Merge branch 'PHP-5.6' into PHP-7.0

* PHP-5.6: Fixed arginfo (cherry picked from commit e4af29b0b7)
regenerate date parser with re2c 0.13.5
2026-11-13 12:10:50 +00:00 · 2016-07-20 14:17:28 +02:00 · 2016-07-20 14:10:20 +02:00 · 2016-07-20 14:10:06 +02:00 · 2016-07-20 14:09:52 +02:00 · 2016-07-19 20:33:23 +02:00
444 changed files with 13152 additions and 5612 deletions
@@ -5,7 +5,6 @@ Installing PHP

     * General Installation Considerations
     * Installation on Unix systems
-          + Apache 1.3.x on Unix systems
          + Apache 2.x on Unix systems
          + Lighttpd 1.4 on Unix systems
          + Sun, iPlanet and Netscape servers on Sun Solaris
@@ -103,7 +102,6 @@ Installation on Unix systems

 Table of Contents

-     * Apache 1.3.x on Unix systems
     * Apache 2.x on Unix systems
     * Lighttpd 1.4 on Unix systems
     * Sun, iPlanet and Netscape servers on Sun Solaris
@@ -163,208 +161,6 @@ Table of Contents
   you can't figure out why, see the Problems section.
     __________________________________________________________________

-Apache 1.3.x on Unix systems
-
-   This  section  contains  notes and hints specific to Apache installs of
-   PHP on Unix platforms. We also have instructions and notes for Apache 2
-   on a separate page.
-
-   You  can select arguments to add to the configure on line 10 below from
-   the  list of core configure options and from extension specific options
-   described  at  the respective places in the manual. The version numbers
-   have  been  omitted here, to ensure the instructions are not incorrect.
-   You  will  need  to replace the 'xxx' here with the correct values from
-   your files.
-
-   Example #1 Installation Instructions (Apache Shared Module Version) for
-   PHP
-1.  gunzip apache_xxx.tar.gz
-2.  tar -xvf apache_xxx.tar
-3.  gunzip php-xxx.tar.gz
-4.  tar -xvf php-xxx.tar
-5.  cd apache_xxx
-6.  ./configure --prefix=/www --enable-module=so
-7.  make
-8.  make install
-9.  cd ../php-xxx
-
-10. Now, configure your PHP.  This is where you customize your PHP
-    with various options, like which extensions will be enabled.  Do a
-    ./configure --help for a list of available options.  In our example
-    we'll do a simple configure with Apache 1 and MySQL support.  Your
-    path to apxs may differ from our example.
-
-      ./configure --with-mysql --with-apxs=/www/bin/apxs
-
-11. make
-12. make install
-
-    If you decide to change your configure options after installation,
-    you only need to repeat the last three steps. You only need to
-    restart apache for the new module to take effect. A recompile of
-    Apache is not needed.
-
-    Note that unless told otherwise, 'make install' will also install PEAR,
-    various PHP tools such as phpize, install the PHP CLI, and more.
-
-13. Setup your php.ini file:
-
-      cp php.ini-development /usr/local/lib/php.ini
-
-    You may edit your .ini file to set PHP options.  If you prefer your
-    php.ini in another location, use --with-config-file-path=/some/path in
-    step 10.
-
-    If you instead choose php.ini-production, be certain to read the list
-    of changes within, as they affect how PHP behaves.
-
-14. Edit your httpd.conf to load the PHP module.  The path on the right hand
-    side of the LoadModule statement must point to the path of the PHP
-    module on your system.  The make install from above may have already
-    added this for you, but be sure to check.
-
-      LoadModule php7_module libexec/libphp7.so
-
-15. And in the AddModule section of httpd.conf, somewhere under the
-    ClearModuleList, add this:
-
-      AddModule mod_php7.c
-
-16. Tell Apache to parse certain extensions as PHP.  For example,
-    let's have Apache parse the .php extension as PHP.  You could
-    have any extension(s) parse as PHP by simply adding more, with
-    each separated by a space.  We'll add .phtml to demonstrate.
-
-      AddType application/x-httpd-php .php .phtml
-
-    It's also common to setup the .phps extension to show highlighted PHP
-    source, this can be done with:
-
-      AddType application/x-httpd-php-source .phps
-
-17. Use your normal procedure for starting the Apache server. (You must
-    stop and restart the server, not just cause the server to reload by
-    using a HUP or USR1 signal.)
-
-   Alternatively, to install PHP as a static object:
-
-   Example  #2  Installation  Instructions (Static Module Installation for
-   Apache) for PHP
-1.  gunzip -c apache_1.3.x.tar.gz | tar xf -
-2.  cd apache_1.3.x
-3.  ./configure
-4.  cd ..
-
-5.  gunzip -c php-5.x.y.tar.gz | tar xf -
-6.  cd php-5.x.y
-7.  ./configure --with-mysql --with-apache=../apache_1.3.x
-8.  make
-9.  make install
-
-10. cd ../apache_1.3.x
-
-11. ./configure --prefix=/www --activate-module=src/modules/php7/libphp7.a
-    (The above line is correct! Yes, we know libphp7.a does not exist at this
-    stage. It isn't supposed to. It will be created.)
-
-12. make
-    (you should now have an httpd binary which you can copy to your Apache bin d
-ir if
-    it is your first install then you need to "make install" as well)
-
-13. cd ../php-5.x.y
-14. cp php.ini-development /usr/local/lib/php.ini
-
-15. You can edit /usr/local/lib/php.ini file to set PHP options.
-    Edit your httpd.conf or srm.conf file and add:
-    AddType application/x-httpd-php .php
-
-   Depending  on  your  Apache  install  and  Unix variant, there are many
-   possible  ways  to  stop and restart the server. Below are some typical
-   lines   used  in  restarting  the  server,  for  different  apache/unix
-   installations.  You  should  replace  /path/to/  with the path to these
-   applications on your systems.
-
-   Example #3 Example commands for restarting Apache
-1. Several Linux and SysV variants:
-/etc/rc.d/init.d/httpd restart
-
-2. Using apachectl scripts:
-/path/to/apachectl stop
-/path/to/apachectl start
-
-3. httpdctl and httpsdctl (Using OpenSSL), similar to apachectl:
-/path/to/httpsdctl stop
-/path/to/httpsdctl start
-
-4. Using mod_ssl, or another SSL server, you may want to manually
-stop and start:
-/path/to/apachectl stop
-/path/to/apachectl startssl
-
-   The  locations of the apachectl and http(s)dctl binaries often vary. If
-   your  system  has locate or whereis or which commands, these can assist
-   you in finding your server control programs.
-
-   Different examples of compiling PHP for apache are as follows:
-./configure --with-apxs --with-pgsql
-
-   This will create a libphp7.so shared library that is loaded into Apache
-   using  a  LoadModule  line  in Apache's httpd.conf file. The PostgreSQL
-   support is embedded into this library.
-
-./configure --with-apxs --with-pgsql=shared
-
-   This  will  create  a libphp7.so shared library for Apache, but it will
-   also create a pgsql.so shared library that is loaded into PHP either by
-   using  the  extension  directive  in  php.ini  file  or  by  loading it
-   explicitly in a script using the dl() function.
-
-./configure --with-apache=/path/to/apache_source --with-pgsql
-
-   This  will  create  a  libmodphp7.a  library,  a  mod_php7.c  and  some
-   accompanying files and copy this into the src/modules/php7 directory in
-   the    Apache    source   tree.   Then   you   compile   Apache   using
-   --activate-module=src/modules/php7/libphp7.a   and   the  Apache  build
-   system  will  create  libphp7.a  and  link it statically into the httpd
-   binary.  The  PostgreSQL  support  is included directly into this httpd
-   binary, so the final result here is a single httpd binary that includes
-   all of Apache and all of PHP.
-
-./configure --with-apache=/path/to/apache_source --with-pgsql=shared
-
-   Same as before, except instead of including PostgreSQL support directly
-   into  the  final  httpd you will get a pgsql.so shared library that you
-   can load into PHP from either the php.ini file or directly using dl().
-
-   When  choosing  to build PHP in different ways, you should consider the
-   advantages  and  drawbacks  of each method. Building as a shared object
-   will  mean  that  you  can compile apache separately, and don't have to
-   recompile  everything  as you add to, or change, PHP. Building PHP into
-   apache  (static  method)  means  that PHP will load and run faster. For
-   more information, see the Apache » web page on DSO support.
-
-     Note:
-
-     Apache's  default  httpd.conf  currently  ships  with a section that
-     looks like this:
-
-User nobody
-Group "#-1"
-
-     Unless  you  change  that  to "Group nogroup" or something like that
-     ("Group  daemon"  is  also very common) PHP will not be able to open
-     files.
-
-     Note:
-
-     Make  sure  you  specify  the  installed  version of apxs when using
-     --with-apxs=/path/to/apxs  .  You must NOT use the apxs version that
-     is  in  the apache sources but the one that is actually installed on
-     your system.
-     __________________________________________________________________
-     __________________________________________________________________
-
 Apache 2.x on Unix systems

