@@ -1343,7 +1333,6 @@ static void zend_assign_to_string_offset(zval *str, zend_long offset, zval *valu
 		zend_string_release(tmp);
 	} else {
 		Z_STRVAL_P(str)[offset] = Z_STRVAL_P(value)[0];
-		zend_string_forget_hash_val(Z_STR_P(str));
 	}
 	/*
 	 * the value of an assignment to a string offset is undefined
@@ -1412,11 +1401,11 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 	zval rv;

 	if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-		zval *z, *zptr, obj;
+		zval *z, obj;
 				
 		ZVAL_OBJ(&obj, Z_OBJ_P(object));
 		Z_ADDREF(obj);
-		zptr = z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
+		z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
 		if (UNEXPECTED(EG(exception))) {
 			OBJ_RELEASE(Z_OBJ(obj));
 			return;
@@ -1443,7 +1432,7 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 		}
 		Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
 		OBJ_RELEASE(Z_OBJ(obj));
-		zval_ptr_dtor(zptr);
+		zval_ptr_dtor(z);
 	} else {
 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
 		if (UNEXPECTED(result)) {
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -79,10 +79,6 @@ static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval
 				return variable_ptr;
 			}
 			if (ZEND_CONST_COND(value_type & (IS_VAR|IS_CV), 1) && variable_ptr == value) {
-				if (value_type == IS_VAR && ref) {
-					ZEND_ASSERT(GC_REFCOUNT(ref) > 1);
-					--GC_REFCOUNT(ref);
-				}
 				return variable_ptr;
 			}
 			garbage = Z_COUNTED_P(variable_ptr);
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -343,10 +343,6 @@ void shutdown_executor(void) /* {{{ */
 		zend_llist_destroy(&CG(open_files));
 	} zend_end_try();

-	zend_try {
-		clean_non_persistent_constants();
-    } zend_end_try();
-
 	zend_try {
 		zend_close_rsrc_list(&EG(regular_list));
 	} zend_end_try();
@@ -378,6 +374,10 @@ void shutdown_executor(void) /* {{{ */
 		}
 	} zend_end_try();

+	zend_try {
+		clean_non_persistent_constants();
+	} zend_end_try();
+
 	zend_try {
 #if 0&&ZEND_DEBUG
 	signal(SIGSEGV, original_sigsegv_handler);
@@ -573,6 +573,8 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_bool inline_change, zend_clas
 				ZVAL_EMPTY_STRING(p);
 			}
 		} else if (UNEXPECTED((const_value = zend_get_constant_ex(Z_STR_P(p), scope, Z_CONST_FLAGS_P(p))) == NULL)) {
+			char *actual = Z_STRVAL_P(p);
+
 			if (UNEXPECTED(EG(exception))) {
 				RESET_CONSTANT_VISITED(p);
 				return FAILURE;
@@ -582,38 +584,46 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_bool inline_change, zend_clas
 				return FAILURE;
 			} else {
 				zend_string *save = Z_STR_P(p);
+				char *slash;
+				size_t actual_len = Z_STRLEN_P(p);
+				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) && (slash = (char *)zend_memrchr(actual, '\\', actual_len))) {
+					actual = slash + 1;
+					actual_len -= (actual - Z_STRVAL_P(p));
+					if (inline_change) {
+						zend_string *s = zend_string_init(actual, actual_len, 0);
+						Z_STR_P(p) = s;
+						Z_TYPE_FLAGS_P(p) = IS_TYPE_REFCOUNTED | IS_TYPE_COPYABLE;
+					}
+				}
+				if (actual[0] == '\\') {
+					if (inline_change) {
+						memmove(Z_STRVAL_P(p), Z_STRVAL_P(p)+1, Z_STRLEN_P(p));
+						--Z_STRLEN_P(p);
+					} else {
+						++actual;
+					}
+					--actual_len;
+				}
 				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) == 0) {
 					if (ZSTR_VAL(save)[0] == '\\') {
 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save) + 1);
 					} else {
 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save));
 					}
+					if (inline_change) {
+						zend_string_release(save);
+					}
 					RESET_CONSTANT_VISITED(p);
 					return FAILURE;
 				} else {
-					char *actual = Z_STRVAL_P(p);
-					size_t actual_len = Z_STRLEN_P(p);
-					char *slash = (char *) zend_memrchr(actual, '\\', actual_len);
-					if (slash) {
-						actual = slash + 1;
-						actual_len -= (actual - Z_STRVAL_P(p));
-					}
-
-					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
-					if (EG(exception)) {
-						RESET_CONSTANT_VISITED(p);
-						return FAILURE;
-					}
-
+					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'",  actual,  actual);
 					if (!inline_change) {
 						ZVAL_STRINGL(p, actual, actual_len);
 					} else {
-						if (slash) {
-							ZVAL_STRINGL(p, actual, actual_len);
+						Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
+							IS_STRING_EX : IS_INTERNED_STRING_EX;
+						if (save && ZSTR_VAL(save) != actual) {
 							zend_string_release(save);
-						} else {
-							Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
-								IS_STRING_EX : IS_INTERNED_STRING_EX;
 						}
 					}
 				}
@@ -755,15 +765,6 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 			}
 			zend_error(E_DEPRECATED, "%s", error);
 			efree(error);
-			if (UNEXPECTED(EG(exception))) {
-				if (callable_name) {
-					zend_string_release(callable_name);
-				}
-				if (EG(current_execute_data) == &dummy_execute_data) {
-					EG(current_execute_data) = dummy_execute_data.prev_execute_data;
-				}
-				return FAILURE;
-			}
 		}
 		zend_string_release(callable_name);
 	}
@@ -861,11 +862,8 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 		EG(scope) = func->common.scope;
 		call->symbol_table = fci->symbol_table;
 		if (EXPECTED((func->op_array.fn_flags & ZEND_ACC_GENERATOR) == 0)) {
-			const zend_op *current_opline_before_exception = EG(opline_before_exception);
-
 			zend_init_execute_data(call, &func->op_array, fci->retval);
 			zend_execute_ex(call);
-			EG(opline_before_exception) = current_opline_before_exception;
 		} else {
 			zend_generator_create_zval(call, &func->op_array, fci->retval);
 		}
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -25,12 +25,26 @@
 /* one (0) is reserved */
 #define GC_ROOT_BUFFER_MAX_ENTRIES 10001

