set versions

sync NEWS
fix two remaining tests
2026-11-12 03:30:50 +00:00 · 2016-06-21 19:56:51 +02:00 · 2016-06-21 19:55:22 +02:00 · 2016-06-21 19:10:57 +02:00 · 2016-06-21 19:10:37 +02:00 · 2016-06-21 19:10:02 +02:00
582 changed files with 14951 additions and 5049 deletions
@@ -178,7 +178,7 @@ Internal Function Naming Convensions
    Unexposed module function should be static and should not be defined in
    'php_modulename.h'.

-    static int php_session_destroy(TSRMLS_D)
+    static int php_session_destroy()

 2.  Main module source file must be named 'modulename.c'.

@@ -5,7 +5,6 @@ Installing PHP

     * General Installation Considerations
     * Installation on Unix systems
-          + Apache 1.3.x on Unix systems
          + Apache 2.x on Unix systems
          + Lighttpd 1.4 on Unix systems
          + Sun, iPlanet and Netscape servers on Sun Solaris
@@ -103,7 +102,6 @@ Installation on Unix systems

 Table of Contents

-     * Apache 1.3.x on Unix systems
     * Apache 2.x on Unix systems
     * Lighttpd 1.4 on Unix systems
     * Sun, iPlanet and Netscape servers on Sun Solaris
@@ -163,208 +161,6 @@ Table of Contents
   you can't figure out why, see the Problems section.
     __________________________________________________________________

-Apache 1.3.x on Unix systems
-
-   This  section  contains  notes and hints specific to Apache installs of
-   PHP on Unix platforms. We also have instructions and notes for Apache 2
-   on a separate page.
-
-   You  can select arguments to add to the configure on line 10 below from
-   the  list of core configure options and from extension specific options
-   described  at  the respective places in the manual. The version numbers
-   have  been  omitted here, to ensure the instructions are not incorrect.
-   You  will  need  to replace the 'xxx' here with the correct values from
-   your files.
-
-   Example #1 Installation Instructions (Apache Shared Module Version) for
-   PHP
-1.  gunzip apache_xxx.tar.gz
-2.  tar -xvf apache_xxx.tar
-3.  gunzip php-xxx.tar.gz
-4.  tar -xvf php-xxx.tar
-5.  cd apache_xxx
-6.  ./configure --prefix=/www --enable-module=so
-7.  make
-8.  make install
-9.  cd ../php-xxx
-
-10. Now, configure your PHP.  This is where you customize your PHP
-    with various options, like which extensions will be enabled.  Do a
-    ./configure --help for a list of available options.  In our example
-    we'll do a simple configure with Apache 1 and MySQL support.  Your
-    path to apxs may differ from our example.
-
-      ./configure --with-mysql --with-apxs=/www/bin/apxs
-
-11. make
-12. make install
-
-    If you decide to change your configure options after installation,
-    you only need to repeat the last three steps. You only need to
-    restart apache for the new module to take effect. A recompile of
-    Apache is not needed.
-
-    Note that unless told otherwise, 'make install' will also install PEAR,
-    various PHP tools such as phpize, install the PHP CLI, and more.
-
-13. Setup your php.ini file:
-
-      cp php.ini-development /usr/local/lib/php.ini
-
-    You may edit your .ini file to set PHP options.  If you prefer your
-    php.ini in another location, use --with-config-file-path=/some/path in
-    step 10.
-
-    If you instead choose php.ini-production, be certain to read the list
-    of changes within, as they affect how PHP behaves.
-
-14. Edit your httpd.conf to load the PHP module.  The path on the right hand
-    side of the LoadModule statement must point to the path of the PHP
-    module on your system.  The make install from above may have already
-    added this for you, but be sure to check.
-
-      LoadModule php7_module libexec/libphp7.so
-
-15. And in the AddModule section of httpd.conf, somewhere under the
-    ClearModuleList, add this:
-
-      AddModule mod_php7.c
-
-16. Tell Apache to parse certain extensions as PHP.  For example,
-    let's have Apache parse the .php extension as PHP.  You could
-    have any extension(s) parse as PHP by simply adding more, with
-    each separated by a space.  We'll add .phtml to demonstrate.
-
-      AddType application/x-httpd-php .php .phtml
-
-    It's also common to setup the .phps extension to show highlighted PHP
-    source, this can be done with:
-
-      AddType application/x-httpd-php-source .phps
-
-17. Use your normal procedure for starting the Apache server. (You must
-    stop and restart the server, not just cause the server to reload by
-    using a HUP or USR1 signal.)
-
-   Alternatively, to install PHP as a static object:
-
-   Example  #2  Installation  Instructions (Static Module Installation for
-   Apache) for PHP
-1.  gunzip -c apache_1.3.x.tar.gz | tar xf -
-2.  cd apache_1.3.x
-3.  ./configure
-4.  cd ..
-
-5.  gunzip -c php-5.x.y.tar.gz | tar xf -
-6.  cd php-5.x.y
-7.  ./configure --with-mysql --with-apache=../apache_1.3.x
-8.  make
-9.  make install
-
-10. cd ../apache_1.3.x
-
-11. ./configure --prefix=/www --activate-module=src/modules/php7/libphp7.a
-    (The above line is correct! Yes, we know libphp7.a does not exist at this
-    stage. It isn't supposed to. It will be created.)
-
-12. make
-    (you should now have an httpd binary which you can copy to your Apache bin d
-ir if
-    it is your first install then you need to "make install" as well)
-
-13. cd ../php-5.x.y
-14. cp php.ini-development /usr/local/lib/php.ini
-
-15. You can edit /usr/local/lib/php.ini file to set PHP options.
-    Edit your httpd.conf or srm.conf file and add:
-    AddType application/x-httpd-php .php
-
-   Depending  on  your  Apache  install  and  Unix variant, there are many
-   possible  ways  to  stop and restart the server. Below are some typical
-   lines   used  in  restarting  the  server,  for  different  apache/unix
-   installations.  You  should  replace  /path/to/  with the path to these
-   applications on your systems.
-
-   Example #3 Example commands for restarting Apache
-1. Several Linux and SysV variants:
-/etc/rc.d/init.d/httpd restart
-
-2. Using apachectl scripts:
-/path/to/apachectl stop
-/path/to/apachectl start
-
-3. httpdctl and httpsdctl (Using OpenSSL), similar to apachectl:
-/path/to/httpsdctl stop
-/path/to/httpsdctl start
-
-4. Using mod_ssl, or another SSL server, you may want to manually
-stop and start:
-/path/to/apachectl stop
-/path/to/apachectl startssl
-
-   The  locations of the apachectl and http(s)dctl binaries often vary. If
-   your  system  has locate or whereis or which commands, these can assist
-   you in finding your server control programs.
-
-   Different examples of compiling PHP for apache are as follows:
-./configure --with-apxs --with-pgsql
-
-   This will create a libphp7.so shared library that is loaded into Apache
-   using  a  LoadModule  line  in Apache's httpd.conf file. The PostgreSQL
-   support is embedded into this library.
-
-./configure --with-apxs --with-pgsql=shared
-
-   This  will  create  a libphp7.so shared library for Apache, but it will
-   also create a pgsql.so shared library that is loaded into PHP either by
-   using  the  extension  directive  in  php.ini  file  or  by  loading it
-   explicitly in a script using the dl() function.
-
-./configure --with-apache=/path/to/apache_source --with-pgsql
-
-   This  will  create  a  libmodphp7.a  library,  a  mod_php7.c  and  some
-   accompanying files and copy this into the src/modules/php7 directory in
-   the    Apache    source   tree.   Then   you   compile   Apache   using
-   --activate-module=src/modules/php7/libphp7.a   and   the  Apache  build
-   system  will  create  libphp7.a  and  link it statically into the httpd
-   binary.  The  PostgreSQL  support  is included directly into this httpd
-   binary, so the final result here is a single httpd binary that includes
-   all of Apache and all of PHP.
-
-./configure --with-apache=/path/to/apache_source --with-pgsql=shared
-
-   Same as before, except instead of including PostgreSQL support directly
-   into  the  final  httpd you will get a pgsql.so shared library that you
-   can load into PHP from either the php.ini file or directly using dl().
-
-   When  choosing  to build PHP in different ways, you should consider the
-   advantages  and  drawbacks  of each method. Building as a shared object
-   will  mean  that  you  can compile apache separately, and don't have to
-   recompile  everything  as you add to, or change, PHP. Building PHP into
-   apache  (static  method)  means  that PHP will load and run faster. For
-   more information, see the Apache » web page on DSO support.
-
-     Note:
-
-     Apache's  default  httpd.conf  currently  ships  with a section that
-     looks like this:
-
-User nobody
-Group "#-1"
-
-     Unless  you  change  that  to "Group nogroup" or something like that
-     ("Group  daemon"  is  also very common) PHP will not be able to open
-     files.
-
-     Note:
-
-     Make  sure  you  specify  the  installed  version of apxs when using
-     --with-apxs=/path/to/apxs  .  You must NOT use the apxs version that
-     is  in  the apache sources but the one that is actually installed on
-     your system.
-     __________________________________________________________________
-     __________________________________________________________________
-
 Apache 2.x on Unix systems

   This  section  contains notes and hints specific to Apache 2.x installs
@@ -1,5 +1,383 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+23 Jun 2016 PHP 7.0.8
+
+- Core:
+  . Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashes). 
+    (Esminis at esminis dot lt)
+  . Fixed bug #72221 (segfault, past-the-end access). (Lauri Kenttä)
+  . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas)
+  . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/
+    json_utf8_to_utf16()). (Stas)
+  . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas)
+  . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas)
+
+- FPM:
+  . Fixed bug #72308 (fastcgi_finish_request and logging environment
+    variables). (Laruence)
+
+- GD:
+  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
+  . Fixed bug #72337 (invalid dimensions can lead to crash) (Pierre)
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in 
+    heap overflow). (Pierre)
+  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
+
+- Intl:
+  . Fixed bug #64524 (Add intl.use_exceptions to php.ini-*). (Anatol)
+
+- mbstring:
+  . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (Stas)
+
+- mcrypt:
+   . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas)
+
+- PCRE:
+  . Fixed bug #72143 (preg_replace uses int instead of size_t). (Joe)
+
+- PDO_pgsql:
+  . Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound).
+    (Laruence)
+  . Fixed bug #72294 (Segmentation fault/invalid pointer in connection
+    with pgsql_stmt_dtor). (Anatol)
+
+- Phpdbg:
+  . Fixed bug #72284 (phpdbg fatal errors with coverage). (Bob)
+
+- Postgres:
+  . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (Laruence)
+  . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol)
+
+- SPL:
+  . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (Stas)
+  . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and
+    unserialize). (Dmitry)
+
+- Standard:
+  . Fixed bug #72017 (range() with float step produces unexpected result).
+    (Thomas Punt)
+  . Fixed bug #72193 (dns_get_record returns array containing elements of
+    type 'unknown'). (Laruence)
+  . Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
+    (Laruence)
+  . Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruence)
+
+- XML:
+  . Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem). (Joe)
+
+- XMLRPC:
+  . Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type).
+    (Joe, Laruence)
+
+- WDDX:
+  . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (Stas)
+
+- Zip:
+  . Fixed ug #72258 (ZipArchive converts filenames to unrecoverable form).
+    (Anatol)
+  . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC
+    algorithm and unserialize). (Dmitry)
+
+26 May 2016 PHP 7.0.7
+
+- Core:
+  . Fixed bug #72162 (use-after-free - error_reporting). (Laruence)
+  . Add compiler option to disable special case function calls. (Joe)
+  . Fixed bug #72101 (crash on complex code). (Dmitry)
+  . Fixed bug #72100 (implode() inserts garbage into resulting string when
+    joins very big integer). (Mikhail Galanin)
+  . Fixed bug #72057 (PHP Hangs when using custom error handler and typehint).
+    (Nikita Nefedov)
+  . Fixed bug #72038 (Function calls with values to a by-ref parameter don't
+    always throw a notice). (Bob)
+  . Fixed bug #71737 (Memory leak in closure with parameter named $this).
+    (Nikita)
+  . Fixed bug #72059 (?? is not allowed on constant expressions). (Bob, Marcio)
+  . Fixed bug #72159 (Imported Class Overrides Local Class Name). (Nikita)
+
+- Curl:
+  . Fixed bug #68658 (Define CURLE_SSL_CACERT_BADFILE). (Pierrick)
+
+- DBA:
+  . Fixed bug #72157 (use-after-free caused by dba_open). (Shm, Laruence)
+
+- GD:
+  . Fixed bug #72227 (imagescale out-of-bounds read). (Stas)
+
+- Intl:
+  . Fixed #72241 (get_icu_value_internal out-of-bounds read). (Stas)
+
+- JSON:
+  . Fixed bug #72069 (Behavior \JsonSerializable different from json_encode).
+    (Laruence)
+
+- Mbstring:
+  . Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace). (Laruence)
+
+- OCI8:
+  . Fixed bug #71600 (oci_fetch_all segfaults when selecting more than eight
+    columns). (Tian Yang)
+
+- Opcache:
+  . Fixed bug #72014 (Including a file with anonymous classes multiple times
+    leads to fatal error). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #72165 (Null pointer dereference - openssl_csr_new). (Anatol)
+
+- PCNTL:
+  . Fixed bug #72154 (pcntl_wait/pcntl_waitpid array internal structure
+    overwrite). (Laruence)
+
+- POSIX:
+  . Fixed bug #72133 (php_posix_group_to_array crashes if gr_passwd is NULL).
+    (esminis at esminis dot lt)
+
+- Postgres:
+  . Fixed bug #72028 (pg_query_params(): NULL converts to empty string).
+    (Laruence)
+  . Fixed bug #71062 (pg_convert() doesn't accept ISO 8601 for datatype
+    timestamp). (denver at timothy dot io)
+  . Fixed bug #72151 (mysqli_fetch_object changed behaviour). (Anatol)
+
+- Reflection:
+  . Fixed bug #72174 (ReflectionProperty#getValue() causes __isset call).
+    (Nikita)
+
+- Session:
+  . Fixed bug #71972 (Cyclic references causing session_start(): Failed to
+    decode session object). (Laruence)
+
+- Sockets:
+  . Added socket_export_stream() function for getting a stream compatible
+    resource from a socket resource. (Chris Wright, Bob)
+
+- SPL:
+  . Fixed bug #72051 (The reference in CallbackFilterIterator doesn't work as
+    expected). (Laruence)
+
+- SQLite3:
+  . Fixed bug #68849 (bindValue is not using the right data type). (Anatol)
+
+- Standard:
+  . Fixed bug #72075 (Referencing socket resources breaks stream_select).
+    (Laruence)
+  . Fixed bug #72031 (array_column() against an array of objects discards all
+    values matching null). (Nikita)
+
+28 Apr 2016 PHP 7.0.6
+
+- Core:
+  . Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1'
+    failed). (Laruence)
+  . Fixed bug #71922 (Crash on assert(new class{})). (Nikita)
+  . Fixed bug #71914 (Reference is lost in "switch"). (Laruence)
+  . Fixed bug #71871 (Interfaces allow final and abstract functions). (Nikita)
+  . Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced
+    memory, crashing). (Laruence)
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+  . Fixed bug #71750 (Multiple Heap Overflows in php_raw_url_encode/
+    php_url_encode). (Stas)
+  . Fixed bug #71731 (Null coalescing operator and ArrayAccess). (Nikita)
+  . Fixed bug #71609 (Segmentation fault on ZTS with gethostbyname). (krakjoe)
+  . Fixed bug #71414 (Inheritance, traits and interfaces). (krakjoe)
+  . Fixed bug #71359 (Null coalescing operator and magic). (krakjoe)
+  . Fixed bug #71334 (Cannot access array keys while uksort()). (Nikita)
+  . Fixed bug #69659 (ArrayAccess, isset() and the offsetExists method).
+    (Nikita)
+  . Fixed bug #69537 (__debugInfo with empty string for key gives error).
+    (krakjoe)
+  . Fixed bug #62059 (ArrayObject and isset are not friends). (Nikita)
+  . Fixed bug #71980 (Decorated/Nested Generator is Uncloseable in Finally).
+    (Nikita)
+
+- BCmath:
+  . Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
+    _one_ definition). (Stas)
+
+- Curl:
+  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
+    (Michael Sierks)
+
+- Date:
+  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
+
+- EXIF:
+  . Fixed bug #72094 (Out of bounds heap read access in exif header processing). (Stas)
+
+- GD:
+  . Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074) (Stas)
+
+- Intl:
+  . Fixed bug #71516 (IntlDateFormatter looses locale if pattern is set via
+    constructor). (Anatol)
+  . Fixed bug #70455 (Missing constant: IntlChar::NO_NUMERIC_VALUE). (Anatol)
+  . Fixed bug #70451, #70452 (Inconsistencies in return values of IntlChar
+    methods). (Daniel Persson)
+  . Fixed bug #68893 (Stackoverflow in datefmt_create). (Anatol)
+  . Fixed bug #66289 (Locale::lookup incorrectly returns en or en_US if locale
+    is empty). (Anatol)
+  . Fixed bug #70484 (selectordinal doesn't work with named parameters).
+    (Anatol)
+  . Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative
+    offset). (Stas)
+
+- ODBC:
+  . Fixed bug #63171 (Script hangs after max_execution_time). (Remi)
+
+- Opcache:
+  . Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
+    (Laruence)
+
+- PDO:
+  . Fixed bug #52098 (Own PDOStatement implementation ignore __call()).
+    (Daniel kalaspuffar, Julien)
+  . Fixed bug #71447 (Quotes inside comments not properly handled). (Matteo)
+
+- PDO_DBlib:
+  . Fixed bug #71943 (dblib_handle_quoter needs to allocate an extra byte).
+    (Adam Baratz)
+  . Add DBLIB-specific attributes for controlling timeouts. (Adam Baratz)
+
+- PDO_pgsql:
+  . Fixed bug #62498 (pdo_pgsql inefficient when getColumnMeta() is used).
+    (Joseph Bylund)
+
+- Postgres:
+  . Fixed bug #71820 (pg_fetch_object binds parameters before call
+    constructor). (Anatol)
+  . Fixed bug #71998 (Function pg_insert does not insert when column
+    type = inet). (Anatol)
+
+- SOAP:
+  . Fixed bug #71986 (Nested foreach assign-by-reference creates broken
+    variables). (Laruence)
+
+- SPL:
+  . Fixed bug #71838 (Deserializing serialized SPLObjectStorage-Object can't
+    access properties in PHP). (Nikita)
+  . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
+  . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
+    offsetExists()). (Nikita)
+  . Fixed bug #52339 (SPL autoloader breaks class_exists()). (Nikita)
+
+- Standard:
+  . Fixed bug #71995 (Returning the same var twice from __sleep() produces
+    broken serialized data). (Laruence)
+  . Fixed bug #71940 (Unserialize crushes on restore object reference).
+    (Laruence)
+  . Fixed bug #71969 (str_replace returns an incorrect resulting array after
+    a foreach by reference). (Laruence)
+  . Fixed bug #71891 (header_register_callback() and
+    register_shutdown_function()). (Laruence)
+  . Fixed bug #71884 (Null pointer deref (segfault) in
+    stream_context_get_default). (Laruence)
+  . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
+  . Fixed bug #71837 (Wrong arrays behaviour). (Laruence)
+  . Fixed bug #71827 (substr_replace bug, string length). (krakjoe)
+  . Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or
+    _REENTRANT is not defined). (Nikita)
+  . Fixed bug #72116 (array_fill optimization breaks implementation). (Bob)
+
+- XML:
+  . Fixed bug #72099 (xml_parse_into_struct segmentation fault). (Stas)
+
+- Zip:
+  . Fixed bug #71923 (integer overflow in ZipArchive::getFrom*).
+    (CVE-2016-3078) (Stas)
+
+31 Mar 2016 PHP 7.0.5
+
+- Core:
+  . Huge pages disabled by default. (Rasmus)
+  . Added ability to enable huge pages in Zend Memory Manager through
+    the environment variable USE_ZEND_ALLOC_HUGE_PAGES=1. (Dmitry)
+  . Fixed bug #71756 (Call-by-reference widens scope to uninvolved functions
+    when used in switch). (Laruence)
+  . Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod,
+    zend_hex_strtod). (Laruence)
+  . Fixed bug #71695 (Global variables are reserved before execution).
+    (Laruence)
+  . Fixed bug #71629 (Out-of-bounds access in php_url_decode in context
+    php_stream_url_wrap_rfc2397). (mt at debian dot org)
+  . Fixed bug #71622 (Strings used in pass-as-reference cannot be used to
+    invoke C::$callable()). (Bob)
+  . Fixed bug #71596 (Segmentation fault on ZTS with date function
+    (setlocale)). (Anatol)
+  . Fixed bug #71535 (Integer overflow in zend_mm_alloc_heap()). (Dmitry)
+  . Fixed bug #71470 (Leaked 1 hashtable iterators). (Nikita)
+  . Fixed bug #71575 (ISO C does not allow extra ‘;’ outside of a function).
+    (asgrim)
+  . Fixed bug #71724 (yield from does not count EOLs). (Nikita)
+  . Fixed bug #71767 (ReflectionMethod::getDocComment returns the wrong
+    comment). (Grigorii Sokolik)
+  . Fixed bug #71806 (php_strip_whitespace() fails on some numerical values).
+    (Nikita)
+  . Fixed bug #71624 (`php -R` (PHP_MODE_PROCESS_STDIN) is broken).
+    (Sean DuBois)
+
+- CLI Server:
+  . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
+
+- Curl:
+  . Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY). (mpyw)
+
+- Date:
+  . Fixed bug #71635 (DatePeriod::getEndDate segfault). (Thomas Punt)
+
+- Fileinfo:
+  . Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic
+    file). (CVE-2015-8865) (Anatol)
+
+- libxml:
+  . Fixed bug #71536 (Access Violation crashes php-cgi.exe). (Anatol)
+
+- mbstring:
+  . Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in
+    mbfl_strcut). (CVE-2016-4073) (Stas)
+
+- ODBC:
+  . Fixed bug #47803, #69526 (Executing prepared statements is succesfull only
+    for the first two statements). (einavitamar at gmail dot com, Anatol)
+
+- PCRE:
+  . Fixed bug #71659 (segmentation fault in pcre running twig tests).
+    (nish dot aravamudan at canonical dot com)
+
+- PDO_DBlib:
+  . Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
+    (steven dot lambeth at gmx dot de, Anatol)
+
+- Phar:
+  . Fixed bug #71625 (Crash in php7.dll with bad phar filename). (Anatol)
+  . Fixed bug #71317 (PharData fails to open specific file). (Jos Elstgeest)
+  . Fixed bug #71860 (Invalid memory write in phar on filename with \0 in
+    name). (CVE-2016-4072) (Stas)
+
+- phpdbg:
+  . Fixed crash when advancing (except step) inside an internal function. (Bob)
+
+- Session:
+  . Fixed bug #71683 (Null pointer dereference in zend_hash_str_find_bucket).
+    (Yasuo)
+
+- SNMP:
+  . Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
+    (CVE-2016-4071) (andrew at jmpesp dot org)
+
+- SPL:
+  . Fixed bug #71617 (private properties lost when unserializing ArrayObject).
+    (Nikita)
+
+- Standard:
+  . Fixed bug #71660 (array_column behaves incorrectly after foreach by
+    reference). (Laruence)
+  . Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
+    (taoguangchen at icloud dot com, Stas)
+
+- Zip:
+  . Update bundled libzip to 1.1.2. (Remi, Anatol)
+
 03 Mar 2016 PHP 7.0.4