   This  section  contains notes and hints specific to Apache 2.x installs
@@ -1,9 +1,400 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-17 Mar 2016 PHP 7.0.5RC1
+21 Jul 2016 PHP 7.0.9

- CLI Server:
-  . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
+- Core:
+  . Fixed bug #72508 (strange references after recursive function call and
+    "switch" statement). (Laruence)
+  . Fixed bug #72513 (Stack-based buffer overflow vulnerability in
+    virtual_file_ex). (Stas)
+  . Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries
+    and applications). (Stas)
+
+- bz2:
+  . Fixed bug #72613 (Inadequate error handling in bzread()). (Stas)
+
+- CLI:
+  . Fixed bug #72484 (SCRIPT_FILENAME shows wrong path if the user specify
+    router.php). (Laruence)
+
+- COM:
+  . Fixed bug #72498 (variant_date_from_timestamp null dereference). (Anatol)
+
+- Curl:
+  . Fixed bug #72541 (size_t overflow lead to heap corruption). (Stas)
+
+- Exif:
+  . Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
+    (Stas)
+  . Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
+    (Stas)
+
+- GD:
+  . Fixed bug #43475 (Thick styled lines have scrambled patterns). (cmb)
+  . Fixed bug #53640 (XBM images require width to be multiple of 8). (cmb)
+  . Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line). (cmb)
+  . Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read
+    access). (Pierre)
+  . Fixed bug #72519 (imagegif/output out-of-bounds access). (Pierre)
+  . Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
+    (Pierre)
+  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
+    overflow). (Pierre)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Pierre)
+
+- Intl:
+  . Fixed bug #72533 (locale_accept_from_http out-of-bounds access). (Stas)
+
+- Mbstring:
+  . Fixed bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) -
+    oob read access). (Laruence)
+  . Fixed bug #72399 (Use-After-Free in MBString (search_re)). (Laruence)
+
+- mcrypt:
+  . Fixed bug #72551, bug #72552 (In correct casting from size_t to int lead to
+    heap overflow in mdecrypt_generic). (Stas)
+
+- PDO_pgsql:
+  . Fixed bug #72570 (Segmentation fault when binding parameters on a query
+    without placeholders). (Matteo)
+
+- PCRE:
+  . Fixed bug #72476 (Memleak in jit_stack). (Laruence)
+  . Fixed bug #72463 (mail fails with invalid argument). (Anatol)
+
+- Readline:
+  . Fixed bug #72538 (readline_redisplay crashes php). (Laruence)
+
+- Standard:
+  . Fixed bug #72505 (readfile() mangles files larger than 2G). (Cschneid)
+  . Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
+    (Laruence)
+
+- Session:
+  . Fixed bug #72531 (ps_files_cleanup_dir Buffer overflow). (Laruence)
+  . Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session
+    Deserialization). (Stas)
+
+- SNMP:
+  . Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and
+    unserialize()). (Stas)
+
+- Streams:
+  . Fixed bug #72439 (Stream socket with remote address leads to a segmentation
+    fault). (Laruence)
+
+- XMLRPC:
+  . Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn
+    simplestring.c). (Stas)
+
+- Zip:
+  . Fixed bug #72520 (Stack-based buffer overflow vulnerability in
+    php_stream_zip_opener). (Stas)
+
+23 Jun 2016 PHP 7.0.8
+
+- Core:
+  . Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashes). 
+    (Esminis at esminis dot lt)
+  . Fixed bug #72221 (segfault, past-the-end access). (Lauri Kenttä)
+  . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas)
+  . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/
+    json_utf8_to_utf16()). (Stas)
+  . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas)
+  . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas)
+
+- Date:
+  . Fixed bug #63740 (strtotime seems to use both sunday and monday as start of
+    week). (Derick)
+
+- FPM:
+  . Fixed bug #72308 (fastcgi_finish_request and logging environment
+    variables). (Laruence)
+
+- GD:
+  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
+    (cmb)
+  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
+  . Fixed bug #72337 (invalid dimensions can lead to crash). (Pierre)
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap 
+    overflow). (CVE-2016-5766) (Pierre)
+  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
+  . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting
+    in heap overflow). (CVE-2016-5767) (Pierre)
+
+- Intl:
+  . Fixed bug #70484 (selectordinal doesn't work with named parameters).
+    (Anatol)
+
+- mbstring:
+   . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free).
+     (CVE-2016-5768) (Stas)
+
+- mcrypt:
+   . Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
+     (Stas)
+
+- OpenSSL:
+  . Fixed bug #72140 (segfault after calling ERR_free_strings()).
+    (Jakub Zelenka)
+
+- PCRE:
+  . Fixed bug #72143 (preg_replace uses int instead of size_t). (Joe)
+
+- PDO_pgsql:
+  . Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound).
+    (Laruence)
+  . Fixed bug #72294 (Segmentation fault/invalid pointer in connection
+    with pgsql_stmt_dtor). (Anatol)
+
+- Phar:
+  . Fixed bug #72321 (invalid free in phar_extract_file()).
+    (hji at dyntopia dot com)
+
+- Phpdbg:
+  . Fixed bug #72284 (phpdbg fatal errors with coverage). (Bob)
+
+- Postgres:
+  . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (Laruence)
+  . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol)
+
+- Standard:
+  . Fixed bug #72369 (array_merge() produces references in PHP7). (Dmitry)
+  . Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruence)
+  . Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
+    (Laruence)
+  . Fixed bug #72193 (dns_get_record returns array containing elements of
+    type 'unknown'). (Laruence)
+  . Fixed bug #72017 (range() with float step produces unexpected result).
+    (Thomas Punt)
+
+- WDDX:
+  . Fixed bug #72340 (Double Free Courruption in wddx_deserialize).
+    (CVE-2016-5772) (Stas)
+
+- XML:
+  . Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem). (Joe)
+
+- XMLRPC:
+  . Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type).
+    (Joe, Laruence)
+
+- Zip:
+  . Fixed ug #72258 (ZipArchive converts filenames to unrecoverable form).
+    (Anatol)
+  . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC
+    algorithm and unserialize). (CVE-2016-5773) (Dmitry)
+
+26 May 2016 PHP 7.0.7
+
+- Core:
+  . Fixed bug #72162 (use-after-free - error_reporting). (Laruence)
+  . Add compiler option to disable special case function calls. (Joe)
+  . Fixed bug #72101 (crash on complex code). (Dmitry)
+  . Fixed bug #72100 (implode() inserts garbage into resulting string when
+    joins very big integer). (Mikhail Galanin)
+  . Fixed bug #72057 (PHP Hangs when using custom error handler and typehint).
+    (Nikita Nefedov)
+  . Fixed bug #72038 (Function calls with values to a by-ref parameter don't
+    always throw a notice). (Bob)
+  . Fixed bug #71737 (Memory leak in closure with parameter named $this).
+    (Nikita)
+  . Fixed bug #72059 (?? is not allowed on constant expressions). (Bob, Marcio)