+#define GC_FAKE_BUFFER_FLAG 0x80
+#define GC_TYPE_MASK        0x7f
+
 #define GC_HAS_DESTRUCTORS  (1<<0)

 #ifndef ZEND_GC_DEBUG
 # define ZEND_GC_DEBUG 0
 #endif

+#define GC_NUM_ADDITIONAL_ENTRIES \
+	((4096 - ZEND_MM_OVERHEAD - sizeof(void*) * 2) / sizeof(gc_root_buffer))
+
+typedef struct _gc_addtional_bufer gc_additional_buffer;
+
+struct _gc_addtional_bufer {
+	uint32_t              used;
+	gc_additional_buffer *next;
+	gc_root_buffer        buf[GC_NUM_ADDITIONAL_ENTRIES];
+};
+
 #ifdef ZTS
 ZEND_API int gc_globals_id;
 #else
@@ -39,6 +53,9 @@ ZEND_API zend_gc_globals gc_globals;

 ZEND_API int (*gc_collect_cycles)(void);

+#define GC_REMOVE_FROM_ROOTS(current) \
+	gc_remove_from_roots((current))
+
 #if ZEND_GC_DEBUG > 1
 # define GC_TRACE(format, ...) fprintf(stderr, format "\n", ##__VA_ARGS__);
 # define GC_TRACE_REF(ref, format, ...) \
@@ -106,12 +123,6 @@ static zend_always_inline void gc_remove_from_roots(gc_root_buffer *root)
 	GC_BENCH_DEC(root_buf_length);
 }

-static zend_always_inline void gc_remove_from_additional_roots(gc_root_buffer *root)
-{
-	root->next->prev = root->prev;
-	root->prev->next = root->next;
-}
-
 static void root_buffer_dtor(zend_gc_globals *gc_globals)
 {
 	if (gc_globals->buf) {
@@ -138,8 +149,6 @@ static void gc_globals_ctor_ex(zend_gc_globals *gc_globals)
 	gc_globals->gc_runs = 0;
 	gc_globals->collected = 0;