 - Core:
@@ -19,7 +397,8 @@ PHP                                                                        NEWS
    using count). (Nikita)
  . Fixed bug #71601 (finally block not executed after yield from). (Bob)
  . Fixed bug #71637 (Multiple Heap Overflow due to integer overflows in 
-    xml/filter_url/addcslashes). (Stas)
+    xml/filter_url/addcslashes). (CVE-2016-4344, CVE-2016-4345, CVE-2016-4346)
+    (Stas)

 - CLI server:
  . Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug).
@@ -55,7 +434,7 @@ PHP                                                                        NEWS

 - SOAP:
  . Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
-    make_http_soap_request()). (Stas)
+    make_http_soap_request()). (CVE-2016-3185) (Stas)

 - Standard:
  . Fixed bug #71603 (compact() maintains references in php7). (Laruence)
@@ -117,13 +496,18 @@ PHP                                                                        NEWS
  . Fixed bug #71475 (openssl_seal() uninitialized memory usage). (Stas)

 - PCRE:
-  . Upgraded pcrelib to 8.38.
+  . Upgraded pcrelib to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387,
+    CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)

 - Phar:
-  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas)
+  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
+    (Stas)
+  . Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()).
+    (CVE-2016-4343) (Stas)
  . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
    (Stas)
-  . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas)
+  . Fixed bug #71488 (Stack overflow when decompressing tar archives).
+    (CVE-2016-2554) (Stas)

 - SOAP:
  . Fixed bug #70979 (crash with bad soap request). (Anatol)
@@ -199,7 +583,7 @@ PHP                                                                        NEWS

 - GD:
  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
-    Out of Bounds). (emmanuel dot law at gmail dot com)
+    Out of Bounds). (CVE-2016-1903) (emmanuel dot law at gmail dot com)

 - Mbstring:
  . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
@@ -227,7 +611,7 @@ PHP                                                                        NEWS

 - Standard:
  . Fixed bug #71270 (Heap BufferOver Flow in escapeshell functions).
-    (emmanuel dot law at gmail dot com)
+    (CVE-2016-1904) (emmanuel dot law at gmail dot com)

 - WDDX:
  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
@@ -772,7 +1156,7 @@ PHP                                                                        NEWS
  . Implemented FR #70438 (Add IV parameter for openssl_seal and openssl_open)
    (Jakub Zelenka)
  . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically
-    secure). (Stas)
+    secure). (CVE-2015-8867) (Stas)
  . Fixed bug #69882 (OpenSSL error "key values mismatch" after
    openssl_pkcs12_read with extra cert). (Tomasz Sawicki)
  . Added "alpn_protocols" SSL context option allowing encrypted client/server
@@ -1020,7 +1404,8 @@ PHP                                                                        NEWS
    (Daniel Lowrey & Bob Weinand)

 - Zip:
-  . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors). (cmb)
+  . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors).
+    (CVE-2014-9767) (cmb)
  . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when
    creating directories). (neal at fb dot com)
  . Added ZipArchive::setCompressionName and ZipArchive::setCompressionIndex
@@ -172,7 +172,7 @@ PHP_FUNCTION(module_name_drawtext)
    zval *image = NULL;
    zval *font = NULL;

-    if (zend_parse_parameters(argc TSRMLS_CC, "rsrll|l", &image, &text, &text_len, &font, &x, &y, &color) == FAILURE)
+    if (zend_parse_parameters(argc, "rsrll|l", &image, &text, &text_len, &font, &x, &y, &color) == FAILURE)
        return;

    if (image) {
@@ -8,98 +8,98 @@ API adjustment to the old output control code:

 	Checking output control layers status:
 		// Using OG()
-		php_output_get_status(TSRMLS_C);
+		php_output_get_status();

 	Starting the default output handler:
-		// php_start_ob_buffer(NULL, 0, 1 TSRMLS_CC);
-		php_output_start_default(TSRMLS_C);
+		// php_start_ob_buffer(NULL, 0, 1);
+		php_output_start_default();

 	Starting an user handler by zval:
-		// php_start_ob_buffer(zhandler, chunk_size, erase TSRMLS_CC);
-		php_output_start_user(zhandler, chunk_size, flags TSRMLS_CC);
+		// php_start_ob_buffer(zhandler, chunk_size, erase);
+		php_output_start_user(zhandler, chunk_size, flags);

 	Starting an internal handler whithout context:
-		// php_ob_set_internal_handler(my_php_output_handler_func_t, buffer_size, "output handler name", erase TSRMLS_CC);
-		php_output_start_internal(handler_name, handler_name_len, my_php_output_handler_func_t, chunk_size, flags TSRMLS_CC);
+		// php_ob_set_internal_handler(my_php_output_handler_func_t, buffer_size, "output handler name", erase);
+		php_output_start_internal(handler_name, handler_name_len, my_php_output_handler_func_t, chunk_size, flags);

 	Starting an internal handler with context:
 		// not possible with old API
 		php_output_handler *h;
-		h = php_output_handler_create_internal(handler_name, handler_name_len, my_php_output_handler_context_func_t, chunk_size, flags TSRMLS_CC);
+		h = php_output_handler_create_internal(handler_name, handler_name_len, my_php_output_handler_context_func_t, chunk_size, flags);
 		php_output_handler_set_context(h, my_context, my_context_dtor);
-		php_output_handler_start(h TSRMLS_CC);
+		php_output_handler_start(h);

 	Testing whether a certain output handler has already been started:
-		// php_ob_handler_used("output handler name" TSRMLS_CC);
-		php_output_handler_started(handler_name, handler_name_len TSRMLS_CC);
+		// php_ob_handler_used("output handler name");
+		php_output_handler_started(handler_name, handler_name_len);

 	Flushing one output buffer:
-		// php_end_ob_buffer(1, 1 TSRMLS_CC);
-		php_output_flush(TSRMLS_C);
+		// php_end_ob_buffer(1, 1);
+		php_output_flush();

 	Flushing all output buffers:
 		// not possible with old API
-		php_output_flush_all(TSRMLS_C);
+		php_output_flush_all();

 	Cleaning one output buffer:
-		// php_ob_end_buffer(0, 1 TSRMLS_CC);
-		php_output_clean(TSRMLS_C);
+		// php_ob_end_buffer(0, 1);
+		php_output_clean();

 	Cleaning all output buffers:
 		// not possible with old API
-		php_output_clean_all(TSRMLS_C);
+		php_output_clean_all();

 	Discarding one output buffer:
-		// php_ob_end_buffer(0, 0 TSRMLS_CC);
-		php_output_discard(TSRMLS_C);
+		// php_ob_end_buffer(0, 0);
+		php_output_discard();

 	Discarding all output buffers:
-		// php_ob_end_buffers(0 TSRMLS_CC);
-		php_output_discard_all(TSRMLS_C);
+		// php_ob_end_buffers(0);
+		php_output_discard_all();

 	Stopping (and dropping) one output buffer:
-		// php_ob_end_buffer(1, 0 TSRMLS_CC)
-		php_output_end(TSRMLS_C);
+		// php_ob_end_buffer(1, 0)
+		php_output_end();

 	Stopping (and dropping) all output buffers:
-		// php_ob_end_buffers(1, 0 TSRMLS_CC);
-		php_output_end_all(TSRMLS_C);
+		// php_ob_end_buffers(1, 0);
+		php_output_end_all();

 	Retrieving output buffers contents:
-		// php_ob_get_buffer(zstring TSRMLS_CC);
-		php_output_get_contents(zstring TSRMLS_CC);
+		// php_ob_get_buffer(zstring);
+		php_output_get_contents(zstring);

 	Retrieving output buffers length:
-		// php_ob_get_length(zlength TSRMLS_CC);
-		php_output_get_length(zlength TSRMLS_CC);
+		// php_ob_get_length(zlength);
+		php_output_get_length(zlength);

 	Retrieving output buffering level:
 		// OG(nesting_level);
-		php_output_get_level(TSRMLS_C);
+		php_output_get_level();

 	Issue a warning because of an output handler conflict:
-		// php_ob_init_conflict("to be started handler name", "to be tested if already started handler name" TSRMLS_CC);
-		php_output_handler_conflict(new_handler_name, new_handler_name_len, set_handler_name, set_handler_name_len TSRMLS_CC);
+		// php_ob_init_conflict("to be started handler name", "to be tested if already started handler name");
+		php_output_handler_conflict(new_handler_name, new_handler_name_len, set_handler_name, set_handler_name_len);

 	Registering a conflict checking function, which will be checked prior starting the handler:
 		// not possible with old API, unless hardcoding into output.c
-		php_output_handler_conflict_register(handler_name, handler_name_len, my_php_output_handler_conflict_check_t TSRMLS_CC);
+		php_output_handler_conflict_register(handler_name, handler_name_len, my_php_output_handler_conflict_check_t);

 	Registering a reverse conflict checking function, which will be checked prior starting the specified foreign handler:
 		// not possible with old API
-		php_output_handler_reverse_conflict_register(foreign_handler_name, foreign_handler_name_len, my_php_output_handler_conflict_check_t TSRMLS_CC);
+		php_output_handler_reverse_conflict_register(foreign_handler_name, foreign_handler_name_len, my_php_output_handler_conflict_check_t);

 	Facilitating a context from within an output handler callable with ob_start():
 		// not possible with old API
-		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ, (void *) &custom_ctx_ptr_ptr TSRMLS_CC);
+		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ, (void *) &custom_ctx_ptr_ptr);

 	Disabling of the output handler by itself:
 		//not possible with old API
-		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_DISABLE, NULL TSRMLS_CC);
+		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_DISABLE, NULL);

 	Marking an output handler immutable by itself because of irreversibility of its operation:
 		// not possible with old API
-		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE, NULL TSRMLS_CC);
+		php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE, NULL);

 	Restarting the output handler because of a CLEAN operation:
 		// not possible with old API
@@ -13,8 +13,8 @@ meaningful error messages.
 Prototypes
 ----------
 /* Implemented. */
-int zend_parse_parameters(int num_args TSRMLS_DC, char *type_spec, ...);
-int zend_parse_parameters_ex(int flags, int num_args TSRMLS_DC, char *type_spec, ...);
+int zend_parse_parameters(int num_args, char *type_spec, ...);
+int zend_parse_parameters_ex(int flags, int num_args, char *type_spec, ...);

 The zend_parse_parameters() function takes the number of parameters
 passed to the extension function, the type specifier string, and the
@@ -30,7 +30,7 @@ resources cannot be auto-converted.

 PHP 5.5 includes a new function:

-int zend_parse_parameter(int flags, int arg_num TSRMLS_DC, zval **arg, const char *spec, ...);
+int zend_parse_parameter(int flags, int arg_num, zval **arg, const char *spec, ...);

 This function behaves like zend_parse_parameters_ex() except that instead of
 reading the arguments from the stack, it receives a single zval to convert
@@ -63,10 +63,10 @@ Type specifiers
 o  - object of any type (zval*)
 O  - object of specific type given by class entry (zval*, zend_class_entry)
 p  - valid path (string without null bytes in the middle) and its length (char*, size_t)
- P  - valid path (string without null bytes in the middle) as zend_string (zend_string)
+ P  - valid path (string without null bytes in the middle) as zend_string (zend_string*)
 r  - resource (zval*)
 s  - string (with possible null bytes) and its length (char*, size_t)
- S  - string (with possible null bytes) as zend_string (zend_string)
+ S  - string (with possible null bytes) as zend_string (zend_string*)
 z  - the actual zval (zval*)
 *  - variable arguments list (0 or more)
 +  - variable arguments list (1 or more)
@@ -97,11 +97,11 @@ Both mistakes might cause memory corruptions and segfaults:
 1)
  char *str;
  long str_len; /* XXX THIS IS WRONG!! Use size_t instead. */
-  zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &str, &str_len)
+  zend_parse_parameters(ZEND_NUM_ARGS(), "s", &str, &str_len)

 2)
  int num; /* XXX THIS IS WRONG!! Use zend_long instead. */
-  zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &num)
+  zend_parse_parameters(ZEND_NUM_ARGS(), "l", &num)

 If you're in doubt, use check_parameters.php script to the parameters 
 and their types (it can be found in ./scripts/dev/ directory of PHP sources):
@@ -116,7 +116,7 @@ zend_long l;
 char *s;
 size_t s_len;
 zval *param;
-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lsz",
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "lsz",
                          &l, &s, &s_len, &param) == FAILURE) {
    return;
 }
@@ -126,7 +126,7 @@ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lsz",
 zval *obj;
 double d = 0.5;
 zend_class_entry *my_ce;
-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O|d",
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|d",
                          &obj, my_ce, &d) == FAILURE) {
    return;
 }
@@ -136,7 +136,7 @@ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O|d",
   If null is passed for object, obj will be set to NULL. */
 zval *obj;
 zval *arr;
-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "o!a",
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "o!a",
                          &obj, &arr) == FAILURE) {
    return;
 }
@@ -144,7 +144,7 @@ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "o!a",

 /* Gets a separated array which can also be null. */
 zval *arr;
-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a/!",
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "a/!",
                          &arr) == FAILURE) {
    return;
 }
@@ -161,10 +161,10 @@ char *s;
 */
 size_t length;

-if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC,
+if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(),
                             "lll", &l1, &l2, &l3) == SUCCESS) {
    /* manipulate longs */
-} else if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC,
+} else if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(),
                                    "s", &s, &length) == SUCCESS) {
    /* manipulate string */
 } else {
@@ -180,7 +180,7 @@ int i, num_varargs;
 zval *varargs = NULL;


-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "*", &varargs, &num_varargs) == FAILURE) {
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "*", &varargs, &num_varargs) == FAILURE) {
    return;
 }

@@ -200,7 +200,7 @@ size_t str_len;
 int i, num_varargs;
 zval *varargs = NULL;

-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s+", &str, &str_len, &varargs, &num_varargs) == FAILURE) {
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "s+", &str, &str_len, &varargs, &num_varargs) == FAILURE) {
    return;
 }

@@ -214,7 +214,7 @@ zval *array;
 int i, num_varargs;
 zval *varargs = NULL;

-if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a*l", &array, &varargs, &num_varargs, &num) == FAILURE) {
+if (zend_parse_parameters(ZEND_NUM_ARGS(), "a*l", &array, &varargs, &num_varargs, &num) == FAILURE) {
    return;
 }

@@ -5,17 +5,16 @@
 5. ext/standard crypt
 6. ext/standard crypt's blowfish implementation
 7. Sqlite/Sqlite3 ext/sqlite3 ext/sqlite
-8. ext/json/json_parser
-9. ext/standard/rand
-10. ext/standard/scanf
-11. ext/standard/strnatcmp.c
-12. ext/standard/uuencode
-13. libxmlrpc ext/xmlrpc
-14. libzip ext/zip
-15. main/snprintf.c
-16. main/strlcat
-17. main/strlcpy
-18. libgd see ext/gd/libgd/COPYING
+8. ext/standard/rand
+9. ext/standard/scanf
+10. ext/standard/strnatcmp.c
+11. ext/standard/uuencode
+12. libxmlrpc ext/xmlrpc
+13. libzip ext/zip
+14. main/snprintf.c
+15. main/strlcat
+16. main/strlcpy
+17. libgd see ext/gd/libgd/COPYING

 5. ext/standard crypt

@@ -104,31 +103,7 @@ a legal notice, here is a blessing:
  May you share freely, never taking more than you give.