+  . Fixed bug #72159 (Imported Class Overrides Local Class Name). (Nikita)
+
+- Curl:
+  . Fixed bug #68658 (Define CURLE_SSL_CACERT_BADFILE). (Pierrick)
+
+- DBA:
+  . Fixed bug #72157 (use-after-free caused by dba_open). (Shm, Laruence)
+
+- GD:
+  . Fixed bug #72227 (imagescale out-of-bounds read). (Stas)
+
+- Intl:
+  . Fixed bug #64524 (Add intl.use_exceptions to php.ini-*). (Anatol)
+  . Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (Stas)
+
+- JSON:
+  . Fixed bug #72069 (Behavior \JsonSerializable different from json_encode).
+    (Laruence)
+
+- Mbstring:
+  . Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace). (Laruence)
+
+- OCI8:
+  . Fixed bug #71600 (oci_fetch_all segfaults when selecting more than eight
+    columns). (Tian Yang)
+
+- Opcache:
+  . Fixed bug #72014 (Including a file with anonymous classes multiple times
+    leads to fatal error). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #72165 (Null pointer dereference - openssl_csr_new). (Anatol)
+
+- PCNTL:
+  . Fixed bug #72154 (pcntl_wait/pcntl_waitpid array internal structure
+    overwrite). (Laruence)
+
+- POSIX:
+  . Fixed bug #72133 (php_posix_group_to_array crashes if gr_passwd is NULL).
+    (esminis at esminis dot lt)
+
+- Postgres:
+  . Fixed bug #72028 (pg_query_params(): NULL converts to empty string).
+    (Laruence)
+  . Fixed bug #71062 (pg_convert() doesn't accept ISO 8601 for datatype
+    timestamp). (denver at timothy dot io)
+  . Fixed bug #72151 (mysqli_fetch_object changed behaviour). (Anatol)
+
+- Reflection:
+  . Fixed bug #72174 (ReflectionProperty#getValue() causes __isset call).
+    (Nikita)
+
+- Session:
+  . Fixed bug #71972 (Cyclic references causing session_start(): Failed to
+    decode session object). (Laruence)
+
+- Sockets:
+  . Added socket_export_stream() function for getting a stream compatible
+    resource from a socket resource. (Chris Wright, Bob)
+
+- SPL:
+  . Fixed bug #72051 (The reference in CallbackFilterIterator doesn't work as
+    expected). (Laruence)
+
+- SQLite3:
+  . Fixed bug #68849 (bindValue is not using the right data type). (Anatol)
+
+- Standard:
+  . Fixed bug #72075 (Referencing socket resources breaks stream_select).
+    (Laruence)
+  . Fixed bug #72031 (array_column() against an array of objects discards all
+    values matching null). (Nikita)
+
+28 Apr 2016 PHP 7.0.6
+
+- Core:
+  . Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1'
+    failed). (Laruence)
+  . Fixed bug #71922 (Crash on assert(new class{})). (Nikita)
+  . Fixed bug #71914 (Reference is lost in "switch"). (Laruence)
+  . Fixed bug #71871 (Interfaces allow final and abstract functions). (Nikita)
+  . Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced
+    memory, crashing). (Laruence)
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+  . Fixed bug #71750 (Multiple Heap Overflows in php_raw_url_encode/
+    php_url_encode). (Stas)
+  . Fixed bug #71731 (Null coalescing operator and ArrayAccess). (Nikita)
+  . Fixed bug #71609 (Segmentation fault on ZTS with gethostbyname). (krakjoe)
+  . Fixed bug #71414 (Inheritance, traits and interfaces). (krakjoe)
+  . Fixed bug #71359 (Null coalescing operator and magic). (krakjoe)
+  . Fixed bug #71334 (Cannot access array keys while uksort()). (Nikita)
+  . Fixed bug #69659 (ArrayAccess, isset() and the offsetExists method).
+    (Nikita)
+  . Fixed bug #69537 (__debugInfo with empty string for key gives error).
+    (krakjoe)
+  . Fixed bug #62059 (ArrayObject and isset are not friends). (Nikita)
+  . Fixed bug #71980 (Decorated/Nested Generator is Uncloseable in Finally).
+    (Nikita)
+
+- BCmath:
+  . Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
+    _one_ definition). (Stas)
+
+- Curl:
+  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
+    (Michael Sierks)
+
+- Date:
+  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
+
+- EXIF:
+  . Fixed bug #72094 (Out of bounds heap read access in exif header processing). (Stas)
+
+- GD:
+  . Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074) (Stas)
+
+- Intl:
+  . Fixed bug #71516 (IntlDateFormatter looses locale if pattern is set via
+    constructor). (Anatol)
+  . Fixed bug #70455 (Missing constant: IntlChar::NO_NUMERIC_VALUE). (Anatol)
+  . Fixed bug #70451, #70452 (Inconsistencies in return values of IntlChar
+    methods). (Daniel Persson)
+  . Fixed bug #68893 (Stackoverflow in datefmt_create). (Anatol)
+  . Fixed bug #66289 (Locale::lookup incorrectly returns en or en_US if locale
+    is empty). (Anatol)
+  . Fixed bug #70484 (selectordinal doesn't work with named parameters).
+    (Anatol)
+  . Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative
+    offset). (Stas)
+
+- ODBC:
+  . Fixed bug #63171 (Script hangs after max_execution_time). (Remi)
+
+- Opcache:
+  . Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
+    (Laruence)
+
+- PDO:
+  . Fixed bug #52098 (Own PDOStatement implementation ignore __call()).
+    (Daniel kalaspuffar, Julien)
+  . Fixed bug #71447 (Quotes inside comments not properly handled). (Matteo)
+
+- PDO_DBlib:
+  . Fixed bug #71943 (dblib_handle_quoter needs to allocate an extra byte).
+    (Adam Baratz)
+  . Add DBLIB-specific attributes for controlling timeouts. (Adam Baratz)
+
+- PDO_pgsql:
+  . Fixed bug #62498 (pdo_pgsql inefficient when getColumnMeta() is used).
+    (Joseph Bylund)
+
+- Postgres:
+  . Fixed bug #71820 (pg_fetch_object binds parameters before call
+    constructor). (Anatol)
+  . Fixed bug #71998 (Function pg_insert does not insert when column
+    type = inet). (Anatol)
+
+- SOAP:
+  . Fixed bug #71986 (Nested foreach assign-by-reference creates broken
+    variables). (Laruence)
+
+- SPL:
+  . Fixed bug #71838 (Deserializing serialized SPLObjectStorage-Object can't
+    access properties in PHP). (Nikita)
+  . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
+  . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
+    offsetExists()). (Nikita)
+  . Fixed bug #52339 (SPL autoloader breaks class_exists()). (Nikita)
+
+- Standard:
+  . Fixed bug #71995 (Returning the same var twice from __sleep() produces
+    broken serialized data). (Laruence)
+  . Fixed bug #71940 (Unserialize crushes on restore object reference).
+    (Laruence)
+  . Fixed bug #71969 (str_replace returns an incorrect resulting array after
+    a foreach by reference). (Laruence)
+  . Fixed bug #71891 (header_register_callback() and
+    register_shutdown_function()). (Laruence)
+  . Fixed bug #71884 (Null pointer deref (segfault) in
+    stream_context_get_default). (Laruence)
+  . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
+  . Fixed bug #71837 (Wrong arrays behaviour). (Laruence)
+  . Fixed bug #71827 (substr_replace bug, string length). (krakjoe)
+  . Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or
+    _REENTRANT is not defined). (Nikita)
+  . Fixed bug #72116 (array_fill optimization breaks implementation). (Bob)
+
+- XML:
+  . Fixed bug #72099 (xml_parse_into_struct segmentation fault). (Stas)
+
+- Zip:
+  . Fixed bug #71923 (integer overflow in ZipArchive::getFrom*).
+    (CVE-2016-3078) (Stas)
+
+31 Mar 2016 PHP 7.0.5