-	gc_globals->additional_buffer = NULL;
-
 #if GC_BENCH
 	gc_globals->root_buf_length = 0;
 	gc_globals->root_buf_peak = 0;
@@ -195,8 +204,6 @@ ZEND_API void gc_reset(void)
 		GC_G(first_unused) = NULL;
 		GC_G(last_unused) = NULL;
 	}
-
-	GC_G(additional_buffer) = NULL;
 }

 ZEND_API void gc_init(void)
@@ -269,45 +276,21 @@ ZEND_API void ZEND_FASTCALL gc_possible_root(zend_refcounted *ref)
 	GC_BENCH_PEAK(root_buf_peak, root_buf_length);
 }

-static zend_always_inline gc_root_buffer* gc_find_additional_buffer(zend_refcounted *ref)
-{
-	gc_additional_buffer *additional_buffer = GC_G(additional_buffer);
-
-	/* We have to check each additional_buffer to find which one holds the ref */
-	while (additional_buffer) {
-		uint32_t idx = GC_ADDRESS(GC_INFO(ref)) - GC_ROOT_BUFFER_MAX_ENTRIES;
-		if (idx < additional_buffer->used) {
-			gc_root_buffer *root = additional_buffer->buf + idx;
-			if (root->ref == ref) {
-				return root;
-			}
-		}
-		additional_buffer = additional_buffer->next;
-	}
-
-	ZEND_ASSERT(0);
-	return NULL;
-}
-
 ZEND_API void ZEND_FASTCALL gc_remove_from_buffer(zend_refcounted *ref)
 {
 	gc_root_buffer *root;

 	ZEND_ASSERT(GC_ADDRESS(GC_INFO(ref)));
+	ZEND_ASSERT(GC_ADDRESS(GC_INFO(ref)) < GC_ROOT_BUFFER_MAX_ENTRIES);

 	GC_BENCH_INC(zval_remove_from_buffer);

-	if (EXPECTED(GC_ADDRESS(GC_INFO(ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
-		root = GC_G(buf) + GC_ADDRESS(GC_INFO(ref));
-		gc_remove_from_roots(root);
-	} else {
-		root = gc_find_additional_buffer(ref);
-		gc_remove_from_additional_roots(root);
-	}
+	root = GC_G(buf) + GC_ADDRESS(GC_INFO(ref));
 	if (GC_REF_GET_COLOR(ref) != GC_BLACK) {
 		GC_TRACE_SET_COLOR(ref, GC_PURPLE);
 	}
 	GC_INFO(ref) = 0;
+	GC_REMOVE_FROM_ROOTS(root);

 	/* updete next root that is going to be freed */
 	if (GC_G(next_to_free) == root) {
@@ -658,7 +641,7 @@ static void gc_scan_roots(void)
 	}
 }

-static void gc_add_garbage(zend_refcounted *ref)
+static void gc_add_garbage(zend_refcounted *ref, gc_additional_buffer **additional_buffer)
 {
 	gc_root_buffer *buf = GC_G(unused);

@@ -681,23 +664,25 @@ static void gc_add_garbage(zend_refcounted *ref)
 #endif
 	} else {
 		/* If we don't have free slots in the buffer, allocate a new one and
-		 * set it's address above GC_ROOT_BUFFER_MAX_ENTRIES that have special
+		 * set it's address to GC_ROOT_BUFFER_MAX_ENTRIES that have special
 		 * meaning.
 		 */
-		if (!GC_G(additional_buffer) || GC_G(additional_buffer)->used == GC_NUM_ADDITIONAL_ENTRIES) {
+		if (!*additional_buffer || (*additional_buffer)->used == GC_NUM_ADDITIONAL_ENTRIES) {
 			gc_additional_buffer *new_buffer = emalloc(sizeof(gc_additional_buffer));
 			new_buffer->used = 0;
-			new_buffer->next = GC_G(additional_buffer);
-			GC_G(additional_buffer) = new_buffer;
+			new_buffer->next = *additional_buffer;
+			*additional_buffer = new_buffer;
 		}
-		buf = GC_G(additional_buffer)->buf + GC_G(additional_buffer)->used;
+		buf = (*additional_buffer)->buf + (*additional_buffer)->used;
+		(*additional_buffer)->used++;
 #if 1
 		/* optimization: color is already GC_BLACK (0) */
-		GC_INFO(ref) = GC_ROOT_BUFFER_MAX_ENTRIES + GC_G(additional_buffer)->used;
+		GC_INFO(ref) = GC_ROOT_BUFFER_MAX_ENTRIES;
 #else
-		GC_REF_SET_ADDRESS(ref, GC_ROOT_BUFFER_MAX_ENTRIES) + GC_G(additional_buffer)->used;
+		GC_REF_SET_ADDRESS(ref, GC_ROOT_BUFFER_MAX_ENTRIES);
 #endif
-		GC_G(additional_buffer)->used++;
+		/* modify type to prevent indirect destruction */
+		GC_TYPE(ref) |= GC_FAKE_BUFFER_FLAG;
 	}
 	if (buf) {
 		GC_REFCOUNT(ref)++;
@@ -709,7 +694,7 @@ static void gc_add_garbage(zend_refcounted *ref)
 	}
 }