-8. ext/json/json_parser
-Copyright (c) 2005 JSON.org
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-The Software shall be used for Good, not Evil.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-9. ext/standard/rand
+8. ext/standard/rand
 The following php_mt_...() functions are based on a C++ class MTRand by
 Richard J. Wagner. For more information see the web page at
 http://www-personal.engin.umich.edu/~wagnerr/MersenneTwister.html
@@ -181,7 +156,7 @@ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


-10. ext/standard/scanf
+9. ext/standard/scanf
 scanf.c --

 This file contains the base code which implements sscanf and by extension
@@ -227,7 +202,7 @@ authors grant the U.S. Government and others acting in its behalf
 permission to use and distribute the software in accordance with the
 terms specified in this license.

-11. ext/standard/strnatcmp.c
+10. ext/standard/strnatcmp.c

 strnatcmp.c -- Perform 'natural order' comparisons of strings in C.
 Copyright (C) 2000 by Martin Pool <mbp@humbug.org.au>
@@ -248,7 +223,7 @@ freely, subject to the following restrictions:
 	 misrepresented as being the original software.
 3. This notice may not be removed or altered from any source distribution.

-12. ext/standard/uuencode
+11. ext/standard/uuencode
 Portions of this code are based on Berkeley's uuencode/uudecode
 implementation.

@@ -284,7 +259,7 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.


-13. libxmlrpc ext/xmlrpc
+12. libxmlrpc ext/xmlrpc

 Copyright 2000 Epinions, Inc. 

@@ -308,7 +283,7 @@ OF OR IN CONNECTION WITH THE SOFTWARE (HOWEVER ARISING, INCLUDING
 NEGLIGENCE), EVEN IF EPINIONS, INC.  IS AWARE OF THE POSSIBILITY OF SUCH 
 DAMAGES.

-14. libzip ext/zip
+13. libzip ext/zip
 zip.h -- exported declarations.
 Copyright (C) 1999-2009 Dieter Baron and Thomas Klausner

@@ -340,7 +315,7 @@ IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
 IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-15. main/snprintf.c
+14. main/snprintf.c
 Copyright (c) 2002, 2006 Todd C. Miller <Todd.Miller@courtesan.com>

 Permission to use, copy, modify, and distribute this software for any
@@ -413,8 +388,8 @@ This code is based on, and used with the permission of, the
 SIO stdio-replacement strx_* functions by Panos Tsirigotis
 <panos@alumni.cs.colorado.edu> for xinetd.

-16. main/strlcat
-17. main/strlcpy
+15. main/strlcat
+16. main/strlcpy
 Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
 All rights reserved.

@@ -28,7 +28,7 @@ The main functions are:
 PHPAPI size_t php_stream_read(php_stream * stream, char * buf, size_t count);
 PHPAPI size_t php_stream_write(php_stream * stream, const char * buf, size_t
        count);
-PHPAPI size_t php_stream_printf(php_stream * stream TSRMLS_DC, 
+PHPAPI size_t php_stream_printf(php_stream * stream, 
        const char * fmt, ...);
 PHPAPI int php_stream_eof(php_stream * stream);
 PHPAPI int php_stream_getc(php_stream * stream);
@@ -47,7 +47,7 @@ Opening Streams
 In most cases, you should use this API:

 PHPAPI php_stream *php_stream_open_wrapper(const char *path, const char *mode,
-    int options, char **opened_path TSRMLS_DC);
+    int options, char **opened_path);

 Where:
    path is the file or resource to open.
@@ -80,7 +80,7 @@ PHPAPI php_stream *php_stream_fopen_tmpfile(void);
    Open a FILE * with tmpfile() and convert into a stream.

 PHPAPI php_stream *php_stream_fopen_temporary_file(const char *dir,
-    const char *pfx, char **opened_path TSRMLS_DC);
+    const char *pfx, char **opened_path);
    Generate a temporary file name and open it.

 There are some network enabled relatives in php_network.h:
@@ -138,7 +138,7 @@ SAPI_INPUT_FILTER_FUNC(my_sapi_input_filter)
    strcpy(raw_var, "RAW_");
    strlcat(raw_var,var,var_len+5);

-    php_register_variable_ex(raw_var, &new_var, array_ptr TSRMLS_DC);
+    php_register_variable_ex(raw_var, &new_var, array_ptr);

    php_strip_tags(*val, val_len, NULL, NULL, 0);

@@ -154,7 +154,7 @@ PHP_FUNCTION(my_get_raw)
    zval **tmp;
    zval *array_ptr = NULL;

-    if(zend_parse_parameters(2 TSRMLS_CC, "ls", &arg, &var, &var_len) == FAILURE) {
+    if(zend_parse_parameters(2, "ls", &arg, &var, &var_len) == FAILURE) {
        return;
    }

@@ -170,8 +170,8 @@ TSRM_API void *tsrm_get_ls_cache(void);

 #define TSRMG_STATIC(id, type, element)	(TSRMG_BULK_STATIC(id, type)->element)
 #define TSRMG_BULK_STATIC(id, type)	((type) (*((void ***) TSRMLS_CACHE))[TSRM_UNSHUFFLE_RSRC_ID(id)])
-#define TSRMLS_CACHE_EXTERN() extern TSRM_TLS void *TSRMLS_CACHE
-#define TSRMLS_CACHE_DEFINE() TSRM_TLS void *TSRMLS_CACHE = NULL
+#define TSRMLS_CACHE_EXTERN() extern TSRM_TLS void *TSRMLS_CACHE;
+#define TSRMLS_CACHE_DEFINE() TSRM_TLS void *TSRMLS_CACHE = NULL;
 #if ZEND_DEBUG
 #define TSRMLS_CACHE_UPDATE() TSRMLS_CACHE = tsrm_get_ls_cache()
 #else
@@ -0,0 +1,197 @@
+# =================================================================================
+#  http://www.gnu.org/software/autoconf-archive/ax_func_which_gethostbyname_r.html
+# =================================================================================
+#
+# SYNOPSIS
+#
+#   AX_FUNC_WHICH_GETHOSTBYNAME_R
+#
+# DESCRIPTION
+#
+#   Determines which historical variant of the gethostbyname_r() call
+#   (taking three, five, or six arguments) is available on the system and
+#   defines one of the following macros accordingly:
+#
+#     HAVE_FUNC_GETHOSTBYNAME_R_6
+#     HAVE_FUNC_GETHOSTBYNAME_R_5
+#     HAVE_FUNC_GETHOSTBYNAME_R_3
+#
+#   as well as
+#
+#     HAVE_GETHOSTBYNAME_R
+#
+#   If used in conjunction with gethostname.c, the API demonstrated in
+#   test.c can be used regardless of which gethostbyname_r() is available.
+#   These example files can be found at
+#   http://www.csn.ul.ie/~caolan/publink/gethostbyname_r
+#
+#   based on David Arnold's autoconf suggestion in the threads faq
+#
+#   Originally named "AC_caolan_FUNC_WHICH_GETHOSTBYNAME_R". Rewritten for
+#   Autoconf 2.5x, and updated for 2.68 by Daniel Richard G.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Caolan McNamara <caolan@skynet.ie>
+#   Copyright (c) 2008 Daniel Richard G. <skunk@iskunk.org>
+#
+#   This program is free software; you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation; either version 2 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 7
+
+AC_DEFUN([AX_FUNC_WHICH_GETHOSTBYNAME_R], [
+
+    AC_LANG_PUSH([C])
+    AC_MSG_CHECKING([how many arguments gethostbyname_r() takes])
+
+    AC_CACHE_VAL([ac_cv_func_which_gethostbyname_r], [
+
+################################################################
+
+ac_cv_func_which_gethostbyname_r=unknown
+
+#
+# ONE ARGUMENT (sanity check)
+#
+
+# This should fail, as there is no variant of gethostbyname_r() that takes
+# a single argument. If it actually compiles, then we can assume that
+# netdb.h is not declaring the function, and the compiler is thereby
+# assuming an implicit prototype. In which case, we're out of luck.
+#
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            (void)gethostbyname_r(name) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=no])
+
+#
+# SIX ARGUMENTS
+# (e.g. Linux)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret, *retp;
+            char buf@<:@1024@:>@;
+            int buflen = 1024;
+            int my_h_errno;
+            (void)gethostbyname_r(name, &ret, buf, buflen, &retp, &my_h_errno) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=six])
+
+fi
+
+#
+# FIVE ARGUMENTS
+# (e.g. Solaris)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret;
+            char buf@<:@1024@:>@;
+            int buflen = 1024;
+            int my_h_errno;
+            (void)gethostbyname_r(name, &ret, buf, buflen, &my_h_errno) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=five])
+
+fi
+
+#
+# THREE ARGUMENTS
+# (e.g. AIX, HP-UX, Tru64)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret;
+            struct hostent_data data;
+            (void)gethostbyname_r(name, &ret, &data) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=three])
+
+fi
+
+################################################################
+
+]) dnl end AC_CACHE_VAL
+
+case "$ac_cv_func_which_gethostbyname_r" in
+    three|five|six)
+    AC_DEFINE([HAVE_GETHOSTBYNAME_R], [1],
+              [Define to 1 if you have some form of gethostbyname_r().])
+    ;;
+esac
+
+case "$ac_cv_func_which_gethostbyname_r" in
+    three)
+    AC_MSG_RESULT([three])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_3], [1],
+              [Define to 1 if you have the three-argument form of gethostbyname_r().])
+    ;;
+
+    five)
+    AC_MSG_RESULT([five])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_5], [1],
+              [Define to 1 if you have the five-argument form of gethostbyname_r().])
+    ;;
+
+    six)
+    AC_MSG_RESULT([six])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_6], [1],
+              [Define to 1 if you have the six-argument form of gethostbyname_r().])
+    ;;
+
+    no)
+    AC_MSG_RESULT([cannot find function declaration in netdb.h])
+    ;;
+
+    unknown)
+    AC_MSG_RESULT([can't tell])
+    ;;
+
+    *)
+    AC_MSG_ERROR([internal error])
+    ;;
+esac
+
+AC_LANG_POP
+
+]) dnl end AC_DEFUN
+
@@ -1,3 +1,4 @@
+m4_include([TSRM/m4/gethostbyname.m4])

 dnl TSRM_CHECK_GCC_ARG(ARG, ACTION-IF-FOUND, ACTION-IF-NOT_FOUND)	
 AC_DEFUN([TSRM_CHECK_GCC_ARG],[
@@ -32,6 +33,8 @@ AC_CHECK_HEADERS(stdarg.h)

 AC_CHECK_FUNCS(sigprocmask)

+AX_FUNC_WHICH_GETHOSTBYNAME_R()
+
 ])


@@ -89,7 +92,6 @@ else
 fi
 ])

-
 AC_DEFUN([TSRM_THREADS_CHECKS],[

 dnl For the thread implementations, we always use --with-*
@@ -72,7 +72,7 @@ typedef struct {

 #ifdef ZTS
 # define TWG(v) TSRMG_STATIC(win32_globals_id, tsrm_win32_globals *, v)
-TSRMLS_CACHE_EXTERN();
+TSRMLS_CACHE_EXTERN()
 #else
 # define TWG(v) (win32_globals.v)
 #endif
@@ -756,6 +756,14 @@ out, that the corresponding SDK isn't available anymore.
      - 'gd PS font'
      - 'gd PS encoding'

+- Zip
+  . Filename encoding flags, as of 7.0.8
+    - ZipArchive::FL_ENC_GUESS
+    - ZipArchive::FL_ENC_RAW
+    - ZipArchive::FL_ENC_STRICT
+    - ZipArchive::FL_ENC_UTF_8
+    - ZipArchive::FL_ENC_CP437
+
 ========================================
 11. Changes to INI File Handling
 ========================================
@@ -0,0 +1,43 @@
+--TEST--
+Using indirect append on ArrayAccess object
+--FILE--
+<?php
+
+class AA implements ArrayAccess {
+    private $data = [];
+    public function &offsetGet($name) {
+        if (null === $name) {
+            return $this->data[];
+        } else {
+            return $this->data[$name];
+        }
+    }
+    public function offsetSet($name, $value) {
+        $this->data[$name] = $value;
+    }
+    public function offsetUnset($name) {}
+    public function offsetExists($name) {}
+}
+
+$aa = new AA;
+$aa[3] = 1;
+$aa[][][0] = 2;
+var_dump($aa);
+
+?>
+--EXPECT--
+object(AA)#1 (1) {
+  ["data":"AA":private]=>
+  array(2) {
+    [3]=>
+    int(1)
+    [4]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        int(2)
+      }
+    }
+  }
+}
@@ -0,0 +1,36 @@
+--TEST--
+Array must be separated if unpacking by reference
+--FILE--
+<?php
+
+function inc(&... $args) {
+    foreach ($args as &$arg) {
+        $arg++;
+    }
+}
+
+$arr = [1, 2];
+$arr[] = 3;
+$arr2 = $arr;
+inc(...$arr);
+var_dump($arr);
+var_dump($arr2);
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(2)
+  [1]=>
+  int(3)
+  [2]=>
+  int(4)
+}
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
@@ -0,0 +1,11 @@
+--TEST--
+Serialization of backtick literal is incorrect
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+
+assert_options(ASSERT_WARNING);
+assert(false && `echo -n ""`);
+--EXPECTF--
+Warning: assert(): assert(false && `echo -n ""`) failed in %s%east_serialize_backtick_literal.php on line %d
@@ -8,7 +8,8 @@ class Thing {}
 function boom()
 {
    $reader = xml_parser_create();
-    xml_set_object($reader, new Thing());
+    $thing = new Thing();
+    xml_set_object($reader, $thing);
    die("ok\n");
    xml_parser_free($reader);
 }
@@ -10,5 +10,4 @@ class foo {
 $obj = new foo("Hello world");
 ?>
 --EXPECTF--
-Fatal error: Cannot re-assign $this in %sbug41117_1.php on line 3
-
+Fatal error: Cannot use $this as parameter in %s on line %d
@@ -23,4 +23,4 @@ class B extends A {
 }
 ?>
 --EXPECTF--
-Warning: Declaration of B::foo($var) should be compatible with A::foo() in %sbug62358.php on line %d
+Fatal error: Declaration of B::foo($var) must be compatible with I::foo() in %sbug62358.php on line 17
@@ -18,4 +18,4 @@ $test = new Foo();
 var_dump($test instanceof Baz);
 ?>
 --EXPECTF--
-Fatal error: Access level to Bar::bad() must be public (as in class Baz) in %sbug69467.php on line %d
+Fatal error: Access level to Foo::bad() must be public (as in class Baz) in %sbug69467.php on line %d
@@ -0,0 +1,19 @@
+--TEST--
+Bug #69537 (__debugInfo with empty string for key gives error)
+--FILE--
+<?php
+class Foo {
+
+    public function __debugInfo(){
+        return ['' => 1];
+    }
+}
+
+var_dump(new Foo);
+?>
+--EXPECTF--
+object(Foo)#%d (%d) {
+  [""]=>
+  int(1)
+}
+
@@ -27,8 +27,6 @@ $c10 = new C10;
 var_dump($c10[] += 5);
 --EXPECTF--
 Inside C10::offsetGet
-
-Notice: Undefined variable: offset in %sbug69955.php on line 10
 NULL