 - Core:
  . Huge pages disabled by default. (Rasmus)
@@ -33,15 +424,26 @@ PHP                                                                        NEWS
  . Fixed bug #71624 (`php -R` (PHP_MODE_PROCESS_STDIN) is broken).
    (Sean DuBois)

+- CLI Server:
+  . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
+
 - Curl:
  . Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY). (mpyw)

 - Date:
  . Fixed bug #71635 (DatePeriod::getEndDate segfault). (Thomas Punt)

+- Fileinfo:
+  . Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic
+    file). (CVE-2015-8865) (Anatol)
+
 - libxml:
  . Fixed bug #71536 (Access Violation crashes php-cgi.exe). (Anatol)

+- mbstring:
+  . Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in
+    mbfl_strcut). (CVE-2016-4073) (Stas)
+
 - ODBC:
  . Fixed bug #47803, #69526 (Executing prepared statements is succesfull only
    for the first two statements). (einavitamar at gmail dot com, Anatol)
@@ -51,21 +453,26 @@ PHP                                                                        NEWS
    (nish dot aravamudan at canonical dot com)

 - PDO_DBlib:
-  . Bug #54648 (PDO::MSSQL forces format of datetime fields).
+  . Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
    (steven dot lambeth at gmx dot de, Anatol)

 - Phar:
-  . Fixed bug #71625 (Crash in php7.dll with bad phar filename).
-    (Anatol)
+  . Fixed bug #71625 (Crash in php7.dll with bad phar filename). (Anatol)
  . Fixed bug #71317 (PharData fails to open specific file). (Jos Elstgeest)
+  . Fixed bug #71860 (Invalid memory write in phar on filename with \0 in
+    name). (CVE-2016-4072) (Stas)

 - phpdbg:
  . Fixed crash when advancing (except step) inside an internal function. (Bob)

 - Session:
-  . Fixed Bug #71683 (Null pointer dereference in zend_hash_str_find_bucket).
+  . Fixed bug #71683 (Null pointer dereference in zend_hash_str_find_bucket).
    (Yasuo)

+- SNMP:
+  . Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
+    (CVE-2016-4071) (andrew at jmpesp dot org)
+
 - SPL:
  . Fixed bug #71617 (private properties lost when unserializing ArrayObject).
    (Nikita)
@@ -73,6 +480,8 @@ PHP                                                                        NEWS
 - Standard:
  . Fixed bug #71660 (array_column behaves incorrectly after foreach by
    reference). (Laruence)
+  . Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
+    (taoguangchen at icloud dot com, Stas)

 - Zip:
  . Update bundled libzip to 1.1.2. (Remi, Anatol)
@@ -96,7 +505,8 @@ PHP                                                                        NEWS
    using count). (Nikita)
  . Fixed bug #71601 (finally block not executed after yield from). (Bob)
  . Fixed bug #71637 (Multiple Heap Overflow due to integer overflows in 
-    xml/filter_url/addcslashes). (Stas)
+    xml/filter_url/addcslashes). (CVE-2016-4344, CVE-2016-4345, CVE-2016-4346)
+    (Stas)

 - CLI server:
  . Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug).
@@ -132,7 +542,7 @@ PHP                                                                        NEWS

 - SOAP:
  . Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
-    make_http_soap_request()). (Stas)
+    make_http_soap_request()). (CVE-2016-3185) (Stas)

 - Standard:
  . Fixed bug #71603 (compact() maintains references in php7). (Laruence)
@@ -194,13 +604,18 @@ PHP                                                                        NEWS
  . Fixed bug #71475 (openssl_seal() uninitialized memory usage). (Stas)

 - PCRE:
-  . Upgraded pcrelib to 8.38.
+  . Upgraded pcrelib to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387,
+    CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)

 - Phar:
-  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas)
+  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
+    (Stas)
+  . Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()).
+    (CVE-2016-4343) (Stas)
  . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
    (Stas)
-  . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas)
+  . Fixed bug #71488 (Stack overflow when decompressing tar archives).
+    (CVE-2016-2554) (Stas)

 - SOAP:
  . Fixed bug #70979 (crash with bad soap request). (Anatol)
@@ -276,7 +691,7 @@ PHP                                                                        NEWS

 - GD:
  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
-    Out of Bounds). (emmanuel dot law at gmail dot com)
+    Out of Bounds). (CVE-2016-1903) (emmanuel dot law at gmail dot com)

 - Mbstring:
  . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
@@ -304,7 +719,7 @@ PHP                                                                        NEWS

 - Standard:
  . Fixed bug #71270 (Heap BufferOver Flow in escapeshell functions).
-    (emmanuel dot law at gmail dot com)
+    (CVE-2016-1904) (emmanuel dot law at gmail dot com)

 - WDDX:
  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
@@ -722,7 +1137,8 @@ PHP                                                                        NEWS

 - GD:
  . Fixed bug #53156 (imagerectangle problem with point ordering). (cmb)
-  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (cmb)
+  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
+    (cmb)
  . Fixed bug #70102 (imagecreatefromwebm() shifts colors). (cmb)
  . Fixed bug #66590 (imagewebp() doesn't pad to even length). (cmb)
  . Fixed bug #66882 (imagerotate by -90 degrees truncates image by 1px). (cmb)
@@ -849,7 +1265,7 @@ PHP                                                                        NEWS
  . Implemented FR #70438 (Add IV parameter for openssl_seal and openssl_open)
    (Jakub Zelenka)
  . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically
-    secure). (Stas)
+    secure). (CVE-2015-8867) (Stas)
  . Fixed bug #69882 (OpenSSL error "key values mismatch" after
    openssl_pkcs12_read with extra cert). (Tomasz Sawicki)
  . Added "alpn_protocols" SSL context option allowing encrypted client/server
@@ -1097,7 +1513,8 @@ PHP                                                                        NEWS
    (Daniel Lowrey & Bob Weinand)