-static int gc_collect_white(zend_refcounted *ref, uint32_t *flags)
+static int gc_collect_white(zend_refcounted *ref, uint32_t *flags, gc_additional_buffer **additional_buffer)
 {
 	int count = 0;
 	HashTable *ht;
@@ -742,7 +727,7 @@ tail_call:
 #else
 				if (!GC_ADDRESS(GC_INFO(ref))) {
 #endif
-					gc_add_garbage(ref);
+					gc_add_garbage(ref, additional_buffer);
 				}
 				if (obj->handlers->dtor_obj &&
 				    ((obj->handlers->dtor_obj != zend_objects_destroy_object) ||
@@ -766,7 +751,7 @@ tail_call:
 					if (Z_REFCOUNTED_P(zv)) {
 						ref = Z_COUNTED_P(zv);
 						GC_REFCOUNT(ref)++;
-						count += gc_collect_white(ref, flags);
+						count += gc_collect_white(ref, flags, additional_buffer);
 					/* count non-refcounted for compatibility ??? */
 					} else if (Z_TYPE_P(zv) != IS_UNDEF) {
 						count++;
@@ -788,7 +773,7 @@ tail_call:
 #else
 				if (!GC_ADDRESS(GC_INFO(ref))) {
 #endif
-				gc_add_garbage(ref);
+				gc_add_garbage(ref, additional_buffer);
 			}
 			ht = (zend_array*)ref;
 		} else if (GC_TYPE(ref) == IS_REFERENCE) {
@@ -828,7 +813,7 @@ tail_call:
 			if (Z_REFCOUNTED_P(zv)) {
 				ref = Z_COUNTED_P(zv);
 				GC_REFCOUNT(ref)++;
-				count += gc_collect_white(ref, flags);
+				count += gc_collect_white(ref, flags, additional_buffer);
 				/* count non-refcounted for compatibility ??? */
 			} else if (Z_TYPE_P(zv) != IS_UNDEF) {
 				count++;
@@ -846,7 +831,7 @@ tail_call:
 	return count;
 }