 Inside C10::offsetSet
@@ -0,0 +1,61 @@
+--TEST--
+Bug #71359: Null coalescing operator and magic
+--FILE--
+<?php
+class AA {
+    private $data = [];
+    public function __isset($name) {
+        echo "__isset($name)\n";
+        return array_key_exists($name, $this->data);
+    }
+    public function &__get($name) {
+        echo "__get($name)\n";
+        if (!array_key_exists($name, $this->data)) {
+            throw new Exception('Unknown offset');
+        }
+        return $this->data[$name];
+    }
+    public function __set($name, $value) {
+        echo "__set($name)\n";
+        $this->data[$name] = $value;
+    }
+    public function __unset($name) {
+        echo "__unset($name)\n";
+        unset($this->data[$name]);
+    }
+}
+
+$aa = new AA;
+var_dump(isset($aa->zero->one->two));
+var_dump(isset($aa->zero->foo));
+var_dump($aa->zero ?? 42);
+var_dump($aa->zero->one->two ?? 42);
+$aa->zero = new AA;
+$aa->zero->one = new AA;
+var_dump(isset($aa->zero->one->two));
+var_dump($aa->zero->one->two ?? 42);
+?>
+--EXPECT--
+__isset(zero)
+bool(false)
+__isset(zero)
+bool(false)
+__isset(zero)
+int(42)
+__isset(zero)
+int(42)
+__set(zero)
+__get(zero)
+__set(one)
+__isset(zero)
+__get(zero)
+__isset(one)
+__get(one)
+__isset(two)
+bool(false)
+__isset(zero)
+__get(zero)
+__isset(one)
+__get(one)
+__isset(two)
+int(42)
@@ -0,0 +1,25 @@
+--TEST--
+Bug #71414 (Interface method override inherited method and implemented in a trait causes fatal error)
+--FILE--
+<?php
+interface InterfaceY {
+    public function z(): string;
+}
+
+trait TraitY {
+    public function z(): string {
+    }
+}
+
+class X {
+    public function z() {
+    }
+}
+
+class Y extends X implements InterfaceY {
+    use TraitY;
+}
+
+echo "ok";
+--EXPECT--
+ok
@@ -0,0 +1,15 @@
+--TEST--
+bug #71428.1: inheritance with null default values
+--XFAIL--
+This is a BC break
+--FILE--
+<?php
+class A {
+    public function m(array $a = null) {}
+}
+class B extends A {
+    public function m(array $a = []) {}
+}
+--EXPECTF--
+Warning: Declaration of B::m(array $a = Array) should be compatible with A::m(array $a = NULL) in %sbug71428.1.php on line 7
+
@@ -0,0 +1,23 @@
+--TEST--
+bug #71428.2: inheritance of ye olde dynamic interfaces
+--SKIPIF--
+<?php if (!extension_loaded('pdo')) die("skip PDO is not available"); ?>
+--FILE--
+<?php
+interface StatementInterface {
+	public function fetch($first = null, $second, $third);
+}
+
+class Statement extends PDOStatement implements StatementInterface {}
+
+interface StatementInterface1 {
+	public function fetch($first = null, $second = null, $third = null);
+}
+
+class Statement1 extends PDOStatement implements StatementInterface1 {}
+
+echo "ok";
+?>
+--EXPECT--
+ok
+
@@ -0,0 +1,13 @@
+--TEST--
+bug #71428: Validation type inheritance with = NULL
+--XFAIL--
+This is a BC break
+--FILE--
+<?php
+class A { }
+class B           {  public function m(A $a = NULL, $n) { echo "B.m";} };
+class C extends B {  public function m(A $a       , $n) { echo "C.m";} };
+?>
+--EXPECTF--
+Warning: Declaration of C::m(A $a, $n) should be compatible with B::m(A $a = NULL, $n) in %sbug71428.3.php on line 4
+
@@ -0,0 +1,13 @@
+--TEST--
+Bug #71470: Leaked 1 hashtable iterators
+--FILE--
+<?php
+
+$array = [1, 2, 3];
+foreach ($array as &$v) {
+    die("foo\n");
+}
+
+?>
+--EXPECT--
+foo
@@ -0,0 +1,30 @@
+--TEST--
+Bug #71622 (Strings used in pass-as-reference cannot be used to invoke C::$callable())
+--FILE--
+<?php
+
+function getMethodName(&$methodName) {
+	$methodName = Abc::METHOD_NAME;
+}
+
+class Abc {
+	const METHOD_NAME = "goal";
+
+	private static function goal() {
+		echo "success\n";
+	}
+
+	public static function run() {
+		$method = "foobar";
+		getMethodName($method);
+		var_dump(is_callable("self::$method"));
+		self::$method();
+	}
+}
+
+Abc::run();
+
+?>
+--EXPECT--
+bool(true)
+success
@@ -0,0 +1,17 @@
+--TEST--
+Bug #71695 (Global variables are reserved before execution)
+--FILE--
+<?php
+function provideGlobals() {
+	var_dump(array_key_exists("foo", $GLOBALS));
+	var_dump(isset($GLOBALS["foo"]));
+	$GLOBALS += array("foo" => "foo");
+}
+
+provideGlobals();
+echo $foo;
+?>
+--EXPECT--
+bool(false)
+bool(false)
+foo
@@ -0,0 +1,19 @@
+--TEST--
+Bug #71724: yield from does not count EOLs
+--FILE--
+<?php
+
+function test()
+{
+    yield
+
+
+
+
+    from [__LINE__];
+}
+var_dump(test()->current());
+
+?>
+--EXPECT--
+int(10)
@@ -0,0 +1,64 @@
+--TEST--
+Bug #71731: Null coalescing operator and ArrayAccess
+--FILE--
+<?php
+
+class AA implements ArrayAccess {
+    private $data = [];
+    public function offsetExists($name) {
+        echo "offsetExists($name)\n";
+        return array_key_exists($name, $this->data);
+    }
+    public function &offsetGet($name) {
+        echo "offsetGet($name)\n";
+        if (!array_key_exists($name, $this->data)) {
+            throw new Exception('Unknown offset');
+        }
+        return $this->data[$name];
+    }
+    public function offsetSet($name, $value) {
+        echo "offsetSet($name)\n";
+        $this->data[$name] = $value;
+    }
+    public function offsetUnset($name) {
+        echo "offsetUnset($name)\n";
+        unset($this->data[$name]);
+    }
+}
+
+$aa = new AA;
+var_dump(isset($aa[0][1][2]));
+var_dump(isset($aa[0]->foo));
+var_dump($aa[0] ?? 42);
+var_dump($aa[0][1][2] ?? 42);
+
+$aa[0] = new AA;
+$aa[0][1] = new AA;
+var_dump(isset($aa[0][1][2]));
+var_dump($aa[0][1][2] ?? 42);
+
+?>
+--EXPECT--
+offsetExists(0)
+bool(false)
+offsetExists(0)
+bool(false)
+offsetExists(0)
+int(42)
+offsetExists(0)
+int(42)
+offsetSet(0)
+offsetGet(0)
+offsetSet(1)
+offsetExists(0)
+offsetGet(0)
+offsetExists(1)
+offsetGet(1)
+offsetExists(2)
+bool(false)
+offsetExists(0)
+offsetGet(0)
+offsetExists(1)
+offsetGet(1)
+offsetExists(2)
+int(42)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #71737: Memory leak in closure with parameter named $this
+--FILE--
+<?php
+
+class Test {
+    public function method() {
+        return function($this) {};
+    }
+}
+
+(new Test)->method()(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Cannot use $this as parameter in %s on line %d
@@ -0,0 +1,27 @@
+--TEST--
+Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)
+--FILE--
+<?php
+function a ($option) {
+	b($option['bla']);
+	c($option);
+	var_dump($option);
+}
+function b (&$string) {
+	$string = 'changed';
+}
+function c ($option) {
+	switch ($option['bla']) {
+	case 'changed':
+		$copy = $option;
+		$copy['bla'] = 'copy';
+		break;
+	}
+}
+a(array('bla' => 'false'));
+?>
+--EXPECTF--
+array(1) {
+  ["bla"]=>
+  string(7) "changed"
+}
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL
@@ -0,0 +1,28 @@
+--TEST--
+Bug #71859 (zend_objects_store_call_destructors operates on realloced memory, crashing)
+--FILE--
+<?php
+class constructs_in_destructor {
+  public function __destruct() {
+    //We are now in zend_objects_store_call_destructors
+    //This causes a realloc in zend_objects_store_put
+    for ($i = 0; $i < 10000; ++$i) {
+      $GLOBALS["a$i"] = new stdClass;
+    }
+    //Returns to zend_objects_store_call_destructors, to access freed memory.
+  }
+}
+
+$a = new constructs_in_destructor;
+//Create cycle so destructors are ran only in zend_objects_store_call_destructors
+$a->a = $a;
+
+// Create some objects so zend_objects_store_call_destructors has something
+// to do after constructs_in_destructor is destroyed.
+for ($i = 0; $i < 200; ++$i) {
+  $GLOBALS["b$i"] = new stdClass;
+}
+?>
+okey
+--EXPECT--
+okey
@@ -0,0 +1,12 @@
+--TEST--
+Bug #71871: Interfaces allow final and abstract functions
+--FILE--
+<?php
+
+interface test {
+    final function test();
+}
+
+?>
+--EXPECTF--
+Fatal error: Access type for interface method test::test() must be omitted in %s on line %d
@@ -0,0 +1,12 @@
+--TEST--
+Bug #71871: Interfaces allow final and abstract functions
+--FILE--
+<?php
+
+interface test {
+    abstract function test();
+}
+
+?>
+--EXPECTF--
+Fatal error: Access type for interface method test::test() must be omitted in %s on line %d
@@ -0,0 +1,40 @@
+--TEST--
+Bug #71914 (Reference is lost in "switch")
+--FILE--
+<?php
+
+function bug(&$value) {
+	switch ($value) {
+	case "xxxx":
+		$value = true;
+		break;
+	}
+}
+
+function returnArray() {
+	$array = array();
+	$array["str"]  = "xxxx";
+	return $array;
+}
+
+class Foo {
+	public $array = array("str" => "xxxx");
+}
+
+function test($arr, &$dummy) {
+	bug($arr["str"]);
+	var_dump($arr["str"]);
+}
+
+$foo = new Foo();
+$arr = returnArray();
+
+$array = array("str" => "xxxx");
+test($array, $array["str"]);
+test($arr, $arr["str"]);
+test($foo->array, $foo->array["str"]);
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71922: Crash on assert(new class{});
+--INI--
+zend.assertions=1
+assert.exception=1
+--FILE--
+<?php
+
+try {
+    assert(0 && new class {
+    } && new class(42) extends stdclass {
+    });
+} catch (AssertionError $e) {
+    echo "Assertion failure: ", $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Assertion failure: assert(0 && new class {
+} && new class(42) extends stdclass {
+})
@@ -0,0 +1,30 @@
+--TEST--
+Bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+  die("skip Require a resource which is able to hold a callbck");
+}
+?>
+--FILE--
+<?php
+
+class A {
+	public static function dummy() {
+	}
+}
+
+$a = array();
+$a[] = "A";
+$a[] = "dummy";
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_HEADERFUNCTION, $a);
+
+set_error_handler($a);
+set_error_handler(function()use($ch1){});
+set_error_handler(function(){});
+?>
+okey
+--EXPECT--
+okey
@@ -0,0 +1,43 @@
+--TEST--
+Bug #71980: Decorated/Nested Generator is Uncloseable in Finally
+--FILE--
+<?php
+
+class Dtor {
+    public function __destruct() {
+        echo "Dtor\n";
+    }
+}
+
+function gen1() {
+    try {
+        foreach ([42, new Dtor] as $value) {
+            yield $value;
+        }
+    } finally {
+        echo "Finally\n";
+    }
+}
+
+function gen2() {
+    try {
+        var_dump(new Dtor, yield);
+    } finally {
+        echo "Finally\n";
+    }
+}
+
+$gen = gen1();
+$gen->rewind();
+unset($gen);
+
+$gen = gen2();
+$gen->rewind();
+unset($gen);
+
+?>
+--EXPECT--
+Dtor
+Finally
+Dtor
+Finally
@@ -0,0 +1,27 @@
+--TEST--
+Bug #72038 (Function calls with values to a by-ref parameter don't always throw a notice)
+--FILE--
+<?php
+
+test($foo = new stdClass);
+var_dump($foo);
+test($bar = 2);
+var_dump($bar);
+test($baz = &$bar);
+var_dump($baz);
+
+function test(&$param) {
+        $param = 1;
+}
+
+?>
+--EXPECTF--
+
+Notice: Only variables should be passed by reference in %s on line %d
+object(stdClass)#1 (0) {
+}
+
+Notice: Only variables should be passed by reference in %s on line %d
+int(2)
+int(1)
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #72057 (PHP hangs when user error handler throws exception after Notice from type coercion)
+--FILE--
+<?php
+
+set_error_handler(
+    function() {
+        throw new Exception("My custom error");
+    }
+);
+
+(function (int $i) { bar(); })("7as");
+
+--EXPECTF--
+
+Fatal error: Uncaught Exception: My custom error in %s:%d
+Stack trace:
+#0 %s(%d): {closure}(8, 'A non well form...', '%s', %d, Array)
+#1 %s(%d): {closure}('7as')
+#2 {main}
+  thrown in %s on line %d
@@ -0,0 +1,85 @@
+--TEST--
+Bug #72101 (crash on complex code)
+--FILE--
+<?php
+class PHPUnit_Framework_MockObject_Stub_ReturnCallback {
+    protected $callback;
+    public function __construct($callback) {
+        $this->callback = $callback;
+    }
+    public function invoke($invocation) {
+        return call_user_func_array($this->callback, $invocation->parameters);
+    }
+}
+
+class PHPUnit_Framework_MockObject_InvocationMocker {
+    protected $matchers = [];
+    public function addMatcher( $matcher) {
+        $this->matchers[] = $matcher;
+    }
+    public function invoke( $invocation) {
+        foreach ($this->matchers as $match) {
+            $match->invoked($invocation);
+        }
+    }
+}
+
+class PHPUnit_Framework_MockObject_Matcher {
+    public $stub = null;
+    public function invoked($invocation) {
+        return $this->stub->invoke($invocation);
+    }
+}
+
+class MethodCallbackByReference {
+    public function bar(&$a, &$b, $c) {
+        Legacy::bar($a, $b, $c);
+    }
+    public function callback(&$a, &$b, $c) {
+        $b = 1;
+    }
+}
+class PHPUnit_Framework_MockObject_Invocation_Static {
+    public $parameters;
+    public function __construct(array $parameters) {
+        $this->parameters = $parameters;
+    }
+}
+
+class Mock_MethodCallbackByReference_7b180d26 extends MethodCallbackByReference {
+    public $inv_mocker;
+    public function bar(&$a, &$b, $c) {
+        $arguments = array($a, $b, $c);
+        $result = $this->inv_mocker->invoke(
+            new PHPUnit_Framework_MockObject_Invocation_Static(
+                $arguments
+            )
+        );
+        return $result;
+    }
+}
+
+set_error_handler(function() {
+//    var_dump(func_get_args());
+    DoesNotExists::$nope = true;
+}, E_ALL | E_STRICT);
+
+$foo = new Mock_MethodCallbackByReference_7b180d26();
+$InvMocker = new PHPUnit_Framework_MockObject_InvocationMocker();
+$foo->inv_mocker = $InvMocker;
+$OuterMatcher = new PHPUnit_Framework_MockObject_Matcher();
+$InvMocker->addMatcher($OuterMatcher);
+$OuterMatcher->methodNameMatcher = null;
+$OuterMatcher->stub = new PHPUnit_Framework_MockObject_Stub_ReturnCallback([$foo, 'callback']);
+$a = $b = $c = 0;
+$foo->bar($a, $b, $c);
+--EXPECTF--
+Fatal error: Uncaught Error: Class 'DoesNotExists' not found in %sbug72101.php:61
+Stack trace:
+#0 %sbug72101.php(8): {closure}(2, 'Parameter 1 to ...', '%s', 8, Array)
+#1 %sbug72101.php(27): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#2 %sbug72101.php(19): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(51): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#4 %sbug72101.php(72): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
+#5 {main}
+  thrown in %sbug72101.php on line 61
@@ -0,0 +1,18 @@
+--TEST--
+Bug #72119 (Interface declaration compatibility regression with default values)
+--FILE--
+<?php
+interface Foo {
+    public function bar(array $baz = null);
+}
+
+class Hello implements Foo {
+    public function bar(array $baz = [])
+    {
+
+    }
+}
+echo "OK\n";
+?>
+--EXPECT--
+OK
@@ -0,0 +1,10 @@
+--TEST--
+Bug #72162 (use-after-free - error_reporting)
+--FILE--
+<?php
+error_reporting(E_ALL);
+$var11 = new StdClass();
+$var16 = error_reporting($var11);
+?>
+--EXPECTF--
+Catchable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d
@@ -0,0 +1,73 @@
+--TEST--
+call_user_func_array() passes value to prefer-ref arg if element wasn't a reference
+--FILE--
+<?php
+
+namespace {
+    call_user_func_array('array_multisort', [[3, 2, 1]]);
+
+    $args = [[3, 2, 1]];
+    call_user_func_array('array_multisort', $args);
+    var_dump($args);
+    unset($args);
+
+    $array = [3, 2, 1];
+    call_user_func('array_multisort', $array);
+    var_dump($array);
+    unset($array);
+}
+
+namespace Foo {
+    call_user_func_array('array_multisort', [[3, 2, 1]]);
+
+    $args = [[3, 2, 1]];
+    call_user_func_array('array_multisort', $args);
+    var_dump($args);
+    unset($args);
+
+    $array = [3, 2, 1];
+    call_user_func('array_multisort', $array);
+    var_dump($array);
+    unset($array);
+}
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(3) {
+    [0]=>
+    int(3)
+    [1]=>
+    int(2)
+    [2]=>
+    int(1)
+  }
+}
+array(3) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(2)
+  [2]=>
+  int(1)
+}
+array(1) {
+  [0]=>
+  array(3) {
+    [0]=>
+    int(3)
+    [1]=>
+    int(2)
+    [2]=>
+    int(1)
+  }
+}
+array(3) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(2)
+  [2]=>
+  int(1)
+}
@@ -0,0 +1,16 @@
+--TEST--
+Closure::__invoke() is case insensitive
+--FILE--
+<?php
+
+$inc = function(&$n) {
+    $n++;
+};
+
+$n = 1;
+$inc->__INVOKE($n);
+var_dump($n);
+
+?>
+--EXPECT--
+int(2)
@@ -0,0 +1,47 @@
+--TEST--
+Constant expressions with null coalescing operator ??
+--FILE--
+<?php
+
+const A = [1 => [[]]];
+
+const T_1 = null ?? A[1]['undefined']['index'] ?? 1;
+const T_2 = null ?? A['undefined']['index'] ?? 2;
+const T_3 = null ?? A[1][0][2] ?? 3;
+const T_4 = A[1][0][2] ?? 4;
+const T_5 = null ?? __LINE__;
+const T_6 = __LINE__ ?? "bar";
+
+var_dump(T_1);
+var_dump(T_2);
+var_dump(T_3);
+var_dump(T_4);
+var_dump(T_5);
+var_dump(T_6);
+
+var_dump((function(){ static $var = null ?? A[1]['undefined']['index'] ?? 1; return $var; })());
+var_dump((function(){ static $var = null ?? A['undefined']['index'] ?? 2; return $var; })());
+var_dump((function(){ static $var = null ?? A[1][0][2] ?? 3; return $var; })());
+var_dump((function(){ static $var = A[1][0][2] ?? 4; return $var; })());
+
+var_dump((new class { public $var = null ?? A[1]['undefined']['index'] ?? 1; })->var);
+var_dump((new class { public $var = null ?? A['undefined']['index'] ?? 2; })->var);
+var_dump((new class { public $var = null ?? A[1][0][2] ?? 3; })->var);
+var_dump((new class { public $var = A[1][0][2] ?? 4; })->var);
+
+?>
+--EXPECTF--
+int(1)
+int(2)
+int(3)
+int(4)
+int(%d)
+int(%d)
+int(1)
+int(2)
+int(3)
+int(4)
+int(1)
+int(2)
+int(3)
+int(4)
@@ -0,0 +1,11 @@
+--TEST--
+Constant expressions with empty dimension fetch on coalesce
+--FILE--
+<?php
+
+const A = [][] ?? 1;
+
+?>
+--EXPECTF--
+Fatal error: Cannot use [] for reading in %s.php on line %d
+
@@ -35,10 +35,12 @@ const T_19 = [
    false => false,
    true => true,
 ];
+eval("const T_20x = 'a';");
+const T_20 = null ?: (T_20x . 'bc');

 var_dump(
    T_1, T_2, T_3, T_4, T_5, T_6, T_7, T_8, T_9, T_10,
-    T_11, T_12, T_13, T_14, T_15, T_16, T_17, T_18, T_19
+    T_11, T_12, T_13, T_14, T_15, T_16, T_17, T_18, T_19, T_20
 );

 ?>
@@ -75,3 +77,4 @@ array(6) {
  [1]=>
  bool(true)
 }
+string(3) "abc"
@@ -0,0 +1,15 @@
+--TEST--
+Crash when using dynamic call syntax with fully qualified name in a namespace
+--FILE--
+<?php
+
+namespace Foo;
+try {
+    ('\bar')();
+} catch (\Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Call to undefined function bar()
@@ -3,10 +3,12 @@ Testing each() with array and object
 --FILE--
 <?php

-$foo = each(new stdClass);
+$a = new stdClass;
+$foo = each($a);
 var_dump($foo);

-var_dump(each(new stdClass));
+$a = new stdClass;
+var_dump(each($a));

 $a = array(new stdClass);
 var_dump(each($a));
@@ -45,7 +45,7 @@ $done = 0;
 $a = [0,1,2,3,4];
 foreach($a as &$v) {
 	echo "$v\n";
-	if ($done && $v == 3) {
+	if (!$done && $v == 3) {
 		$done = 1;
 		array_splice($a, 1, 2, $replacement);
 	}
@@ -0,0 +1,37 @@
+--TEST--
+Cannot "yield from" from force closed generator
+--FILE--
+<?php
+
+function gen1() {
+    echo "gen1\n";
+    yield 1;
+}
+
+function gen2() {
+    try {
+        echo "try\n";
+        yield from gen1();
+    } finally {
+        echo "finally\n";
+        yield from gen1();
+    }
+}
+
+try {
+    $gen = gen2();
+    $gen->rewind();
+    unset($gen);
+} catch (Error $e) {
+    echo $e, "\n";
+}
+
+?>
+--EXPECTF--
+try
+gen1
+finally
+Error: Cannot use "yield from" in a force-closed generator in %s:%d
+Stack trace:
+#0 %s(%d): gen2()
+#1 {main}
@@ -12,4 +12,4 @@ class Obj
 function echo(){} // not valid