 - Zip:
-  . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors). (cmb)
+  . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors).
+    (CVE-2014-9767) (cmb)
  . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when
    creating directories). (neal at fb dot com)
  . Added ZipArchive::setCompressionName and ZipArchive::setCompressionIndex
@@ -0,0 +1,197 @@
+# =================================================================================
+#  http://www.gnu.org/software/autoconf-archive/ax_func_which_gethostbyname_r.html
+# =================================================================================
+#
+# SYNOPSIS
+#
+#   AX_FUNC_WHICH_GETHOSTBYNAME_R
+#
+# DESCRIPTION
+#
+#   Determines which historical variant of the gethostbyname_r() call
+#   (taking three, five, or six arguments) is available on the system and
+#   defines one of the following macros accordingly:
+#
+#     HAVE_FUNC_GETHOSTBYNAME_R_6
+#     HAVE_FUNC_GETHOSTBYNAME_R_5
+#     HAVE_FUNC_GETHOSTBYNAME_R_3
+#
+#   as well as
+#
+#     HAVE_GETHOSTBYNAME_R
+#
+#   If used in conjunction with gethostname.c, the API demonstrated in
+#   test.c can be used regardless of which gethostbyname_r() is available.
+#   These example files can be found at
+#   http://www.csn.ul.ie/~caolan/publink/gethostbyname_r
+#
+#   based on David Arnold's autoconf suggestion in the threads faq
+#
+#   Originally named "AC_caolan_FUNC_WHICH_GETHOSTBYNAME_R". Rewritten for
+#   Autoconf 2.5x, and updated for 2.68 by Daniel Richard G.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Caolan McNamara <caolan@skynet.ie>
+#   Copyright (c) 2008 Daniel Richard G. <skunk@iskunk.org>
+#
+#   This program is free software; you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation; either version 2 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 7
+
+AC_DEFUN([AX_FUNC_WHICH_GETHOSTBYNAME_R], [
+
+    AC_LANG_PUSH([C])
+    AC_MSG_CHECKING([how many arguments gethostbyname_r() takes])
+
+    AC_CACHE_VAL([ac_cv_func_which_gethostbyname_r], [
+
+################################################################
+
+ac_cv_func_which_gethostbyname_r=unknown
+
+#
+# ONE ARGUMENT (sanity check)
+#
+
+# This should fail, as there is no variant of gethostbyname_r() that takes
+# a single argument. If it actually compiles, then we can assume that
+# netdb.h is not declaring the function, and the compiler is thereby
+# assuming an implicit prototype. In which case, we're out of luck.
+#
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            (void)gethostbyname_r(name) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=no])
+
+#
+# SIX ARGUMENTS
+# (e.g. Linux)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret, *retp;
+            char buf@<:@1024@:>@;
+            int buflen = 1024;
+            int my_h_errno;
+            (void)gethostbyname_r(name, &ret, buf, buflen, &retp, &my_h_errno) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=six])
+
+fi
+
+#
+# FIVE ARGUMENTS
+# (e.g. Solaris)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret;
+            char buf@<:@1024@:>@;
+            int buflen = 1024;
+            int my_h_errno;
+            (void)gethostbyname_r(name, &ret, buf, buflen, &my_h_errno) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=five])
+
+fi
+
+#
+# THREE ARGUMENTS
+# (e.g. AIX, HP-UX, Tru64)
+#
+
+if test "$ac_cv_func_which_gethostbyname_r" = "unknown"; then
+
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+        [
+            char *name = "www.gnu.org";
+            struct hostent ret;
+            struct hostent_data data;
+            (void)gethostbyname_r(name, &ret, &data) /* ; */
+        ])],
+    [ac_cv_func_which_gethostbyname_r=three])
+
+fi
+
+################################################################
+
+]) dnl end AC_CACHE_VAL
+
+case "$ac_cv_func_which_gethostbyname_r" in
+    three|five|six)
+    AC_DEFINE([HAVE_GETHOSTBYNAME_R], [1],
+              [Define to 1 if you have some form of gethostbyname_r().])
+    ;;
+esac
+
+case "$ac_cv_func_which_gethostbyname_r" in
+    three)
+    AC_MSG_RESULT([three])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_3], [1],
+              [Define to 1 if you have the three-argument form of gethostbyname_r().])
+    ;;
+
+    five)
+    AC_MSG_RESULT([five])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_5], [1],
+              [Define to 1 if you have the five-argument form of gethostbyname_r().])
+    ;;
+
+    six)
+    AC_MSG_RESULT([six])
+    AC_DEFINE([HAVE_FUNC_GETHOSTBYNAME_R_6], [1],
+              [Define to 1 if you have the six-argument form of gethostbyname_r().])
+    ;;
+
+    no)
+    AC_MSG_RESULT([cannot find function declaration in netdb.h])
+    ;;
+
+    unknown)
+    AC_MSG_RESULT([can't tell])
+    ;;
+
+    *)
+    AC_MSG_ERROR([internal error])
+    ;;
+esac
+
+AC_LANG_POP
+
+]) dnl end AC_DEFUN
+
@@ -1,3 +1,4 @@
+m4_include([TSRM/m4/gethostbyname.m4])

 dnl TSRM_CHECK_GCC_ARG(ARG, ACTION-IF-FOUND, ACTION-IF-NOT_FOUND)	
 AC_DEFUN([TSRM_CHECK_GCC_ARG],[
@@ -32,6 +33,8 @@ AC_CHECK_HEADERS(stdarg.h)

 AC_CHECK_FUNCS(sigprocmask)

+AX_FUNC_WHICH_GETHOSTBYNAME_R()
+
 ])


@@ -89,7 +92,6 @@ else
 fi
 ])

-
 AC_DEFUN([TSRM_THREADS_CHECKS],[

 dnl For the thread implementations, we always use --with-*
@@ -641,6 +641,10 @@ Other
 - debug_zval_dump
  It prints now "int" instead of "long", and "float" instead of "double".

+- getenv()
+  Since 7.0.9, getenv() has optional second parameter, making it only
+  consider local environment and not SAPI environment if true.
+
 ========================================
 6. New Functions
 ========================================
@@ -756,6 +760,14 @@ out, that the corresponding SDK isn't available anymore.
      - 'gd PS font'
      - 'gd PS encoding'