-static int gc_collect_roots(uint32_t *flags)
+static int gc_collect_roots(uint32_t *flags, gc_additional_buffer **additional_buffer)
 {
 	int count = 0;
 	gc_root_buffer *current = GC_G(roots).next;
@@ -855,12 +840,8 @@ static int gc_collect_roots(uint32_t *flags)
 	while (current != &GC_G(roots)) {
 		gc_root_buffer *next = current->next;
 		if (GC_REF_GET_COLOR(current->ref) == GC_BLACK) {
-			if (EXPECTED(GC_ADDRESS(GC_INFO(current->ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
-				gc_remove_from_roots(current);
-			} else {
-				gc_remove_from_additional_roots(current);
-			}
 			GC_INFO(current->ref) = 0; /* reset GC_ADDRESS() and keep GC_BLACK */
+			GC_REMOVE_FROM_ROOTS(current);
 		}
 		current = next;
 	}
@@ -869,7 +850,7 @@ static int gc_collect_roots(uint32_t *flags)
 	while (current != &GC_G(roots)) {
 		GC_REFCOUNT(current->ref)++;
 		if (GC_REF_GET_COLOR(current->ref) == GC_WHITE) {
-			count += gc_collect_white(current->ref, flags);
+			count += gc_collect_white(current->ref, flags, additional_buffer);
 		}
 		current = current->next;
 	}
@@ -905,16 +886,13 @@ static void gc_remove_nested_data_from_buffer(zend_refcounted *ref, gc_root_buff
 tail_call:
 	if (root ||
 	    (GC_ADDRESS(GC_INFO(ref)) != 0 &&
-	     GC_REF_GET_COLOR(ref) == GC_BLACK)) {
+	     GC_REF_GET_COLOR(ref) == GC_BLACK &&
+	     GC_ADDRESS(GC_INFO(ref)) != GC_ROOT_BUFFER_MAX_ENTRIES)) {
 		GC_TRACE_REF(ref, "removing from buffer");
 		GC_REFCOUNT(ref)--;
 		if (root) {
-			if (EXPECTED(GC_ADDRESS(GC_INFO(root->ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
-				gc_remove_from_roots(root);
-			} else {
-				gc_remove_from_additional_roots(root);
-			}
 			GC_INFO(ref) = 0;
+			GC_REMOVE_FROM_ROOTS(root);
 			root = NULL;
 		} else {
 			GC_REMOVE_FROM_BUFFER(ref);
@@ -1008,7 +986,7 @@ ZEND_API int zend_gc_collect_cycles(void)
 		zend_refcounted *p;
 		gc_root_buffer to_free;
 		uint32_t gc_flags = 0;
-		gc_additional_buffer *additional_buffer_snapshot;
+		gc_additional_buffer *additional_buffer;
 #if ZEND_GC_DEBUG
 		zend_bool orig_gc_full;
 #endif
@@ -1032,8 +1010,8 @@ ZEND_API int zend_gc_collect_cycles(void)
 #endif

 		GC_TRACE("Collecting roots");
-		additional_buffer_snapshot = GC_G(additional_buffer);
-		count = gc_collect_roots(&gc_flags);
+		additional_buffer = NULL;
+		count = gc_collect_roots(&gc_flags, &additional_buffer);
 #if ZEND_GC_DEBUG
 		GC_G(gc_full) = orig_gc_full;
 #endif
@@ -1077,7 +1055,7 @@ ZEND_API int zend_gc_collect_cycles(void)
 				while (current != &to_free) {
 					p = current->ref;
 					GC_G(next_to_free) = current->next;
-					if (GC_TYPE(p) == IS_OBJECT) {
+					if ((GC_TYPE(p) & GC_TYPE_MASK) == IS_OBJECT) {
 						zend_object *obj = (zend_object*)p;

 						if (IS_OBJ_VALID(EG(objects_store).object_buckets[obj->handle]) &&
@@ -1114,7 +1092,7 @@ ZEND_API int zend_gc_collect_cycles(void)
 			p = current->ref;
 			GC_G(next_to_free) = current->next;
 			GC_TRACE_REF(p, "destroying");
-			if (GC_TYPE(p) == IS_OBJECT) {
+			if ((GC_TYPE(p) & GC_TYPE_MASK) == IS_OBJECT) {
 				zend_object *obj = (zend_object*)p;

 				if (EG(objects_store).object_buckets &&
@@ -1133,7 +1111,7 @@ ZEND_API int zend_gc_collect_cycles(void)
 					EG(objects_store).free_list_head = obj->handle;
 					p = current->ref = (zend_refcounted*)(((char*)obj) - obj->handlers->offset);
 				}
-			} else if (GC_TYPE(p) == IS_ARRAY) {
+			} else if ((GC_TYPE(p) & GC_TYPE_MASK) == IS_ARRAY) {
 				zend_array *arr = (zend_array*)p;

 				GC_TYPE(arr) = IS_NULL;
@@ -1155,10 +1133,10 @@ ZEND_API int zend_gc_collect_cycles(void)
 			current = next;
 		}

-		while (GC_G(additional_buffer) != additional_buffer_snapshot) {
-			gc_additional_buffer *next = GC_G(additional_buffer)->next;
-			efree(GC_G(additional_buffer));
-			GC_G(additional_buffer) = next;
+		while (additional_buffer != NULL) {
+			gc_additional_buffer *next = additional_buffer->next;
+			efree(additional_buffer);
+			additional_buffer = next;
 		}