 --EXPECTF--
-Parse error: syntax error, unexpected 'echo' (T_ECHO), expecting identifier (T_STRING) or '(' in %s on line 9
+Parse error: syntax error, unexpected 'echo' (T_ECHO), expecting %s in %s on line 9
@@ -80,7 +80,6 @@ class Obj
    function __FILE__(){ echo __METHOD__, PHP_EOL; }
    function __DIR__(){ echo __METHOD__, PHP_EOL; }
    function __NAMESPACE__(){ echo __METHOD__, PHP_EOL; }
-    function __halt_compiler(){ echo __METHOD__, PHP_EOL; }
 }

 $obj = new Obj;
@@ -160,7 +159,6 @@ $obj->__LINE__();
 $obj->__FILE__();
 $obj->__DIR__();
 $obj->__NAMESPACE__();
-$obj->__halt_compiler();

 echo "\nDone\n";

@@ -240,6 +238,5 @@ Obj::__LINE__
 Obj::__FILE__
 Obj::__DIR__
 Obj::__NAMESPACE__
-Obj::__halt_compiler

 Done
@@ -80,7 +80,6 @@ class Obj
    static function __FILE__(){ echo __METHOD__, PHP_EOL; }
    static function __DIR__(){ echo __METHOD__, PHP_EOL; }
    static function __NAMESPACE__(){ echo __METHOD__, PHP_EOL; }
-    static function __halt_compiler(){ echo __METHOD__, PHP_EOL; }
 }

 Obj::empty();
@@ -158,7 +157,6 @@ Obj::__LINE__();
 Obj::__FILE__();
 Obj::__DIR__();
 Obj::__NAMESPACE__();
-Obj::__halt_compiler();

 echo "\nDone\n";

@@ -238,6 +236,5 @@ Obj::__LINE__
 Obj::__FILE__
 Obj::__DIR__
 Obj::__NAMESPACE__
-Obj::__halt_compiler

 Done
@@ -79,7 +79,6 @@ class Obj
    const __FILE__ = '__FILE__';
    const __DIR__ = '__DIR__';
    const __NAMESPACE__ = '__NAMESPACE__';
-    const __HALT_COMPILER = '__halt_compiler';
 }

 echo Obj::EMPTY, PHP_EOL;
@@ -156,7 +155,6 @@ echo Obj::__LINE__, PHP_EOL;
 echo Obj::__FILE__, PHP_EOL;
 echo Obj::__DIR__, PHP_EOL;
 echo Obj::__NAMESPACE__, PHP_EOL;
-echo Obj::__HALT_COMPILER, PHP_EOL;

 echo "\nDone\n";

@@ -235,6 +233,5 @@ __LINE__
 __FILE__
 __DIR__
 __NAMESPACE__
-__halt_compiler

 Done
@@ -0,0 +1,18 @@
+--TEST--
+Leak when using an invalid parent:: reference in a constant definition
+--FILE--
+<?php
+
+class A {
+    const B = parent::C;
+}
+
+try {
+    A::B;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Cannot access parent:: when current class scope has no parent
@@ -2,6 +2,13 @@
 int memory_get_peak_usage ([ bool $real_usage = false ] );
 --CREDITS--
 marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
+--SKIPIF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+?>
 --INI--
 memory_limit=-1
 --FILE--
@@ -0,0 +1,25 @@
+--TEST--
+Indirect modification of isref by-value return value not possible
+--FILE--
+<?php
+
+class A {
+    public $b;
+}
+
+$arr = [];
+
+$a = new A;
+$a->b =& $arr;
+
+(new ReflectionProperty('A', 'b'))->getValue($a)[] = 42;
+
+var_dump($a);
+
+?>
+--EXPECT--
+object(A)#1 (1) {
+  ["b"]=>
+  &array(0) {
+  }
+}
@@ -0,0 +1,15 @@
+--TEST--
+Class declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    class Bar {}
+}
+
+namespace Bazzle {
+    use Foo\Bar;
+    class Bar {}
+}
+--EXPECTF--
+Fatal error: Cannot declare class Bazzle\Bar because the name is already in use in %s on line %d
@@ -0,0 +1,15 @@
+--TEST--
+Function declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    function bar() {}
+}
+
+namespace Bazzle {
+    use function Foo\bar;
+    function bar() {}
+}
+--EXPECTF--
+Fatal error: Cannot declare function Bazzle\bar because the name is already in use in %s on line %d
@@ -0,0 +1,15 @@
+--TEST--
+Class declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    const BAR = 42;
+}
+
+namespace Bazzle {
+    use const Foo\BAR;
+    const BAR = 24;
+}
+--EXPECTF--
+Fatal error: Cannot declare const Bazzle\BAR because the name is already in use in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Leak in QM_ASSIGN when unwrapping references (rc=1)
+--FILE--
+<?php
+
+function &ref() {
+    $str = "str";
+    $str .= "str";
+    return $str;
+}
+
+var_dump(true ? ref() : ref());
+var_dump(ref() ?: ref());
+var_dump(ref() ?? ref());
+
+?>
+--EXPECT--
+string(6) "strstr"
+string(6) "strstr"
+string(6) "strstr"
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71978 (Existence of return type hint affects other compatibility rules)
+--FILE--
+<?php
+class A {
+	function foo(int $a) {}
+}
+class B extends A {
+	function foo(string $a) {}
+}
+class A1 {
+	function foo(int $a): int {}
+}
+class B1 extends A1 {
+	function foo(string $a): int {}
+}
+?>
+--EXPECTF--
+Warning: Declaration of B::foo(string $a) should be compatible with A::foo(int $a) in %s on line %d
+
+Warning: Declaration of B1::foo(string $a): int should be compatible with A1::foo(int $a): int in %s on line %d
@@ -16,4 +16,4 @@ class C implements IFoo {
 }

 --EXPECTF--
-Fatal error: Declaration of TFoo::oneArgument() must be compatible with IFoo::oneArgument($a) in %s on line %d
+Fatal error: Declaration of C::oneArgument() must be compatible with IFoo::oneArgument($a) in %s on line %d
@@ -148,7 +148,7 @@ static HashTable *global_class_table = NULL;
 static HashTable *global_constants_table = NULL;
 static HashTable *global_auto_globals_table = NULL;
 static HashTable *global_persistent_list = NULL;
-ZEND_TSRMLS_CACHE_DEFINE();
+ZEND_TSRMLS_CACHE_DEFINE()
 #endif

 ZEND_API zend_utility_values zend_uv;
@@ -77,7 +77,7 @@
 #define ZEND_TSRMLS_CACHE
 #endif

-ZEND_TSRMLS_CACHE_EXTERN();
+ZEND_TSRMLS_CACHE_EXTERN()

 #ifdef HAVE_NORETURN
 # ifdef ZEND_NORETURN_ALIAS
@@ -1226,8 +1226,15 @@ ZEND_API void object_properties_load(zend_object *object, HashTable *properties)
 				size_t prop_name_len;
 				if (zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_name_len) == SUCCESS) {
 					zend_string *pname = zend_string_init(prop_name, prop_name_len, 0);
+					zend_class_entry *prev_scope = EG(scope);
+					if (class_name && class_name[0] != '*') {
+						zend_string *cname = zend_string_init(class_name, strlen(class_name), 0);
+						EG(scope) = zend_lookup_class(cname);
+						zend_string_release(cname);
+					}
 					property_info = zend_get_property_info(object->ce, pname, 1);
 					zend_string_release(pname);
+					EG(scope) = prev_scope;
 				} else {
 					property_info = ZEND_WRONG_PROPERTY_INFO;
 				}
@@ -3351,6 +3358,7 @@ again:
 					memcpy(ZSTR_VAL(*callable_name), ZSTR_VAL(ce->name), ZSTR_LEN(ce->name));
 					memcpy(ZSTR_VAL(*callable_name) + ZSTR_LEN(ce->name), "::__invoke", sizeof("::__invoke"));
 				}
+				fcc->initialized = 1;
 				return 1;
 			}
 			if (callable_name) {
@@ -476,8 +476,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;

 /** Build zend_call_info/cache from a zval*
 *
- * Caller is responsible to provide a return value, otherwise the we will crash.
- * fci->retval_ptr_ptr = NULL;
+ * Caller is responsible to provide a return value (fci->retval), otherwise the we will crash.
 * In order to pass parameters the following members need to be set:
 * fci->param_count = 0;
 * fci->params = NULL;
@@ -200,6 +200,10 @@ typedef struct  _zend_mm_huge_list zend_mm_huge_list;
 # define PTR_FMT "0x%0.8lx"
 #endif

+#ifdef MAP_HUGETLB
+int zend_mm_use_huge_pages = 0;
+#endif
+
 /*
 * Memory is retrived from OS by chunks of fixed size 2MB.
 * Inside chunk it's managed by pages of fixed size 4096B.
@@ -462,7 +466,7 @@ static void *zend_mm_mmap(size_t size)
 	void *ptr;

 #ifdef MAP_HUGETLB
-	if (size == ZEND_MM_CHUNK_SIZE) {
+	if (zend_mm_use_huge_pages && size == ZEND_MM_CHUNK_SIZE) {
 		ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON | MAP_HUGETLB, -1, 0);
 		if (ptr != MAP_FAILED) {
 			return ptr;
@@ -1353,6 +1357,10 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
 	/* special handling for zero-size allocation */
 	size = MAX(size, 1);
 	size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
+	if (UNEXPECTED(size < real_size)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
+		return NULL;
+	}
 #endif
 	if (size <= ZEND_MM_MAX_SMALL_SIZE) {
 		ptr = zend_mm_alloc_small(heap, size, ZEND_MM_SMALL_SIZE_TO_BIN(size) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -2324,7 +2332,7 @@ ZEND_API int is_zend_mm(void)
 #endif
 }

-#if !ZEND_DEBUG && !defined(_WIN32)
+#if !ZEND_DEBUG && (!defined(_WIN32) || defined(__clang__))
 #undef _emalloc

 #if ZEND_MM_CUSTOM
@@ -2643,6 +2651,12 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		alloc_globals->mm_heap->custom_heap.std._realloc = realloc;
 		return;
 	}
+#endif
+#ifdef MAP_HUGETLB
+	tmp = getenv("USE_ZEND_ALLOC_HUGE_PAGES");
+	if (tmp && zend_atoi(tmp, 0)) {
+		zend_mm_use_huge_pages = 1;
+	}
 #endif
 	ZEND_TSRMLS_CACHE_UPDATE();
 	alloc_globals->mm_heap = zend_mm_init();
@@ -337,6 +337,22 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 				zval_dtor(&op1);
 			}
 			break;
+		case ZEND_AST_COALESCE:
+			if (UNEXPECTED(zend_ast_evaluate(&op1, ast->child[0], scope) != SUCCESS)) {
+				ret = FAILURE;
+				break;
+			}
+			if (Z_TYPE(op1) > IS_NULL) {
+				*result = op1;
+			} else {
+				if (UNEXPECTED(zend_ast_evaluate(result, ast->child[1], scope) != SUCCESS)) {
+					zval_dtor(&op1);
+					ret = FAILURE;
+					break;
+				}
+				zval_dtor(&op1);
+			}
+			break;
 		case ZEND_AST_UNARY_PLUS:
 			if (UNEXPECTED(zend_ast_evaluate(&op2, ast->child[0], scope) != SUCCESS)) {
 				ret = FAILURE;
@@ -385,6 +401,10 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 			}
 			break;
 		case ZEND_AST_DIM:
+			if (ast->child[1] == NULL) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
+			}
+
 			if (UNEXPECTED(zend_ast_evaluate(&op1, ast->child[0], scope) != SUCCESS)) {
 				ret = FAILURE;
 			} else if (UNEXPECTED(zend_ast_evaluate(&op2, ast->child[1], scope) != SUCCESS)) {
@@ -393,7 +413,12 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 			} else {
 				zval tmp;

-				zend_fetch_dimension_by_zval(&tmp, &op1, &op2);
+				if (ast->attr == ZEND_DIM_IS) {
+					zend_fetch_dimension_by_zval_is(&tmp, &op1, &op2, IS_CONST);
+				} else {
+					zend_fetch_dimension_by_zval(&tmp, &op1, &op2);
+				}
+
 				if (UNEXPECTED(Z_ISREF(tmp))) {
 					ZVAL_DUP(result, Z_REFVAL(tmp));
 				} else {
@@ -922,6 +947,21 @@ static void zend_ast_export_zval(smart_str *str, zval *zv, int priority, int ind
 	}
 }

+static void zend_ast_export_class_no_header(smart_str *str, zend_ast_decl *decl, int indent) {
+	if (decl->child[0]) {
+		smart_str_appends(str, " extends ");
+		zend_ast_export_ns_name(str, decl->child[0], 0, indent);
+	}
+	if (decl->child[1]) {
+		smart_str_appends(str, " implements ");
+		zend_ast_export_ex(str, decl->child[1], 0, indent);
+	}
+	smart_str_appends(str, " {\n");
+	zend_ast_export_stmt(str, decl->child[2], indent + 1);
+	zend_ast_export_indent(str, indent);
+	smart_str_appends(str, "}");
+}
+
 #define BINARY_OP(_op, _p, _pl, _pr) do { \
 		op = _op; \
 		p = _p; \
@@ -1048,18 +1088,8 @@ tail_call:
 				smart_str_appends(str, "class ");
 			}
 			smart_str_appendl(str, ZSTR_VAL(decl->name), ZSTR_LEN(decl->name));
-			if (decl->child[0]) {
-				smart_str_appends(str, " extends ");
-				zend_ast_export_ns_name(str, decl->child[0], 0, indent);
-			}
-			if (decl->child[1]) {
-				smart_str_appends(str, " implements ");
-				zend_ast_export_ex(str, decl->child[1], 0, indent);
-			}
-			smart_str_appends(str, " {\n");
-			zend_ast_export_stmt(str, decl->child[2], indent + 1);
-			zend_ast_export_indent(str, indent);
-			smart_str_appends(str, "}\n");
+			zend_ast_export_class_no_header(str, decl, indent);
+			smart_str_appendc(str, '\n');
 			break;

 		/* list nodes */
@@ -1187,7 +1217,11 @@ simple_list:
 			if (ast->child[0]->kind == ZEND_AST_ENCAPS_LIST) {
 				zend_ast_export_encaps_list(str, '`', (zend_ast_list*)ast->child[0], indent);
 			} else {
-				zend_ast_export_ex(str, ast->child[0], 0, indent);
+				zval *zv;
+				ZEND_ASSERT(ast->child[0]->kind == ZEND_AST_ZVAL);
+				zv = zend_ast_get_zval(ast->child[0]);
+				ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);
+				zend_ast_export_qstr(str, '`', Z_STR_P(zv));
 			}
 			smart_str_appendc(str, '`');
 			break;
@@ -1344,10 +1378,20 @@ simple_list:
 			break;
 		case ZEND_AST_NEW:
 			smart_str_appends(str, "new ");
-			zend_ast_export_ns_name(str, ast->child[0], 0, indent);
-			smart_str_appendc(str, '(');
-			zend_ast_export_ex(str, ast->child[1], 0, indent);
-			smart_str_appendc(str, ')');
+			if (ast->child[0]->kind == ZEND_AST_CLASS) {
+				smart_str_appends(str, "class");
+				if (zend_ast_get_list(ast->child[1])->children) {
+					smart_str_appendc(str, '(');
+					zend_ast_export_ex(str, ast->child[1], 0, indent);
+					smart_str_appendc(str, ')');
+				}
+				zend_ast_export_class_no_header(str, (zend_ast_decl *) ast->child[0], indent);
+			} else {
+				zend_ast_export_ns_name(str, ast->child[0], 0, indent);
+				smart_str_appendc(str, '(');
+				zend_ast_export_ex(str, ast->child[1], 0, indent);
+				smart_str_appendc(str, ')');
+			}
 			break;
 		case ZEND_AST_INSTANCEOF:
 			zend_ast_export_ex(str, ast->child[0], 0, indent);
@@ -704,7 +704,8 @@ ZEND_FUNCTION(error_reporting)
 #endif

 	old_error_reporting = EG(error_reporting);
-	if(ZEND_NUM_ARGS() != 0) {
+	if (ZEND_NUM_ARGS() != 0) {
+		zend_string *new_val = zval_get_string(err);
 		do {
 			zend_ini_entry *p = EG(error_reporting_ini_entry);

@@ -730,7 +731,7 @@ ZEND_FUNCTION(error_reporting)
 				zend_string_release(p->value);
 			}

-			p->value = zval_get_string(err);
+			p->value = new_val;
 			if (Z_TYPE_P(err) == IS_LONG) {
 				EG(error_reporting) = Z_LVAL_P(err);
 			} else {
@@ -1183,7 +1184,7 @@ ZEND_FUNCTION(get_object_vars)

 	zobj = Z_OBJ_P(obj);

-	if (!zobj->ce->default_properties_count && properties == zobj->properties) {
+	if (!zobj->ce->default_properties_count && properties == zobj->properties && !ZEND_HASH_GET_APPLY_COUNT(properties)) {
 		/* fast copy */
 		if (EXPECTED(zobj->handlers == &std_object_handlers)) {
 			if (EXPECTED(!(GC_FLAGS(properties) & IS_ARRAY_IMMUTABLE))) {
@@ -297,14 +297,10 @@ ZEND_API zval* zend_get_closure_this_ptr(zval *obj) /* {{{ */

 static zend_function *zend_closure_get_method(zend_object **object, zend_string *method, const zval *key) /* {{{ */
 {
-	zend_string *lc_name;
-
-	lc_name = zend_string_tolower(method);
-	if (zend_string_equals_literal(method, ZEND_INVOKE_FUNC_NAME)) {
-		zend_string_release(lc_name);
+	if (zend_string_equals_literal_ci(method, ZEND_INVOKE_FUNC_NAME)) {
 		return zend_get_closure_invoke_method(*object);
 	}
-	zend_string_release(lc_name);
+
 	return std_object_handlers.get_method(object, method, key);
 }
 /* }}} */
@@ -611,16 +611,29 @@ static inline void zend_end_loop(int cont_addr) /* {{{ */

 void zend_do_free(znode *op1) /* {{{ */
 {
-	if (op1->op_type==IS_TMP_VAR) {
-		zend_op *opline = get_next_op(CG(active_op_array));
+	if (op1->op_type == IS_TMP_VAR) {
+		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
+
+		while (opline->opcode == ZEND_END_SILENCE) {
+			opline--;
+		}
+
+		if (opline->result_type == IS_TMP_VAR && opline->result.var == op1->u.op.var) {
+			if (opline->opcode == ZEND_BOOL || opline->opcode == ZEND_BOOL_NOT) {
+				return;
+			}
+		}
+
+		opline = get_next_op(CG(active_op_array));

 		opline->opcode = ZEND_FREE;
 		SET_NODE(opline->op1, op1);
 		SET_UNUSED(opline->op2);
-	} else if (op1->op_type==IS_VAR) {
+	} else if (op1->op_type == IS_VAR) {
 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
-
-		while (opline->opcode == ZEND_END_SILENCE || opline->opcode == ZEND_EXT_FCALL_END || opline->opcode == ZEND_OP_DATA) {
+		while (opline->opcode == ZEND_END_SILENCE ||
+				opline->opcode == ZEND_EXT_FCALL_END ||
+				opline->opcode == ZEND_OP_DATA) {
 			opline--;
 		}
 		if (opline->result_type == IS_VAR
@@ -650,7 +663,7 @@ void zend_do_free(znode *op1) /* {{{ */
 					SET_UNUSED(opline->op2);
 					return;
 				}
-				if (opline->result_type==IS_VAR
+				if (opline->result_type == IS_VAR
 					&& opline->result.var == op1->u.op.var) {
 					if (opline->opcode == ZEND_NEW) {
 						opline->result_type |= EXT_TYPE_UNUSED;
@@ -760,6 +773,7 @@ zend_string *zend_resolve_non_class_name(