+- Zip
+  . Filename encoding flags, as of 7.0.8
+    - ZipArchive::FL_ENC_GUESS
+    - ZipArchive::FL_ENC_RAW
+    - ZipArchive::FL_ENC_STRICT
+    - ZipArchive::FL_ENC_UTF_8
+    - ZipArchive::FL_ENC_CP437
+
 ========================================
 11. Changes to INI File Handling
 ========================================
@@ -0,0 +1,43 @@
+--TEST--
+Using indirect append on ArrayAccess object
+--FILE--
+<?php
+
+class AA implements ArrayAccess {
+    private $data = [];
+    public function &offsetGet($name) {
+        if (null === $name) {
+            return $this->data[];
+        } else {
+            return $this->data[$name];
+        }
+    }
+    public function offsetSet($name, $value) {
+        $this->data[$name] = $value;
+    }
+    public function offsetUnset($name) {}
+    public function offsetExists($name) {}
+}
+
+$aa = new AA;
+$aa[3] = 1;
+$aa[][][0] = 2;
+var_dump($aa);
+
+?>
+--EXPECT--
+object(AA)#1 (1) {
+  ["data":"AA":private]=>
+  array(2) {
+    [3]=>
+    int(1)
+    [4]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        int(2)
+      }
+    }
+  }
+}
@@ -0,0 +1,36 @@
+--TEST--
+Array must be separated if unpacking by reference
+--FILE--
+<?php
+
+function inc(&... $args) {
+    foreach ($args as &$arg) {
+        $arg++;
+    }
+}
+
+$arr = [1, 2];
+$arr[] = 3;
+$arr2 = $arr;
+inc(...$arr);
+var_dump($arr);
+var_dump($arr2);
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(2)
+  [1]=>
+  int(3)
+  [2]=>
+  int(4)
+}
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
@@ -0,0 +1,11 @@
+--TEST--
+Serialization of backtick literal is incorrect
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+
+assert_options(ASSERT_WARNING);
+assert(false && `echo -n ""`);
+--EXPECTF--
+Warning: assert(): assert(false && `echo -n ""`) failed in %s%east_serialize_backtick_literal.php on line %d
@@ -8,7 +8,8 @@ class Thing {}
 function boom()
 {
    $reader = xml_parser_create();
-    xml_set_object($reader, new Thing());
+    $thing = new Thing();
+    xml_set_object($reader, $thing);
    die("ok\n");
    xml_parser_free($reader);
 }
@@ -10,5 +10,4 @@ class foo {
 $obj = new foo("Hello world");
 ?>
 --EXPECTF--
-Fatal error: Cannot re-assign $this in %sbug41117_1.php on line 3
-
+Fatal error: Cannot use $this as parameter in %s on line %d
@@ -23,4 +23,4 @@ class B extends A {
 }
 ?>
 --EXPECTF--
-Warning: Declaration of B::foo($var) should be compatible with A::foo() in %sbug62358.php on line %d
+Fatal error: Declaration of B::foo($var) must be compatible with I::foo() in %sbug62358.php on line 17
@@ -18,4 +18,4 @@ $test = new Foo();
 var_dump($test instanceof Baz);
 ?>
 --EXPECTF--
-Fatal error: Access level to Bar::bad() must be public (as in class Baz) in %sbug69467.php on line %d
+Fatal error: Access level to Foo::bad() must be public (as in class Baz) in %sbug69467.php on line %d
@@ -0,0 +1,19 @@
+--TEST--
+Bug #69537 (__debugInfo with empty string for key gives error)
+--FILE--
+<?php
+class Foo {
+
+    public function __debugInfo(){
+        return ['' => 1];
+    }
+}
+
+var_dump(new Foo);
+?>
+--EXPECTF--
+object(Foo)#%d (%d) {
+  [""]=>
+  int(1)
+}
+
@@ -27,8 +27,6 @@ $c10 = new C10;
 var_dump($c10[] += 5);
 --EXPECTF--
 Inside C10::offsetGet
-
-Notice: Undefined variable: offset in %sbug69955.php on line 10
 NULL