 		GC_TRACE("Collection finished");
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -67,17 +67,6 @@ typedef struct _gc_root_buffer {
 	uint32_t                 refcount;
 } gc_root_buffer;

-#define GC_NUM_ADDITIONAL_ENTRIES \
-	((4096 - ZEND_MM_OVERHEAD - sizeof(void*) * 2) / sizeof(gc_root_buffer))
-
-typedef struct _gc_additional_bufer gc_additional_buffer;
-
-struct _gc_additional_bufer {
-	uint32_t              used;
-	gc_additional_buffer *next;
-	gc_root_buffer        buf[GC_NUM_ADDITIONAL_ENTRIES];
-};
-
 typedef struct _zend_gc_globals {
 	zend_bool         gc_enabled;
 	zend_bool         gc_active;
@@ -104,8 +93,6 @@ typedef struct _zend_gc_globals {
 	uint32_t zval_marked_grey;
 #endif

-	gc_additional_buffer *additional_buffer;
-
 } zend_gc_globals;

 #ifdef ZTS
Author	SHA1	Message	Date
Anatol Belski	da12ca9c1e	sync NEWS with entries and release date	2016-08-17 17:58:20 +02:00
Anatol Belski	d6f62b7d6e	apply missing patch for #72681	2016-08-17 16:31:00 +02:00
Anatol Belski	bd38aea92c	set version	2016-08-17 16:25:22 +02:00
Anatol Belski	40f48594d2	fix tests	2016-08-17 14:00:23 +02:00
Stanislav Malyshev	20ce2fe8e3	Fix bug #72663 - destroy broken object when unserializing (cherry picked from commit `448c9be157`)	2016-08-17 13:59:18 +02:00
Stanislav Malyshev	8d7766a948	fix test (cherry picked from commit `ed9d916c28`)	2016-08-17 13:53:22 +02:00
Nikita Popov	758a0cd8b3	Bug #72663 - part 3 When using the php_serialize session serialization handler, do not use the result of the unserialization if it failed. (cherry picked from commit `e0f9fbdfa6`)	2016-08-17 13:52:28 +02:00
Nikita Popov	d3221181c3	Bug #72663 - part 2 If a (nested) unserialize() call fails, we remove all the values that were inserted into var_hash during that call. This prevents their use in other unserializations in the same context. (cherry picked from commit `61f2f5a0f7`)	2016-08-17 13:51:06 +02:00
Nikita Popov	686f4e01e6	Bug #72663 - part 1 Don't call __destruct() on an unserialized object that has a __wakeup() method if either a) unserialization of its properties fails or b) the __wakeup() call fails (e.g. by throwing). This basically treats __wakeup() as a form of constructor and aligns us with the usual behavior that if the constructor call fails the destructor should not be called. The security aspect here is that people use __wakeup() to prevent unserialization of objects with dangerous __destruct() methods, but this is ineffective if __destruct() can still be called while __wakeup() was skipped. (cherry picked from commit `2135fdef9b`)	2016-08-17 13:51:05 +02:00
Stanislav Malyshev	d9fac3953d	Fix bug #72749 : wddx_deserialize allows illegal memory access (cherry picked from commit 659a21dc20f0b64dafd8cb16573059d3b45cce6b) Conflicts: ext/wddx/wddx.c (cherry picked from commit `e3829b8869`)	2016-08-17 13:46:52 +02:00
Stanislav Malyshev	749cae0fa1	Fixed bug #72627 : Memory Leakage In exif_process_IFD_in_TIFF (cherry picked from commit 620b01337cc39f856ca68c34c35e154f5f0682fc) Conflicts: ext/exif/exif.c (cherry picked from commit `24fb60ffe9`)	2016-08-17 13:46:34 +02:00
Anatol Belski	b0d8f96048	fix tests (cherry picked from commit `d926a48fd2`)	2016-08-17 13:46:15 +02:00
Anatol Belski	3493ed5b52	Fix bug#72697 - select_colors write out-of-bounds (cherry picked from commit b6f13a5ef9d6280cf984826a5de012a32c396cd4) Conflicts: ext/gd/gd.c (cherry picked from commit `28022c9b1f`)	2016-08-17 13:46:14 +02:00