 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
+		*is_fully_qualified = 1;
 		return zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
 	}

@@ -1203,7 +1217,7 @@ ZEND_API int zend_unmangle_property_name_ex(const zend_string *name, const char

 	*class_name = NULL;

-	if (ZSTR_VAL(name)[0] != '\0') {
+	if (!ZSTR_LEN(name) || ZSTR_VAL(name)[0] != '\0') {
 		*prop_name = ZSTR_VAL(name);
 		if (prop_len) {
 			*prop_len = ZSTR_LEN(name);
@@ -3155,6 +3169,14 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return FAILURE;
 	}

+	if (zend_string_equals_literal(lcname, "assert")) {
+		return zend_compile_assert(result, args, lcname, fbc);
+	}
+
+	if (CG(compiler_options) & ZEND_COMPILE_NO_BUILTINS) {
+		return FAILURE;
+	}
+
 	if (zend_string_equals_literal(lcname, "strlen")) {
 		return zend_compile_func_strlen(result, args);
 	} else if (zend_string_equals_literal(lcname, "is_null")) {
@@ -3185,8 +3207,6 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return zend_compile_func_cufa(result, args, lcname);
 	} else if (zend_string_equals_literal(lcname, "call_user_func")) {
 		return zend_compile_func_cuf(result, args, lcname);
-	} else if (zend_string_equals_literal(lcname, "assert")) {
-		return zend_compile_assert(result, args, lcname, fbc);
 	} else {
 		return FAILURE;
 	}
@@ -4471,8 +4491,9 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 			zend_error_noreturn(E_COMPILE_ERROR, "Redefinition of parameter $%s",
 				ZSTR_VAL(name));
 		} else if (zend_string_equals_literal(name, "this")) {
-			if (op_array->scope && (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
-				zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
+			if ((op_array->scope || (op_array->fn_flags & ZEND_ACC_CLOSURE))
+					&& (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use $this as parameter");
 			}
 			op_array->this_var = var_node.u.op.var;
 		}
@@ -4636,7 +4657,7 @@ void zend_begin_method_decl(zend_op_array *op_array, zend_string *name, zend_boo
 	zend_string *lcname;

 	if (in_interface) {
-		if ((op_array->fn_flags & ZEND_ACC_PPP_MASK) != ZEND_ACC_PUBLIC) {
+		if (!is_public || (op_array->fn_flags & (ZEND_ACC_FINAL|ZEND_ACC_ABSTRACT))) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Access type for interface method "
 				"%s::%s() must be omitted", ZSTR_VAL(ce->name), ZSTR_VAL(name));
 		}
@@ -4798,15 +4819,16 @@ void zend_begin_method_decl(zend_op_array *op_array, zend_string *name, zend_boo
 static void zend_begin_func_decl(znode *result, zend_op_array *op_array, zend_ast_decl *decl) /* {{{ */
 {
 	zend_ast *params_ast = decl->child[0];
-	zend_string *name = decl->name, *lcname;
+	zend_string *unqualified_name, *name, *lcname;
 	zend_op *opline;

-	op_array->function_name = name = zend_prefix_with_ns(name);
-
+	unqualified_name = decl->name;
+	op_array->function_name = name = zend_prefix_with_ns(unqualified_name);
 	lcname = zend_string_tolower(name);

 	if (FC(imports_function)) {
-		zend_string *import_name = zend_hash_find_ptr(FC(imports_function), lcname);
+		zend_string *import_name = zend_hash_find_ptr_lc(
+			FC(imports_function), ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name));
 		if (import_name && !zend_string_equals_ci(lcname, import_name)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare function %s "
 				"because the name is already in use", ZSTR_VAL(name));
@@ -5189,7 +5211,7 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 	zend_ast *extends_ast = decl->child[0];
 	zend_ast *implements_ast = decl->child[1];
 	zend_ast *stmt_ast = decl->child[2];
-	zend_string *name, *lcname, *import_name = NULL;
+	zend_string *name, *lcname;
 	zend_class_entry *ce = zend_arena_alloc(&CG(arena), sizeof(zend_class_entry));
 	zend_op *opline;
 	znode declare_node, extends_node;
@@ -5198,31 +5220,25 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 	znode original_implementing_class = FC(implementing_class);

 	if (EXPECTED((decl->flags & ZEND_ACC_ANON_CLASS) == 0)) {
+		zend_string *unqualified_name = decl->name;
+
 		if (CG(active_class_entry)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Class declarations may not be nested");
 		}
-		name = decl->name;
-		zend_assert_valid_class_name(name);
-		lcname = zend_string_tolower(name);
-		if (FC(current_namespace)) {
-			name = zend_prefix_with_ns(name);

-			zend_string_release(lcname);
-			lcname = zend_string_tolower(name);
-		} else {
-			zend_string_addref(name);
-		}
+		zend_assert_valid_class_name(unqualified_name);
+		name = zend_prefix_with_ns(unqualified_name);
+		name = zend_new_interned_string(name);
+		lcname = zend_string_tolower(name);

 		if (FC(imports)) {
-			import_name = zend_hash_find_ptr(FC(imports), lcname);
+			zend_string *import_name = zend_hash_find_ptr_lc(
+				FC(imports), ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name));
+			if (import_name && !zend_string_equals_ci(lcname, import_name)) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare class %s "
+						"because the name is already in use", ZSTR_VAL(name));
+			}
 		}
-
-		if (import_name && !zend_string_equals_ci(lcname, import_name)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare class %s "
-					"because the name is already in use", ZSTR_VAL(name));
-		}
-
-		name = zend_new_interned_string(name);
 	} else {
 		name = zend_generate_anon_class_name(decl->lex_pos);
 		lcname = zend_string_tolower(name);
@@ -5298,10 +5314,6 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */

 	CG(active_class_entry) = ce;

-	if (implements_ast) {
-		zend_compile_implements(&declare_node, implements_ast);
-	}
-
 	zend_compile_stmt(stmt_ast);

 	/* Reset lineno for final opcodes and errors */
@@ -5358,11 +5370,15 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 		zend_emit_op(NULL, ZEND_BIND_TRAITS, &declare_node, NULL);
 	}

+	if (implements_ast) {
+		zend_compile_implements(&declare_node, implements_ast);
+	}
+
 	if (!(ce->ce_flags & (ZEND_ACC_INTERFACE|ZEND_ACC_EXPLICIT_ABSTRACT_CLASS))
-		&& (extends_ast || ce->num_interfaces > 0)
+		&& (extends_ast || implements_ast)
 	) {
 		zend_verify_abstract_class(ce);
-		if (ce->num_interfaces && !(ce->ce_flags & ZEND_ACC_IMPLEMENT_TRAITS)) {
+		if (implements_ast) {
 			zend_emit_op(NULL, ZEND_VERIFY_ABSTRACT_CLASS, &declare_node, NULL);
 		}
 	}
@@ -5573,26 +5589,26 @@ void zend_compile_const_decl(zend_ast *ast) /* {{{ */
 		zend_ast *const_ast = list->child[i];
 		zend_ast *name_ast = const_ast->child[0];
 		zend_ast *value_ast = const_ast->child[1];
-		zend_string *name = zend_ast_get_str(name_ast);
+		zend_string *unqualified_name = zend_ast_get_str(name_ast);

-		zend_string *import_name;
+		zend_string *name;
 		znode name_node, value_node;
 		zval *value_zv = &value_node.u.constant;

 		value_node.op_type = IS_CONST;
 		zend_const_expr_to_zval(value_zv, value_ast);

-		if (zend_lookup_reserved_const(ZSTR_VAL(name), ZSTR_LEN(name))) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot redeclare constant '%s'", ZSTR_VAL(name));
+		if (zend_lookup_reserved_const(ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name))) {
+			zend_error_noreturn(E_COMPILE_ERROR,
+				"Cannot redeclare constant '%s'", ZSTR_VAL(unqualified_name));
 		}

-		name = zend_prefix_with_ns(name);
+		name = zend_prefix_with_ns(unqualified_name);
 		name = zend_new_interned_string(name);

-		if (FC(imports_const)
-			&& (import_name = zend_hash_find_ptr(FC(imports_const), name))
-		) {
-			if (!zend_string_equals(import_name, name)) {
+		if (FC(imports_const)) {
+			zend_string *import_name = zend_hash_find_ptr(FC(imports_const), unqualified_name);
+			if (import_name && !zend_string_equals(import_name, name)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare const %s because "
 					"the name is already in use", ZSTR_VAL(name));
 			}
@@ -6054,7 +6070,7 @@ void zend_compile_short_circuiting(znode *result, zend_ast *ast) /* {{{ */

 				zval_ptr_dtor(&right_node.u.constant);
 			} else {
-				zend_emit_op(result, ZEND_BOOL, &right_node, NULL);
+				zend_emit_op_tmp(result, ZEND_BOOL, &right_node, NULL);
 			}
 		}

@@ -6819,7 +6835,7 @@ zend_bool zend_is_allowed_in_const_expr(zend_ast_kind kind) /* {{{ */
 		|| kind == ZEND_AST_CONDITIONAL || kind == ZEND_AST_DIM
 		|| kind == ZEND_AST_ARRAY || kind == ZEND_AST_ARRAY_ELEM
 		|| kind == ZEND_AST_CONST || kind == ZEND_AST_CLASS_CONST
-		|| kind == ZEND_AST_MAGIC_CONST;
+		|| kind == ZEND_AST_MAGIC_CONST || kind == ZEND_AST_COALESCE;
 }
 /* }}} */

@@ -6953,14 +6969,16 @@ void zend_const_expr_to_zval(zval *result, zend_ast *ast) /* {{{ */
 	zend_compile_const_expr(&ast);
 	if (ast->kind == ZEND_AST_ZVAL) {
 		ZVAL_COPY_VALUE(result, zend_ast_get_zval(ast));
-
-		/* Kill this branch of the original AST, as it was already destroyed.
-		 * It would be nice to find a better solution to this problem in the
-		 * future. */
-		orig_ast->kind = 0;
 	} else {
 		ZVAL_NEW_AST(result, zend_ast_copy(ast));
+		/* destroy the ast here, it might have been replaced */
+		zend_ast_destroy(ast);
 	}
+
+	/* Kill this branch of the original AST, as it was already destroyed.
+	 * It would be nice to find a better solution to this problem in the
+	 * future. */
+	orig_ast->kind = 0;
 }
 /* }}} */

@@ -7371,6 +7389,30 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */

 			zend_ct_eval_unary_pm(&result, ast->kind, zend_ast_get_zval(ast->child[0]));
 			break;
+		case ZEND_AST_COALESCE:
+			/* Set isset fetch indicator here, opcache disallows runtime altering of the AST */
+			if (ast->child[0]->kind == ZEND_AST_DIM) {
+				ast->child[0]->attr = ZEND_DIM_IS;
+			}
+			zend_eval_const_expr(&ast->child[0]);
+
+			if (ast->child[0]->kind != ZEND_AST_ZVAL) {
+				/* ensure everything was compile-time evaluated at least once */
+				zend_eval_const_expr(&ast->child[1]);
+				return;
+			}
+
+			if (Z_TYPE_P(zend_ast_get_zval(ast->child[0])) == IS_NULL) {
+				zend_eval_const_expr(&ast->child[1]);
+				*ast_ptr = ast->child[1];
+				ast->child[1] = NULL;
+				zend_ast_destroy(ast);
+			} else {
+				*ast_ptr = ast->child[0];
+				ast->child[0] = NULL;
+				zend_ast_destroy(ast);
+			}
+			return;
 		case ZEND_AST_CONDITIONAL:
 		{
 			zend_ast **child, *child_ast;
@@ -7404,6 +7446,11 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
 			}

+			/* Set isset fetch indicator here, opcache disallows runtime altering of the AST */
+			if (ast->attr == ZEND_DIM_IS && ast->child[0]->kind == ZEND_AST_DIM) {
+				ast->child[0]->attr = ZEND_DIM_IS;
+			}
+
 			zend_eval_const_expr(&ast->child[0]);
 			zend_eval_const_expr(&ast->child[1]);
 			if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
@@ -889,6 +889,8 @@ ZEND_API void zend_assert_valid_class_name(const zend_string *const_name);
 #define ZEND_SEND_BY_REF     1
 #define ZEND_SEND_PREFER_REF 2

+#define ZEND_DIM_IS 1
+
 static zend_always_inline int zend_check_arg_send_type(const zend_function *zf, uint32_t arg_num, uint32_t mask)
 {
 	arg_num--;
@@ -1009,6 +1011,9 @@ END_EXTERN_C()
 /* force IS_OBJ_USE_GUARDS for all classes */
 #define ZEND_COMPILE_GUARDS						(1<<9)

+/* disable builtin special case function calls */
+#define ZEND_COMPILE_NO_BUILTINS				(1<<10)
+
 /* The default value for CG(compiler_options) */
 #define ZEND_COMPILE_DEFAULT					ZEND_COMPILE_HANDLE_OP_ARRAY

@@ -299,7 +299,6 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 	zend_constant *c;
 	const char *colon;
 	zend_class_entry *ce = NULL;
-	zend_string *class_name;
 	const char *name = ZSTR_VAL(cname);
 	size_t name_len = ZSTR_LEN(cname);

@@ -315,13 +314,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 		int class_name_len = colon - name - 1;
 		size_t const_name_len = name_len - class_name_len - 2;
 		zend_string *constant_name = zend_string_init(colon + 1, const_name_len, 0);
-		char *lcname;
+		zend_string *class_name = zend_string_init(name, class_name_len, 0);
 		zval *ret_constant = NULL;
-		ALLOCA_FLAG(use_heap)

-		class_name = zend_string_init(name, class_name_len, 0);
-		lcname = do_alloca(class_name_len + 1, use_heap);
-		zend_str_tolower_copy(lcname, name, class_name_len);
 		if (!scope) {
 			if (EG(current_execute_data)) {
 				scope = EG(scope);
@@ -330,48 +325,43 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 			}
 		}

-		if (class_name_len == sizeof("self")-1 &&
-		    !memcmp(lcname, "self", sizeof("self")-1)) {
+		if (zend_string_equals_literal_ci(class_name, "self")) {
 			if (UNEXPECTED(!scope)) {
 				zend_throw_error(NULL, "Cannot access self:: when no class scope is active");
-				return NULL;
+				goto failure;
 			}
 			ce = scope;
-		} else if (class_name_len == sizeof("parent")-1 &&
-		           !memcmp(lcname, "parent", sizeof("parent")-1)) {
+		} else if (zend_string_equals_literal_ci(class_name, "parent")) {
 			if (UNEXPECTED(!scope)) {
 				zend_throw_error(NULL, "Cannot access parent:: when no class scope is active");
-				return NULL;
+				goto failure;
 			} else if (UNEXPECTED(!scope->parent)) {
 				zend_throw_error(NULL, "Cannot access parent:: when current class scope has no parent");
-				return NULL;
+				goto failure;
 			} else {
 				ce = scope->parent;
 			}
-		} else if (class_name_len == sizeof("static")-1 &&
-		           !memcmp(lcname, "static", sizeof("static")-1)) {
+		} else if (zend_string_equals_literal_ci(class_name, "static")) {
 			ce = zend_get_called_scope(EG(current_execute_data));
 			if (UNEXPECTED(!ce)) {
 				zend_throw_error(NULL, "Cannot access static:: when no class scope is active");
-				return NULL;
+				goto failure;
 			}
 		} else {
 			ce = zend_fetch_class(class_name, flags);
 		}
-		free_alloca(lcname, use_heap);
 		if (ce) {
 			ret_constant = zend_hash_find(&ce->constants_table, constant_name);
 			if (ret_constant == NULL) {
 				if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
 					zend_throw_error(NULL, "Undefined class constant '%s::%s'", ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
-					zend_string_release(class_name);
-					zend_string_free(constant_name);
-					return NULL;
 				}
 			} else if (Z_ISREF_P(ret_constant)) {
 				ret_constant = Z_REFVAL_P(ret_constant);
 			}
 		}
+
+failure:
 		zend_string_release(class_name);
 		zend_string_free(constant_name);
 		if (ret_constant && Z_CONSTANT_P(ret_constant)) {
@@ -1827,7 +1827,7 @@ try_array:

 try_string_offset:
 		if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
-			switch(Z_TYPE_P(dim)) {
+			switch (Z_TYPE_P(dim)) {
 				/* case IS_LONG: */
 				case IS_STRING:
 					if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
@@ -1912,6 +1912,12 @@ ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *
 	zend_fetch_dimension_address_read_R(result, container, dim, IS_TMP_VAR);
 }

+ZEND_API void zend_fetch_dimension_by_zval_is(zval *result, zval *container, zval *dim, int dim_type)
+{
+	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS);
+}
+
+
 static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type)
 {
    if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
@@ -296,6 +296,7 @@ ZEND_API zend_class_entry *zend_fetch_class_by_name(zend_string *class_name, con
 void zend_verify_abstract_class(zend_class_entry *ce);

 ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *dim);
+ZEND_API void zend_fetch_dimension_by_zval_is(zval *result, zval *container, zval *dim, int dim_type);

 ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data_ptr, uint32_t var);

@@ -295,8 +295,8 @@ void shutdown_executor(void) /* {{{ */
 		}

 		zend_stack_clean(&EG(user_error_handlers_error_reporting), NULL, 1);
-		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
-		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
+		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
+		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
 	} zend_end_try();

 	zend_try {
@@ -397,8 +397,8 @@ void shutdown_executor(void) /* {{{ */

 	zend_shutdown_fpu();

-#ifdef ZEND_DEBUG
-	if (EG(ht_iterators_used)) {
+#if ZEND_DEBUG
+	if (EG(ht_iterators_used) && !CG(unclean_shutdown)) {
 		zend_error(E_WARNING, "Leaked %" PRIu32 " hashtable iterators", EG(ht_iterators_used));
 	}
 #endif
@@ -786,6 +786,9 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 	if (func->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) {
 		if (func->common.fn_flags & ZEND_ACC_ABSTRACT) {
 			zend_throw_error(NULL, "Cannot call abstract method %s::%s()", ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (EG(current_execute_data) == &dummy_execute_data) {
+				EG(current_execute_data) = dummy_execute_data.prev_execute_data;
+			}
 			return FAILURE;
 		}
 		if (func->common.fn_flags & ZEND_ACC_DEPRECATED) {
@@ -851,6 +854,9 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 		ZEND_ADD_CALL_FLAG(call, ZEND_CALL_CLOSURE);
 	}