 Inside C10::offsetSet
@@ -0,0 +1,61 @@
+--TEST--
+Bug #71359: Null coalescing operator and magic
+--FILE--
+<?php
+class AA {
+    private $data = [];
+    public function __isset($name) {
+        echo "__isset($name)\n";
+        return array_key_exists($name, $this->data);
+    }
+    public function &__get($name) {
+        echo "__get($name)\n";
+        if (!array_key_exists($name, $this->data)) {
+            throw new Exception('Unknown offset');
+        }
+        return $this->data[$name];
+    }
+    public function __set($name, $value) {
+        echo "__set($name)\n";
+        $this->data[$name] = $value;
+    }
+    public function __unset($name) {
+        echo "__unset($name)\n";
+        unset($this->data[$name]);
+    }
+}
+
+$aa = new AA;
+var_dump(isset($aa->zero->one->two));
+var_dump(isset($aa->zero->foo));
+var_dump($aa->zero ?? 42);
+var_dump($aa->zero->one->two ?? 42);
+$aa->zero = new AA;
+$aa->zero->one = new AA;
+var_dump(isset($aa->zero->one->two));
+var_dump($aa->zero->one->two ?? 42);
+?>
+--EXPECT--
+__isset(zero)
+bool(false)
+__isset(zero)
+bool(false)
+__isset(zero)
+int(42)
+__isset(zero)
+int(42)
+__set(zero)
+__get(zero)
+__set(one)
+__isset(zero)
+__get(zero)
+__isset(one)
+__get(one)
+__isset(two)
+bool(false)
+__isset(zero)
+__get(zero)
+__isset(one)
+__get(one)
+__isset(two)
+int(42)
@@ -0,0 +1,25 @@
+--TEST--
+Bug #71414 (Interface method override inherited method and implemented in a trait causes fatal error)
+--FILE--
+<?php
+interface InterfaceY {
+    public function z(): string;
+}
+
+trait TraitY {
+    public function z(): string {
+    }
+}
+
+class X {
+    public function z() {
+    }
+}
+
+class Y extends X implements InterfaceY {
+    use TraitY;
+}
+
+echo "ok";
+--EXPECT--
+ok
@@ -0,0 +1,15 @@
+--TEST--
+bug #71428.1: inheritance with null default values
+--XFAIL--
+This is a BC break
+--FILE--
+<?php
+class A {
+    public function m(array $a = null) {}
+}
+class B extends A {
+    public function m(array $a = []) {}
+}
+--EXPECTF--
+Warning: Declaration of B::m(array $a = Array) should be compatible with A::m(array $a = NULL) in %sbug71428.1.php on line 7
+
@@ -0,0 +1,23 @@
+--TEST--
+bug #71428.2: inheritance of ye olde dynamic interfaces
+--SKIPIF--
+<?php if (!extension_loaded('pdo')) die("skip PDO is not available"); ?>
+--FILE--
+<?php
+interface StatementInterface {
+	public function fetch($first = null, $second, $third);
+}
+
+class Statement extends PDOStatement implements StatementInterface {}
+
+interface StatementInterface1 {
+	public function fetch($first = null, $second = null, $third = null);
+}
+
+class Statement1 extends PDOStatement implements StatementInterface1 {}
+
+echo "ok";
+?>
+--EXPECT--
+ok
+
@@ -0,0 +1,13 @@
+--TEST--
+bug #71428: Validation type inheritance with = NULL
+--XFAIL--
+This is a BC break
+--FILE--
+<?php
+class A { }
+class B           {  public function m(A $a = NULL, $n) { echo "B.m";} };
+class C extends B {  public function m(A $a       , $n) { echo "C.m";} };
+?>
+--EXPECTF--
+Warning: Declaration of C::m(A $a, $n) should be compatible with B::m(A $a = NULL, $n) in %sbug71428.3.php on line 4
+
@@ -0,0 +1,64 @@
+--TEST--
+Bug #71731: Null coalescing operator and ArrayAccess
+--FILE--
+<?php
+
+class AA implements ArrayAccess {
+    private $data = [];
+    public function offsetExists($name) {
+        echo "offsetExists($name)\n";
+        return array_key_exists($name, $this->data);
+    }
+    public function &offsetGet($name) {
+        echo "offsetGet($name)\n";
+        if (!array_key_exists($name, $this->data)) {
+            throw new Exception('Unknown offset');
+        }
+        return $this->data[$name];
+    }
+    public function offsetSet($name, $value) {
+        echo "offsetSet($name)\n";
+        $this->data[$name] = $value;
+    }
+    public function offsetUnset($name) {
+        echo "offsetUnset($name)\n";
+        unset($this->data[$name]);
+    }
+}
+
+$aa = new AA;
+var_dump(isset($aa[0][1][2]));
+var_dump(isset($aa[0]->foo));
+var_dump($aa[0] ?? 42);
+var_dump($aa[0][1][2] ?? 42);
+
+$aa[0] = new AA;
+$aa[0][1] = new AA;
+var_dump(isset($aa[0][1][2]));
+var_dump($aa[0][1][2] ?? 42);
+
+?>
+--EXPECT--
+offsetExists(0)
+bool(false)
+offsetExists(0)
+bool(false)
+offsetExists(0)
+int(42)
+offsetExists(0)
+int(42)
+offsetSet(0)
+offsetGet(0)
+offsetSet(1)
+offsetExists(0)
+offsetGet(0)
+offsetExists(1)
+offsetGet(1)
+offsetExists(2)
+bool(false)
+offsetExists(0)
+offsetGet(0)
+offsetExists(1)
+offsetGet(1)
+offsetExists(2)
+int(42)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #71737: Memory leak in closure with parameter named $this
+--FILE--
+<?php
+
+class Test {
+    public function method() {
+        return function($this) {};
+    }
+}
+
+(new Test)->method()(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Cannot use $this as parameter in %s on line %d
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL
@@ -0,0 +1,28 @@
+--TEST--
+Bug #71859 (zend_objects_store_call_destructors operates on realloced memory, crashing)
+--FILE--
+<?php
+class constructs_in_destructor {
+  public function __destruct() {
+    //We are now in zend_objects_store_call_destructors
+    //This causes a realloc in zend_objects_store_put
+    for ($i = 0; $i < 10000; ++$i) {
+      $GLOBALS["a$i"] = new stdClass;
+    }
+    //Returns to zend_objects_store_call_destructors, to access freed memory.
+  }
+}
+
+$a = new constructs_in_destructor;
+//Create cycle so destructors are ran only in zend_objects_store_call_destructors
+$a->a = $a;
+
+// Create some objects so zend_objects_store_call_destructors has something
+// to do after constructs_in_destructor is destroyed.
+for ($i = 0; $i < 200; ++$i) {
+  $GLOBALS["b$i"] = new stdClass;
+}
+?>
+okey
+--EXPECT--
+okey
@@ -0,0 +1,12 @@
+--TEST--
+Bug #71871: Interfaces allow final and abstract functions
+--FILE--
+<?php
+
+interface test {
+    final function test();
+}
+
+?>
+--EXPECTF--
+Fatal error: Access type for interface method test::test() must be omitted in %s on line %d
@@ -0,0 +1,12 @@
+--TEST--
+Bug #71871: Interfaces allow final and abstract functions
+--FILE--
+<?php
+
+interface test {
+    abstract function test();
+}
+
+?>
+--EXPECTF--
+Fatal error: Access type for interface method test::test() must be omitted in %s on line %d
@@ -0,0 +1,40 @@
+--TEST--
+Bug #71914 (Reference is lost in "switch")
+--FILE--
+<?php
+
+function bug(&$value) {
+	switch ($value) {
+	case "xxxx":
+		$value = true;
+		break;
+	}
+}
+
+function returnArray() {
+	$array = array();
+	$array["str"]  = "xxxx";
+	return $array;
+}
+
+class Foo {
+	public $array = array("str" => "xxxx");
+}
+
+function test($arr, &$dummy) {
+	bug($arr["str"]);
+	var_dump($arr["str"]);
+}
+
+$foo = new Foo();
+$arr = returnArray();
+
+$array = array("str" => "xxxx");
+test($array, $array["str"]);
+test($arr, $arr["str"]);
+test($foo->array, $foo->array["str"]);
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71922: Crash on assert(new class{});
+--INI--
+zend.assertions=1
+assert.exception=1
+--FILE--
+<?php
+
+try {
+    assert(0 && new class {
+    } && new class(42) extends stdclass {
+    });
+} catch (AssertionError $e) {
+    echo "Assertion failure: ", $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Assertion failure: assert(0 && new class {
+} && new class(42) extends stdclass {
+})
@@ -0,0 +1,30 @@
+--TEST--
+Bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+  die("skip Require a resource which is able to hold a callbck");
+}
+?>
+--FILE--
+<?php
+
+class A {
+	public static function dummy() {
+	}
+}
+
+$a = array();
+$a[] = "A";
+$a[] = "dummy";
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_HEADERFUNCTION, $a);
+
+set_error_handler($a);
+set_error_handler(function()use($ch1){});
+set_error_handler(function(){});
+?>
+okey
+--EXPECT--
+okey
@@ -0,0 +1,43 @@
+--TEST--
+Bug #71980: Decorated/Nested Generator is Uncloseable in Finally
+--FILE--
+<?php
+
+class Dtor {