Stanislav Malyshev	72d03f8aa4	Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation (cherry picked from commit c3f6d6da100c6451a540680504de4105b8bed83c) Conflicts: ext/snmp/snmp.c main/php_version.h (cherry picked from commit `b735a4419c`)	2016-08-17 13:45:47 +02:00
Stanislav Malyshev	bab470f6ba	Fix bug #72730 - imagegammacorrect allows arbitrary write access (cherry picked from commit 047fe0ed03093a496691d376fcf51a7e2f1d04b0) Conflicts: ext/gd/gd.c (cherry picked from commit `e70069a62f`)	2016-08-17 13:45:14 +02:00
Stanislav Malyshev	b2d89c93e8	Fix bug #72750 : wddx_deserialize null dereference (cherry picked from commit 6930a1d12c47aa1d2675837852910d177b0ceb11) Conflicts: ext/wddx/wddx.c (cherry picked from commit `f1486f0fd6`)	2016-08-17 13:45:00 +02:00
Anatol Belski	4dd455c6d2	Fix bug #72771 : ftps:// opendir wrapper is vulnerable to protocol downgrade attack (cherry picked from commit f9c2edb4dbc01a817989b70ca7726f177bb1a103) Conflicts: ext/standard/ftp_fopen_wrapper.c (cherry picked from commit `e5b0952be2`)	2016-08-17 13:44:47 +02:00
Stanislav Malyshev	52f58eeaec	Fix for bug #72790 and bug #72799 (cherry picked from commit a14fdb9746262549bbbb96abb87338bacd147e1b) Conflicts: ext/wddx/wddx.c (cherry picked from commit `0c8a2a2cd1`)	2016-08-17 13:43:58 +02:00
Anatol Belski	a20112a1d6	Fix bug #72837 - integer overflow in bzdecompress caused heap corruption Conflicts: ext/bz2/bz2.c (cherry picked from commit `67d0fe39ee`)	2016-08-17 11:33:06 +02:00
Stanislav Malyshev	5ba1cbec07	Fix for bug #72782 : mcrypt accepts only ints, so don't pass anything else (cherry picked from commit `4f6a97f532`)	2016-08-17 11:31:41 +02:00
Stanislav Malyshev	326ac100ac	Fix bug #72742 - memory allocator fails to realloc small block to large one (cherry picked from commit `c2a13ced42`)	2016-08-17 11:31:26 +02:00
Stanislav Malyshev	19c10bb629	Fix bug #72674 - check both curl_escape and curl_unescape (cherry picked from commit `72dbb7f416`)	2016-08-17 11:30:38 +02:00
Anatol Belski	0a85fd9877	sync NEWS	2016-08-14 22:57:39 +02:00
Anatol Belski	9a5dff415a	Revert "Implemented FR #72633 Postgres PDO lastInsertId() should work without specifying a sequence" This reverts commit `12628e9a46`.	2016-08-14 22:57:13 +02:00
Anatol Belski	bd6983bb1e	Revert "cleanup the table after the test run" This reverts commit `266c62070f`.	2016-08-14 22:57:02 +02:00
Anatol Belski	8889b13853	improve the check, avoid strlen on NULL (cherry picked from commit `9667ee4f72`)	2016-08-03 18:31:29 +02:00
Anatol Belski	e0e2323e7d	sync NEWS	2016-08-03 17:53:05 +02:00
Kalle Sommer Nielsen	91641c23fc	Changed the way MAKERNOTE is handled in case we do not have a matching signature (Remi). Before this patch, exif_process_IFD_in_MAKERNOTE() would return false, then causing the rest of the EXIF parsing to be interrupted. This is a regression from earlier which was most likely a part of a security fix for MAKERNOTE. The new behavior is to instead of stopping to parse, to continue so we can still fetch data like thumbnail and GPS, thrus allowing yet unsupported formats to parse. If EXIF's debugging mode is enabled, a notice will display in case we do not match against a valid MAKERNOTE signature. This should temporarily fix bug #72682 (exif_read_data() fails to read all data for some images) until I get around to debug it further. (cherry picked from commit `aabcb5481d`)	2016-08-03 17:46:59 +02:00
Anatol Belski	e8f76d10ab	update libs_versions.txt	2016-08-03 15:08:16 +02:00
Anatol Belski	be6b7e5eeb	set versions	2016-08-02 11:24:57 +02:00