+	/* PHP-7 doesn't support symbol_table substitution for functions */
+	ZEND_ASSERT(fci->symbol_table == NULL);
+
 	if (func->type == ZEND_USER_FUNCTION) {
 		int call_via_handler = (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) != 0;
 		EG(scope) = func->common.scope;
@@ -31,7 +31,8 @@ static zend_object_handlers zend_generator_handlers;

 static zend_object *zend_generator_create(zend_class_entry *class_type);

-static void zend_generator_cleanup_unfinished_execution(zend_generator *generator) /* {{{ */
+static void zend_generator_cleanup_unfinished_execution(
+		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
 {
 	zend_execute_data *execute_data = generator->execute_data;

@@ -47,7 +48,7 @@ static void zend_generator_cleanup_unfinished_execution(zend_generator *generato
 		EG(vm_stack_end) = generator->stack->end;
 		EG(vm_stack) = generator->stack;

-		zend_cleanup_unfinished_execution(execute_data, op_num, 0);
+		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);

 		generator->stack = EG(vm_stack);
 		generator->stack->top = EG(vm_stack_top);
@@ -85,7 +86,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator);
+			zend_generator_cleanup_unfinished_execution(generator, 0);
 		}

 		/* Free closure object */
@@ -151,8 +152,11 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	/* If a finally block was found we jump directly to it and
 	 * resume the generator. */
 	if (finally_op_num) {
-		zval *fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
+		zval *fast_call;

+		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+
+		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
 		EG(exception) = NULL;
 		fast_call->u2.lineno = (uint32_t)-1;
@@ -571,12 +571,25 @@ static zend_always_inline zval *_zend_hash_add_or_update_i(HashTable *ht, zend_s
 			zval *data;

 			if (flag & HASH_ADD) {
-				return NULL;
-			}
-			ZEND_ASSERT(&p->val != pData);
-			data = &p->val;
-			if ((flag & HASH_UPDATE_INDIRECT) && Z_TYPE_P(data) == IS_INDIRECT) {
-				data = Z_INDIRECT_P(data);
+				if (!(flag & HASH_UPDATE_INDIRECT)) {
+					return NULL;
+				}
+				ZEND_ASSERT(&p->val != pData);
+				data = &p->val;
+				if (Z_TYPE_P(data) == IS_INDIRECT) {
+					data = Z_INDIRECT_P(data);
+					if (Z_TYPE_P(data) != IS_UNDEF) {
+						return NULL;
+					}
+				} else {
+					return NULL;
+				}
+			} else {
+				ZEND_ASSERT(&p->val != pData);
+				data = &p->val;
+				if ((flag & HASH_UPDATE_INDIRECT) && Z_TYPE_P(data) == IS_INDIRECT) {
+					data = Z_INDIRECT_P(data);
+				}
 			}
 			HANDLE_BLOCK_INTERRUPTIONS();
 			if (ht->pDestructor) {
@@ -1781,7 +1794,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 	target->pDestructor = source->pDestructor;

 	if (source->nNumUsed == 0) {
-		target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
@@ -1806,7 +1819,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 			target->nInternalPointer = idx;
 		}
 	} else if (source->u.flags & HASH_FLAG_PACKED) {
-		target->u.flags = (source->u.flags & ~HASH_FLAG_PERSISTENT) | HASH_FLAG_APPLY_PROTECTION;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION;
 		target->nTableMask = source->nTableMask;
 		target->nNumUsed = source->nNumUsed;
 		target->nNumOfElements = source->nNumOfElements;
@@ -1829,7 +1842,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 			target->nInternalPointer = idx;
 		}
 	} else {
-		target->u.flags = (source->u.flags & ~HASH_FLAG_PERSISTENT) | HASH_FLAG_APPLY_PROTECTION;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION;
 		target->nTableMask = source->nTableMask;
 		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = HT_INVALID_IDX;
@@ -1864,24 +1877,47 @@ ZEND_API void ZEND_FASTCALL _zend_hash_merge(HashTable *target, HashTable *sourc
    uint32_t idx;
 	Bucket *p;
 	zval *t;
-	uint32_t mode = (overwrite?HASH_UPDATE:HASH_ADD);

 	IS_CONSISTENT(source);
 	IS_CONSISTENT(target);
 	HT_ASSERT(GC_REFCOUNT(target) == 1);

-	for (idx = 0; idx < source->nNumUsed; idx++) {
-		p = source->arData + idx;
-		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
-		if (p->key) {
-			t = _zend_hash_add_or_update(target, p->key, &p->val, mode ZEND_FILE_LINE_RELAY_CC);
-			if (t && pCopyConstructor) {
-				pCopyConstructor(t);
+	if (overwrite) {
+		for (idx = 0; idx < source->nNumUsed; idx++) {
+			p = source->arData + idx;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
+			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
+			    continue;
 			}
-		} else {
-			if ((mode==HASH_UPDATE || !zend_hash_index_exists(target, p->h))) {
-			 	t = zend_hash_index_update(target, p->h, &p->val);
-			 	if (t && pCopyConstructor) {
+			if (p->key) {
+				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_UPDATE | HASH_UPDATE_INDIRECT ZEND_FILE_LINE_RELAY_CC);
+				if (t && pCopyConstructor) {
+					pCopyConstructor(t);
+				}
+			} else {
+				t = zend_hash_index_update(target, p->h, &p->val);
+				if (t && pCopyConstructor) {
+					pCopyConstructor(t);
+				}
+			}
+		}
+	} else {
+		for (idx = 0; idx < source->nNumUsed; idx++) {
+			p = source->arData + idx;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
+			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
+			    continue;
+			}
+			if (p->key) {
+				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_ADD | HASH_UPDATE_INDIRECT ZEND_FILE_LINE_RELAY_CC);
+				if (t && pCopyConstructor) {
+					pCopyConstructor(t);
+				}
+			} else {
+				t = zend_hash_index_add(target, p->h, &p->val);
+				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			}
@@ -385,6 +385,18 @@ static zend_always_inline int zend_symtable_exists(HashTable *ht, zend_string *k
 }


+static zend_always_inline int zend_symtable_exists_ind(HashTable *ht, zend_string *key)
+{
+	zend_ulong idx;
+
+	if (ZEND_HANDLE_NUMERIC(key, idx)) {
+		return zend_hash_index_exists(ht, idx);
+	} else {
+		return zend_hash_exists_ind(ht, key);
+	}
+}
+
+
 static zend_always_inline zval *zend_symtable_str_update(HashTable *ht, const char *str, size_t len, zval *pData)
 {
 	zend_ulong idx;
@@ -228,6 +228,9 @@ ZEND_API void zend_strip(void)
 		prev_space = 0;
 		ZVAL_UNDEF(&token);
 	}
+
+	/* Discard parse errors thrown during tokenization */
+	zend_clear_exception();
 }

 /*
@@ -319,6 +319,14 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 			return 0;
 		}

+#if 0
+		// This introduces BC break described at https://bugs.php.net/bug.php?id=72119
+		if (proto_arg_info->type_hint && proto_arg_info->allow_null && !fe_arg_info->allow_null) {
+			/* incompatible nullability */
+			return 0;
+		}
+#endif
+
 		/* by-ref constraints on arguments are invariant */
 		if (fe_arg_info->pass_by_reference != proto_arg_info->pass_by_reference) {
 			return 0;
@@ -483,6 +491,8 @@ static ZEND_COLD zend_string *zend_get_function_declaration(const zend_function
 				} else {
 					smart_str_appends(&str, "NULL");
 				}
+			} else if (arg_info->type_hint && arg_info->allow_null) {
+				smart_str_appends(&str, " = NULL");
 			}

 			if (++i < num_args) {
@@ -563,17 +573,31 @@ static void do_inheritance_check_on_method(zend_function *child, zend_function *
 	}

 	if (child->common.prototype && (
-		child->common.prototype->common.fn_flags & (ZEND_ACC_ABSTRACT | ZEND_ACC_HAS_RETURN_TYPE)
+		child->common.prototype->common.fn_flags & ZEND_ACC_ABSTRACT
 	)) {
-		if (UNEXPECTED(!zend_do_perform_implementation_check(child, child->common.prototype))) {
-			zend_string *method_prototype = zend_get_function_declaration(child->common.prototype);
-			zend_string *child_prototype = zend_get_function_declaration(child);
-			zend_error_noreturn(E_COMPILE_ERROR, "Declaration of %s must be compatible with %s", ZSTR_VAL(child_prototype), ZSTR_VAL(method_prototype));
-		}
-	} else if (UNEXPECTED(!zend_do_perform_implementation_check(child, parent))) {
+		parent = child->common.prototype;
+	}
+	if (UNEXPECTED(!zend_do_perform_implementation_check(child, parent))) {
+		int error_level;
+		const char *error_verb;
 		zend_string *method_prototype = zend_get_function_declaration(parent);
 		zend_string *child_prototype = zend_get_function_declaration(child);
-		zend_error(E_WARNING, "Declaration of %s should be compatible with %s", ZSTR_VAL(child_prototype), ZSTR_VAL(method_prototype));
+
+		if (child->common.prototype && (
+			child->common.prototype->common.fn_flags & ZEND_ACC_ABSTRACT
+		)) {
+			error_level = E_COMPILE_ERROR;
+			error_verb = "must";
+		} else if ((parent->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE) &&
+                   (!(child->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE) ||
+		            !zend_do_perform_type_hint_check(child, child->common.arg_info - 1, parent, parent->common.arg_info - 1))) {
+			error_level = E_COMPILE_ERROR;
+			error_verb = "must";
+		} else {
+			error_level = E_WARNING;
+			error_verb = "should";
+		}
+		zend_error(error_level, "Declaration of %s %s be compatible with %s", ZSTR_VAL(child_prototype), error_verb, ZSTR_VAL(method_prototype));
 		zend_string_free(child_prototype);
 		zend_string_free(method_prototype);
 	}
@@ -636,7 +660,8 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
 				int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
 				int child_num = OBJ_PROP_TO_NUM(child_info->offset);

-				zval_ptr_dtor(&(ce->default_properties_table[parent_num]));
+				/* Don't keep default properties in GC (thry may be freed by opcache) */
+				zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
 				ce->default_properties_table[parent_num] = ce->default_properties_table[child_num];
 				ZVAL_UNDEF(&ce->default_properties_table[child_num]);
 				child_info->offset = parent_info->offset;
@@ -272,7 +272,7 @@ reserved_non_modifiers:
 	| T_THROW | T_USE | T_INSTEADOF | T_GLOBAL | T_VAR | T_UNSET | T_ISSET | T_EMPTY | T_CONTINUE | T_GOTO
 	| T_FUNCTION | T_CONST | T_RETURN | T_PRINT | T_YIELD | T_LIST | T_SWITCH | T_ENDSWITCH | T_CASE | T_DEFAULT | T_BREAK
 	| T_ARRAY | T_CALLABLE | T_EXTENDS | T_IMPLEMENTS | T_NAMESPACE | T_TRAIT | T_INTERFACE | T_CLASS
-	| T_CLASS_C | T_TRAIT_C | T_FUNC_C | T_METHOD_C | T_LINE | T_FILE | T_DIR | T_NS_C | T_HALT_COMPILER
+	| T_CLASS_C | T_TRAIT_C | T_FUNC_C | T_METHOD_C | T_LINE | T_FILE | T_DIR | T_NS_C
 ;

 semi_reserved:
@@ -473,10 +473,10 @@ unset_variable:
 ;

 function_declaration_statement:
-	function returns_ref T_STRING '(' parameter_list ')' return_type
-	backup_doc_comment '{' inner_statement_list '}'
-		{ $$ = zend_ast_create_decl(ZEND_AST_FUNC_DECL, $2, $1, $8,
-		      zend_ast_get_str($3), $5, NULL, $10, $7); }
+	function returns_ref T_STRING backup_doc_comment '(' parameter_list ')' return_type
+	'{' inner_statement_list '}'
+		{ $$ = zend_ast_create_decl(ZEND_AST_FUNC_DECL, $2, $1, $4,
+		      zend_ast_get_str($3), $6, NULL, $10, $8); }
 ;

 is_reference:
@@ -705,10 +705,10 @@ class_statement:
 			{ $$ = $2; RESET_DOC_COMMENT(); }
 	|	T_USE name_list trait_adaptations
 			{ $$ = zend_ast_create(ZEND_AST_USE_TRAIT, $2, $3); }
-	|	method_modifiers function returns_ref identifier '(' parameter_list ')'
-		return_type backup_doc_comment method_body
-			{ $$ = zend_ast_create_decl(ZEND_AST_METHOD, $3 | $1, $2, $9,
-				  zend_ast_get_str($4), $6, NULL, $10, $8); }
+	|	method_modifiers function returns_ref identifier backup_doc_comment '(' parameter_list ')'
+		return_type method_body
+			{ $$ = zend_ast_create_decl(ZEND_AST_METHOD, $3 | $1, $2, $5,
+				  zend_ast_get_str($4), $7, NULL, $10, $9); }
 ;

 name_list:
@@ -959,16 +959,16 @@ expr_without_variable:
 	|	T_YIELD expr { $$ = zend_ast_create(ZEND_AST_YIELD, $2, NULL); }
 	|	T_YIELD expr T_DOUBLE_ARROW expr { $$ = zend_ast_create(ZEND_AST_YIELD, $4, $2); }
 	|	T_YIELD_FROM expr { $$ = zend_ast_create(ZEND_AST_YIELD_FROM, $2); }
-	|	function returns_ref '(' parameter_list ')' lexical_vars return_type
-		backup_doc_comment '{' inner_statement_list '}'
-			{ $$ = zend_ast_create_decl(ZEND_AST_CLOSURE, $2, $1, $8,
+	|	function returns_ref backup_doc_comment '(' parameter_list ')' lexical_vars return_type
+		'{' inner_statement_list '}'
+			{ $$ = zend_ast_create_decl(ZEND_AST_CLOSURE, $2, $1, $3,
 				  zend_string_init("{closure}", sizeof("{closure}") - 1, 0),
-			      $4, $6, $10, $7); }
-	|	T_STATIC function returns_ref '(' parameter_list ')' lexical_vars
-		return_type backup_doc_comment '{' inner_statement_list '}'
-			{ $$ = zend_ast_create_decl(ZEND_AST_CLOSURE, $3 | ZEND_ACC_STATIC, $2, $9,
+			      $5, $7, $10, $8); }
+	|	T_STATIC function returns_ref backup_doc_comment '(' parameter_list ')' lexical_vars
+		return_type '{' inner_statement_list '}'
+			{ $$ = zend_ast_create_decl(ZEND_AST_CLOSURE, $3 | ZEND_ACC_STATIC, $2, $4,
 			      zend_string_init("{closure}", sizeof("{closure}") - 1, 0),
-			      $5, $7, $11, $8); }
+			      $6, $8, $11, $9); }
 ;

 function:
@@ -63,7 +63,6 @@ typedef struct _zend_heredoc_label {
 } zend_heredoc_label;

 BEGIN_EXTERN_C()
-int zend_compare_file_handles(zend_file_handle *fh1, zend_file_handle *fh2);
 ZEND_API void zend_save_lexical_state(zend_lex_state *lex_state);
 ZEND_API void zend_restore_lexical_state(zend_lex_state *lex_state);
 ZEND_API int zend_prepare_string_for_scanning(zval *str, char *filename);
@@ -1152,6 +1152,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
 }

 <ST_IN_SCRIPTING>"yield"{WHITESPACE}"from" {
+	HANDLE_NEWLINES(yytext, yyleng);
 	RETURN_TOKEN(T_YIELD_FROM);
 }

@@ -552,6 +552,31 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 		goto exit;
 	}

+	/* magic isset */
+	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
+		zval tmp_object, tmp_result;
+		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+
+		if (!((*guard) & IN_ISSET)) {
+			ZVAL_COPY(&tmp_object, object);
+			ZVAL_UNDEF(&tmp_result);
+
+			*guard |= IN_ISSET;
+			zend_std_call_issetter(&tmp_object, member, &tmp_result);
+			*guard &= ~IN_ISSET;
+	
+			if (!zend_is_true(&tmp_result)) {
+				retval = &EG(uninitialized_zval);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_result);
+				goto exit;
+			}
+
+			zval_ptr_dtor(&tmp_object);
+			zval_ptr_dtor(&tmp_result);
+		}
+	}
+
 	/* magic get */
 	if (zobj->ce->__get) {
 		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
@@ -710,13 +735,26 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 	zval tmp;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
-		if(offset == NULL) {
+		if (offset == NULL) {
 			/* [] construct */
-			ZVAL_UNDEF(&tmp);
+			ZVAL_NULL(&tmp);
 			offset = &tmp;
 		} else {
 			SEPARATE_ARG_IF_REF(offset);
 		}
+
+		if (type == BP_VAR_IS) {
+			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
+			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
+				return NULL;
+			}
+			if (!i_zend_is_true(rv)) {
+				zval_ptr_dtor(rv);
+				return &EG(uninitialized_zval);
+			}
+			zval_ptr_dtor(rv);
+		}
+
 		zend_call_method_with_1_params(object, ce, NULL, "offsetget", rv, offset);

 		zval_ptr_dtor(offset);
@@ -1030,6 +1068,7 @@ ZEND_API int zend_check_protected(zend_class_entry *ce, zend_class_entry *scope)

 ZEND_API zend_function *zend_get_call_trampoline_func(zend_class_entry *ce, zend_string *method_name, int is_static) /* {{{ */
 {
+	size_t mname_len;
 	zend_op_array *func;
 	zend_function *fbc = is_static ? ce->__callstatic : ce->__call;

@@ -1062,8 +1101,8 @@ ZEND_API zend_function *zend_get_call_trampoline_func(zend_class_entry *ce, zend

 	//??? keep compatibility for "\0" characters
 	//??? see: Zend/tests/bug46238.phpt
-	if (UNEXPECTED(strlen(ZSTR_VAL(method_name)) != ZSTR_LEN(method_name))) {
-		func->function_name = zend_string_init(ZSTR_VAL(method_name), strlen(ZSTR_VAL(method_name)), 0);
+	if (UNEXPECTED((mname_len = strlen(ZSTR_VAL(method_name))) != ZSTR_LEN(method_name))) {
+		func->function_name = zend_string_init(ZSTR_VAL(method_name), mname_len, 0);
 	} else {
 		func->function_name = zend_string_copy(method_name);
 	}
@@ -44,12 +44,9 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
 ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 {
 	if (objects->top > 1) {
-		zend_object **obj_ptr = objects->object_buckets + 1;
-		zend_object **end = objects->object_buckets + objects->top;
-
-		do {
-			zend_object *obj = *obj_ptr;
-
+		uint32_t i;
+		for (i = 1; i < objects->top; i++) {
+			zend_object *obj = objects->object_buckets[i];
 			if (IS_OBJ_VALID(obj)) {
 				if (!(GC_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
 					GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED;
@@ -58,8 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 					GC_REFCOUNT(obj)--;
 				}
 			}
-			obj_ptr++;
-		} while (obj_ptr != end);
+		}
 	}
 }

@@ -597,7 +597,9 @@ try_again:
 					if (obj_ht) {
 						zval arr;

-						if (!Z_OBJCE_P(op)->default_properties_count && obj_ht == Z_OBJ_P(op)->properties) {
+						if (!Z_OBJCE_P(op)->default_properties_count &&
+							obj_ht == Z_OBJ_P(op)->properties &&
+							!ZEND_HASH_GET_APPLY_COUNT(Z_OBJ_P(op)->properties)) {
 							/* fast copy */
 							if (EXPECTED(Z_OBJ_P(op)->handlers == &std_object_handlers)) {
 								ZVAL_ARR(&arr, obj_ht);
@@ -2925,6 +2927,9 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 		if (i == needle_len) {
 			return p;
 		}
+		if (UNEXPECTED(p == end)) {
+			return NULL;
+		}
 		p += td[(unsigned char)(p[needle_len])];
 	}

@@ -4416,8 +4416,10 @@ ZEND_API double zend_hex_strtod(const char *str, const char **endptr)
 	int any = 0;
 	double value = 0;

-	if (strlen(str) < 2) {
-		*endptr = str;
+	if (s[0] == '\0' || s[1] == '\0') {
+		if (endptr != NULL) {
+			*endptr = str;
+		}
 		return 0.0;
 	}

@@ -4454,8 +4456,10 @@ ZEND_API double zend_oct_strtod(const char *str, const char **endptr)
 	double value = 0;
 	int any = 0;

-	if (strlen(str) < 1) {
-		*endptr = str;
+	if (str[0] == '\0') {
+		if (endptr != NULL) {
+			*endptr = str;
+		}
 		return 0.0;
 	}

@@ -4487,8 +4491,10 @@ ZEND_API double zend_bin_strtod(const char *str, const char **endptr)
 	double 		value = 0;
 	int 		any = 0;

-	if (strlen(str) < 2) {
-		*endptr = str;
+	if (str[0] == '\0' || str[1] == '\0') {
+		if (endptr != NULL) {
+			*endptr = str;
+		}
 		return 0.0;
 	}

@@ -597,12 +597,13 @@ static inline zend_ulong realpath_cache_key(const char *path, int path_len) /* {
 	register zend_ulong h;
 	char *bucket_key_start = tsrm_win32_get_path_sid_key(path);
 	char *bucket_key = (char *)bucket_key_start;
-	const char *e = bucket_key + strlen(bucket_key);
+	const char *e;

 	if (!bucket_key) {
 		return 0;
 	}

+	e = bucket_key + strlen(bucket_key);
 	for (h = Z_UL(2166136261); bucket_key < e;) {
 		h *= Z_UL(16777619);
 		h ^= *bucket_key++;
@@ -914,6 +915,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i

 			pbuffer = (REPARSE_DATA_BUFFER *)do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
 			if (pbuffer == NULL) {
+				CloseHandle(hLink);
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
@@ -744,13 +744,18 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMPVAR|
 		/* here we are sure we are dealing with an object */
 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_NULL(EX_VAR(opline->result.var));
+				}
+			} else {
+				ZVAL_DEREF(zptr);
+				SEPARATE_ZVAL_NOREF(zptr);

-			ZVAL_DEREF(zptr);
-			SEPARATE_ZVAL_NOREF(zptr);
-
-			binary_op(zptr, zptr, value);
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_COPY(EX_VAR(opline->result.var), zptr);
+				binary_op(zptr, zptr, value);
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_COPY(EX_VAR(opline->result.var), zptr);
+				}
 			}
 		} else {
 			zend_assign_op_overloaded_property(object, property, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), value, binary_op, (UNEXPECTED(RETURN_VALUE_USED(opline)) ? EX_VAR(opline->result.var) : NULL));
@@ -1150,28 +1155,32 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMPVAR|C
 		}

 		/* here we are sure we are dealing with an object */
-
 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
-
-			if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
-				if (inc) {
-					fast_long_increment_function(zptr);
-				} else {
-					fast_long_decrement_function(zptr);
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_NULL(EX_VAR(opline->result.var));
 				}
 			} else {
-				ZVAL_DEREF(zptr);
-				SEPARATE_ZVAL_NOREF(zptr);
-
-				if (inc) {
-					increment_function(zptr);
+				if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
+					if (inc) {
+						fast_long_increment_function(zptr);
+					} else {
+						fast_long_decrement_function(zptr);
+					}
 				} else {
-					decrement_function(zptr);
+					ZVAL_DEREF(zptr);
+					SEPARATE_ZVAL_NOREF(zptr);
+
+					if (inc) {
+						increment_function(zptr);
+					} else {
+						decrement_function(zptr);
+					}
+				}
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_COPY(EX_VAR(opline->result.var), zptr);
 				}
-			}
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_COPY(EX_VAR(opline->result.var), zptr);
 			}
 		} else {
 			zend_pre_incdec_overloaded_property(object, property, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), inc, (UNEXPECTED(RETURN_VALUE_USED(opline)) ? EX_VAR(opline->result.var) : NULL));
@@ -1232,22 +1241,25 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMPVAR|

 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
-
-			if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
-				ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
-				if (inc) {
-					fast_long_increment_function(zptr);
-				} else {
-					fast_long_decrement_function(zptr);
-				}
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				ZVAL_NULL(EX_VAR(opline->result.var));
 			} else {
-				ZVAL_DEREF(zptr);
-				ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
-				zval_opt_copy_ctor(zptr);
-				if (inc) {
-					increment_function(zptr);
+				if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
+					ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
+					if (inc) {
+						fast_long_increment_function(zptr);
+					} else {
+						fast_long_decrement_function(zptr);
+					}
 				} else {
-					decrement_function(zptr);
+					ZVAL_DEREF(zptr);
+					ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
+					zval_opt_copy_ctor(zptr);
+					if (inc) {
+						increment_function(zptr);
+					} else {
+						decrement_function(zptr);
+					}
 				}
 			}
 		} else {
@@ -2944,7 +2956,7 @@ ZEND_VM_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|CV, CONST|TMPVAR
 					}
 				}
 				if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(object) == IS_UNDEF)) {
-					GET_OP1_UNDEF_CV(object, BP_VAR_R);
+					object = GET_OP1_UNDEF_CV(object, BP_VAR_R);
 					if (UNEXPECTED(EG(exception) != NULL)) {
 						FREE_OP2();
 						HANDLE_EXCEPTION();
@@ -3053,15 +3065,22 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, CONST|VAR, CONST|TMPVAR|UNUSE
 		function_name = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
 		if (OP2_TYPE != IS_CONST) {
 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
-				if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(function_name) == IS_UNDEF)) {
-					GET_OP2_UNDEF_CV(function_name, BP_VAR_R);
-					if (UNEXPECTED(EG(exception) != NULL)) {
-						HANDLE_EXCEPTION();
+				do {
+					if (OP2_TYPE & (IS_VAR|IS_CV) && Z_ISREF_P(function_name)) {
+						function_name = Z_REFVAL_P(function_name);
+						if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
+							break;
+						}
+					} else if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(function_name) == IS_UNDEF)) {
+						GET_OP2_UNDEF_CV(function_name, BP_VAR_R);
+						if (UNEXPECTED(EG(exception) != NULL)) {
+							HANDLE_EXCEPTION();
+						}
 					}
-				}
-				zend_throw_error(NULL, "Function name must be a string");
-				FREE_OP2();
-				HANDLE_EXCEPTION();
+					zend_throw_error(NULL, "Function name must be a string");
+					FREE_OP2();
+					HANDLE_EXCEPTION();
+				} while (0);
 			}
 		}

@@ -4280,27 +4299,24 @@ ZEND_VM_HANDLER(106, ZEND_SEND_VAR_NO_REF, VAR, ANY)

 	varptr = GET_OP1_ZVAL_PTR(BP_VAR_R);

-	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
-	     (Z_VAR_FLAGS_P(varptr) & IS_VAR_RET_REF)) &&
-	    (Z_ISREF_P(varptr) || Z_TYPE_P(varptr) == IS_OBJECT)) {
+	if (EXPECTED(Z_ISREF_P(varptr) ||
+	    ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
+	     (opline->extended_value & ZEND_ARG_SEND_SILENT) :
+	     ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num
+	    )))) {
+		arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+		ZVAL_COPY_VALUE(arg, varptr);

-		ZVAL_MAKE_REF(varptr);
-	} else {
-		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
-			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
-			!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {
-			SAVE_OPLINE();
-			zend_error(E_NOTICE, "Only variables should be passed by reference");
-			arg = ZEND_CALL_VAR(EX(call), opline->result.var);
-			ZVAL_COPY_VALUE(arg, varptr);
-			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-		}
+		ZEND_VM_NEXT_OPCODE();
 	}

+	SAVE_OPLINE();
+	zend_error(E_NOTICE, "Only variables should be passed by reference");
+
 	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
 	ZVAL_COPY_VALUE(arg, varptr);

-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

 ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
@@ -4406,7 +4422,7 @@ ZEND_VM_C_LABEL(send_again):

 		zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, zend_hash_num_elements(ht));

-		if (OP1_TYPE != IS_CONST && OP1_TYPE != IS_TMP_VAR && Z_IMMUTABLE_P(args)) {
+		if ((OP1_TYPE & (IS_VAR|IS_CV)) && Z_REFCOUNT_P(args) > 1) {
 			uint32_t i;
 			int separate = 0;

@@ -4418,7 +4434,7 @@ ZEND_VM_C_LABEL(send_again):
 				}
 			}
 			if (separate) {
-				zval_copy_ctor(args);
+				SEPARATE_ARRAY(args);
 				ht = Z_ARRVAL_P(args);
 			}
 		}
@@ -4432,7 +4448,7 @@ ZEND_VM_C_LABEL(send_again):

 			top = ZEND_CALL_ARG(EX(call), arg_num);
 			if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
-				if (!Z_IMMUTABLE_P(args)) {
+				if (Z_REFCOUNT_P(args) == 1) {
 					ZVAL_MAKE_REF(arg);
 					Z_ADDREF_P(arg);
 					ZVAL_REF(top, Z_REF_P(arg));
@@ -4575,6 +4591,7 @@ ZEND_VM_HANDLER(119, ZEND_SEND_ARRAY, ANY, ANY)
 		EX(call)->func = (zend_function*)&zend_pass_function;
 		EX(call)->called_scope = NULL;
 		Z_OBJ(EX(call)->This) = NULL;
+		ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
 	} else {
 		uint32_t arg_num;
 		HashTable *ht;
@@ -4584,22 +4601,6 @@ ZEND_VM_C_LABEL(send_array):
 		ht = Z_ARRVAL_P(args);
 		zend_vm_stack_extend_call_frame(&EX(call), 0, zend_hash_num_elements(ht));

-		if (OP1_TYPE != IS_CONST && OP1_TYPE != IS_TMP_VAR && Z_IMMUTABLE_P(args)) {
-			int separate = 0;
-
-			/* check if any of arguments are going to be passed by reference */
-			for (arg_num = 0; arg_num < zend_hash_num_elements(ht); arg_num++) {
-				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num + 1)) {
-					separate = 1;
-					break;
-				}
-			}
-			if (separate) {
-				zval_copy_ctor(args);
-				ht = Z_ARRVAL_P(args);
-			}
-		}
-
 		arg_num = 1;
 		param = ZEND_CALL_ARG(EX(call), 1);
 		ZEND_HASH_FOREACH_VAL(ht, arg) {
@@ -4622,24 +4623,18 @@ ZEND_VM_C_LABEL(send_array):
 						EX(call)->func = (zend_function*)&zend_pass_function;
 						EX(call)->called_scope = NULL;
 						Z_OBJ(EX(call)->This) = NULL;
-
+						ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
 						break;
 					}
-
-					ZVAL_NEW_REF(arg, arg);
 				}
-				Z_ADDREF_P(arg);
-			} else{
+			} else {
 				if (Z_ISREF_P(arg) &&
 				    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
 					/* don't separate references for __call */
 					arg = Z_REFVAL_P(arg);
 				}
-				if (Z_OPT_REFCOUNTED_P(arg)) {
-					Z_ADDREF_P(arg);
-				}
 			}
-			ZVAL_COPY_VALUE(param, arg);
+			ZVAL_COPY(param, arg);
 			ZEND_CALL_NUM_ARGS(EX(call))++;
 			arg_num++;
 			param++;
@@ -4661,7 +4656,6 @@ ZEND_VM_HANDLER(120, ZEND_SEND_USER, VAR|CV, ANY)

 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {
 		if (UNEXPECTED(!Z_ISREF_P(arg))) {
-
 			if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {

 				zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
@@ -4680,25 +4674,20 @@ ZEND_VM_HANDLER(120, ZEND_SEND_USER, VAR|CV, ANY)
 				EX(call)->func = (zend_function*)&zend_pass_function;
 				EX(call)->called_scope = NULL;
 				Z_OBJ(EX(call)->This) = NULL;
+				ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);

 				FREE_OP1();
 				ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 			}
-
-			ZVAL_NEW_REF(arg, arg);
 		}
-		Z_ADDREF_P(arg);
 	} else {
 		if (Z_ISREF_P(arg) &&
 		    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
 			/* don't separate references for __call */
 			arg = Z_REFVAL_P(arg);
 		}
-		if (Z_OPT_REFCOUNTED_P(arg)) {
-			Z_ADDREF_P(arg);
-		}
 	}
-	ZVAL_COPY_VALUE(param, arg);
+	ZVAL_COPY(param, arg);

 	FREE_OP1();
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -4717,7 +4706,7 @@ ZEND_VM_HANDLER(63, ZEND_RECV, ANY, ANY)
 		zval *param = _get_zval_ptr_cv_undef_BP_VAR_W(execute_data, opline->result.var);

 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num)))) {
+		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num)) || EG(exception))) {
 			HANDLE_EXCEPTION();
 		}
 	}
@@ -4755,7 +4744,7 @@ ZEND_VM_HANDLER(64, ZEND_RECV_INIT, ANY, CONST)
 		zval *default_value = EX_CONSTANT(opline->op2);

 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, default_value, CACHE_ADDR(Z_CACHE_SLOT_P(default_value))))) {
+		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, default_value, CACHE_ADDR(Z_CACHE_SLOT_P(default_value))) || EG(exception))) {
 			HANDLE_EXCEPTION();
 		}
 	}
@@ -4884,6 +4873,14 @@ ZEND_VM_HANDLER(48, ZEND_CASE, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	SAVE_OPLINE();
 	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
 		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	} else if ((OP1_TYPE & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
+		/* Don't keep lock on reference, lock the value instead */
+		if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
+			ZVAL_UNREF(op1);
+		} else {
+			Z_DELREF_P(op1);
+			ZVAL_COPY(op1, Z_REFVAL_P(op1));
+		}
 	}
 	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(op2) == IS_UNDEF)) {
 		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
@@ -6751,9 +6748,10 @@ ZEND_VM_HANDLER(152, ZEND_JMP_SET, CONST|TMP|VAR|CV, ANY)
 		} else if (OP1_TYPE == IS_VAR && ref) {
 			zend_reference *r = Z_REF_P(ref);

-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 			if (UNEXPECTED(--GC_REFCOUNT(r) == 0)) {
 				efree_size(r, sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(value)) {
+				Z_ADDREF_P(value);
 			}
 		}
 		ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
@@ -6791,9 +6789,10 @@ ZEND_VM_HANDLER(169, ZEND_COALESCE, CONST|TMP|VAR|CV, ANY)
 		} else if (OP1_TYPE == IS_VAR && ref) {
 			zend_reference *r = Z_REF_P(ref);

-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 			if (UNEXPECTED(--GC_REFCOUNT(r) == 0)) {
 				efree_size(r, sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(value)) {
+				Z_ADDREF_P(value);
 			}
 		}
 		ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
@@ -6808,30 +6807,36 @@ ZEND_VM_HANDLER(22, ZEND_QM_ASSIGN, CONST|TMP|VAR|CV, ANY)
 	USE_OPLINE
 	zend_free_op free_op1;
 	zval *value;
+	zval *result = EX_VAR(opline->result.var);

 	value = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
 	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
 		SAVE_OPLINE();
 		GET_OP1_UNDEF_CV(value, BP_VAR_R);
-		ZVAL_NULL(EX_VAR(opline->result.var));
+		ZVAL_NULL(result);
 		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}

-	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && Z_ISREF_P(value)) {
-		ZVAL_COPY(EX_VAR(opline->result.var), Z_REFVAL_P(value));
-		if (OP1_TYPE == IS_VAR) {
+	if (OP1_TYPE == IS_CV) {
+		ZVAL_DEREF(value);
+		ZVAL_COPY(result, value);
+	} else if (OP1_TYPE == IS_VAR) {
+		if (UNEXPECTED(Z_ISREF_P(value))) {
+			ZVAL_COPY_VALUE(result, Z_REFVAL_P(value));
 			if (UNEXPECTED(Z_DELREF_P(value) == 0)) {
 				efree_size(Z_REF_P(value), sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(result)) {
+				Z_ADDREF_P(result);
 			}
+		} else {
+			ZVAL_COPY_VALUE(result, value);
 		}
 	} else {
-		ZVAL_COPY_VALUE(EX_VAR(opline->result.var), value);
+		ZVAL_COPY_VALUE(result, value);
 		if (OP1_TYPE == IS_CONST) {
 			if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
-				zval_copy_ctor_func(EX_VAR(opline->result.var));
+				zval_copy_ctor_func(result);
 			}
-		} else if (OP1_TYPE == IS_CV) {
-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 		}
 	}
 	ZEND_VM_NEXT_OPCODE();
@@ -7274,11 +7279,12 @@ ZEND_VM_HANDLER(156, ZEND_SEPARATE, VAR, UNUSED)
 	if (UNEXPECTED(Z_ISREF_P(var_ptr))) {
 		if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) {
 			ZVAL_UNREF(var_ptr);
+		} else if (!(Z_VAR_FLAGS_P(var_ptr) & IS_VAR_RET_REF)) {
+			Z_DELREF_P(var_ptr);
+			ZVAL_COPY(var_ptr, Z_REFVAL_P(var_ptr));
 		}
-	} else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) {
-		Z_DELREF_P(var_ptr);
-		ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr);
 	}
+
 	ZEND_VM_NEXT_OPCODE();
 }

@@ -7436,6 +7442,12 @@ ZEND_VM_HANDLER(142, ZEND_YIELD_FROM, CONST|TMP|VAR|CV, ANY)
 	SAVE_OPLINE();
 	val = GET_OP1_ZVAL_PTR_DEREF(BP_VAR_R);

+	if (UNEXPECTED(generator->flags & ZEND_GENERATOR_FORCED_CLOSE)) {
+		zend_throw_error(NULL, "Cannot use \"yield from\" in a force-closed generator");
+		FREE_OP1();
+		HANDLE_EXCEPTION();
+	}
+
 	if (Z_TYPE_P(val) == IS_ARRAY) {
 		ZVAL_COPY_VALUE(&generator->values, val);
 		if (OP1_TYPE != IS_TMP_VAR && Z_OPT_REFCOUNTED_P(val)) {