+    public function __destruct() {
+        echo "Dtor\n";
+    }
+}
+
+function gen1() {
+    try {
+        foreach ([42, new Dtor] as $value) {
+            yield $value;
+        }
+    } finally {
+        echo "Finally\n";
+    }
+}
+
+function gen2() {
+    try {
+        var_dump(new Dtor, yield);
+    } finally {
+        echo "Finally\n";
+    }
+}
+
+$gen = gen1();
+$gen->rewind();
+unset($gen);
+
+$gen = gen2();
+$gen->rewind();
+unset($gen);
+
+?>
+--EXPECT--
+Dtor
+Finally
+Dtor
+Finally
@@ -0,0 +1,27 @@
+--TEST--
+Bug #72038 (Function calls with values to a by-ref parameter don't always throw a notice)
+--FILE--
+<?php
+
+test($foo = new stdClass);
+var_dump($foo);
+test($bar = 2);
+var_dump($bar);
+test($baz = &$bar);
+var_dump($baz);
+
+function test(&$param) {
+        $param = 1;
+}
+
+?>
+--EXPECTF--
+
+Notice: Only variables should be passed by reference in %s on line %d
+object(stdClass)#1 (0) {
+}
+
+Notice: Only variables should be passed by reference in %s on line %d
+int(2)
+int(1)
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #72057 (PHP hangs when user error handler throws exception after Notice from type coercion)
+--FILE--
+<?php
+
+set_error_handler(
+    function() {
+        throw new Exception("My custom error");
+    }
+);
+
+(function (int $i) { bar(); })("7as");
+
+--EXPECTF--
+
+Fatal error: Uncaught Exception: My custom error in %s:%d
+Stack trace:
+#0 %s(%d): {closure}(8, 'A non well form...', '%s', %d, Array)
+#1 %s(%d): {closure}('7as')
+#2 {main}
+  thrown in %s on line %d
@@ -0,0 +1,85 @@
+--TEST--
+Bug #72101 (crash on complex code)
+--FILE--
+<?php
+class PHPUnit_Framework_MockObject_Stub_ReturnCallback {
+    protected $callback;
+    public function __construct($callback) {
+        $this->callback = $callback;
+    }
+    public function invoke($invocation) {
+        return call_user_func_array($this->callback, $invocation->parameters);
+    }
+}
+
+class PHPUnit_Framework_MockObject_InvocationMocker {
+    protected $matchers = [];
+    public function addMatcher( $matcher) {
+        $this->matchers[] = $matcher;
+    }
+    public function invoke( $invocation) {
+        foreach ($this->matchers as $match) {
+            $match->invoked($invocation);
+        }
+    }
+}
+
+class PHPUnit_Framework_MockObject_Matcher {
+    public $stub = null;
+    public function invoked($invocation) {
+        return $this->stub->invoke($invocation);
+    }
+}
+
+class MethodCallbackByReference {
+    public function bar(&$a, &$b, $c) {
+        Legacy::bar($a, $b, $c);
+    }
+    public function callback(&$a, &$b, $c) {
+        $b = 1;
+    }
+}
+class PHPUnit_Framework_MockObject_Invocation_Static {
+    public $parameters;
+    public function __construct(array $parameters) {
+        $this->parameters = $parameters;
+    }
+}
+
+class Mock_MethodCallbackByReference_7b180d26 extends MethodCallbackByReference {
+    public $inv_mocker;
+    public function bar(&$a, &$b, $c) {
+        $arguments = array($a, $b, $c);
+        $result = $this->inv_mocker->invoke(
+            new PHPUnit_Framework_MockObject_Invocation_Static(
+                $arguments
+            )
+        );
+        return $result;
+    }
+}
+
+set_error_handler(function() {
+//    var_dump(func_get_args());
+    DoesNotExists::$nope = true;
+}, E_ALL | E_STRICT);
+
+$foo = new Mock_MethodCallbackByReference_7b180d26();
+$InvMocker = new PHPUnit_Framework_MockObject_InvocationMocker();
+$foo->inv_mocker = $InvMocker;
+$OuterMatcher = new PHPUnit_Framework_MockObject_Matcher();
+$InvMocker->addMatcher($OuterMatcher);
+$OuterMatcher->methodNameMatcher = null;
+$OuterMatcher->stub = new PHPUnit_Framework_MockObject_Stub_ReturnCallback([$foo, 'callback']);
+$a = $b = $c = 0;
+$foo->bar($a, $b, $c);
+--EXPECTF--
+Fatal error: Uncaught Error: Class 'DoesNotExists' not found in %sbug72101.php:61
+Stack trace:
+#0 %sbug72101.php(8): {closure}(2, 'Parameter 1 to ...', '%s', 8, Array)
+#1 %sbug72101.php(27): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#2 %sbug72101.php(19): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(51): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#4 %sbug72101.php(72): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
+#5 {main}
+  thrown in %sbug72101.php on line 61
@@ -0,0 +1,18 @@
+--TEST--
+Bug #72119 (Interface declaration compatibility regression with default values)
+--FILE--
+<?php
+interface Foo {
+    public function bar(array $baz = null);
+}
+
+class Hello implements Foo {
+    public function bar(array $baz = [])
+    {
+
+    }
+}
+echo "OK\n";
+?>
+--EXPECT--
+OK
@@ -0,0 +1,10 @@
+--TEST--
+Bug #72162 (use-after-free - error_reporting)
+--FILE--
+<?php
+error_reporting(E_ALL);
+$var11 = new StdClass();
+$var16 = error_reporting($var11);
+?>
+--EXPECTF--
+Catchable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d
@@ -0,0 +1,28 @@
+--TEST--
+Bug #72508 (strange references after recursive function call and "switch" statement)
+--FILE--
+<?php
+function a ($option) {
+	b($option['bla']);
+	c($option);
+	var_dump($option);
+}
+function b (&$string) {
+	$string = 'changed';
+}
+function c ($option) {
+	switch ($option['bla']) {
+	default:
+		$copy = $option;
+		$copy['bla'] = 'copy';
+		break;
+	}
+}
+a(array('bla' => 'fasel'));
+
+?>
+--EXPECT--
+array(1) {
+  ["bla"]=>
+  string(7) "changed"
+}
@@ -0,0 +1,28 @@
+--TEST--
+call_user_func() should error on reference arguments
+--FILE--
+<?php
+
+namespace Foo;
+
+function bar(&$ref) {
+    $ref = 24;
+}
+
+$x = 42;
+$ref =& $x;
+\call_user_func('Foo\bar', $x);
+var_dump($x);
+
+$y = 42;
+$ref =& $y;
+call_user_func('Foo\bar', $y);
+var_dump($y);
+
+?>
+--EXPECTF--
+Warning: Parameter 1 to Foo\bar() expected to be a reference, value given in %s on line %d
+int(42)
+
+Warning: Parameter 1 to Foo\bar() expected to be a reference, value given in %s on line %d
+int(42)
@@ -0,0 +1,18 @@
+--TEST--
+call_user_func() should not use FUNC_ARG fetches
+--FILE--
+<?php
+
+function foo(&$ref) { $ref = 24; }
+
+$a = [];
+call_user_func('foo', $a[0][0]);
+var_dump($a);
+
+?>
+--EXPECTF--
+Notice: Undefined offset: 0 in %s on line %d
+
+Warning: Parameter 1 to foo() expected to be a reference, value given in %s on line %d
+array(0) {
+}
@@ -0,0 +1,73 @@
+--TEST--
+call_user_func_array() passes value to prefer-ref arg if element wasn't a reference
+--FILE--
+<?php
+
+namespace {
+    call_user_func_array('array_multisort', [[3, 2, 1]]);
+
+    $args = [[3, 2, 1]];
+    call_user_func_array('array_multisort', $args);
+    var_dump($args);
+    unset($args);
+
+    $array = [3, 2, 1];
+    call_user_func('array_multisort', $array);
+    var_dump($array);
+    unset($array);
+}
+
+namespace Foo {
+    call_user_func_array('array_multisort', [[3, 2, 1]]);
+
+    $args = [[3, 2, 1]];
+    call_user_func_array('array_multisort', $args);
+    var_dump($args);
+    unset($args);
+
+    $array = [3, 2, 1];
+    call_user_func('array_multisort', $array);
+    var_dump($array);
+    unset($array);
+}
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(3) {
+    [0]=>
+    int(3)
+    [1]=>
+    int(2)
+    [2]=>
+    int(1)
+  }
+}
+array(3) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(2)
+  [2]=>
+  int(1)
+}
+array(1) {
+  [0]=>
+  array(3) {
+    [0]=>
+    int(3)
+    [1]=>
+    int(2)
+    [2]=>
+    int(1)
+  }
+}
+array(3) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(2)
+  [2]=>
+  int(1)
+}
@@ -0,0 +1,16 @@
+--TEST--
+Closure::__invoke() is case insensitive
+--FILE--
+<?php
+
+$inc = function(&$n) {
+    $n++;
+};
+
+$n = 1;
+$inc->__INVOKE($n);
+var_dump($n);
+
+?>
+--EXPECT--
+int(2)
@@ -0,0 +1,47 @@
+--TEST--
+Constant expressions with null coalescing operator ??
+--FILE--
+<?php
+
+const A = [1 => [[]]];
+
+const T_1 = null ?? A[1]['undefined']['index'] ?? 1;
+const T_2 = null ?? A['undefined']['index'] ?? 2;
+const T_3 = null ?? A[1][0][2] ?? 3;
+const T_4 = A[1][0][2] ?? 4;
+const T_5 = null ?? __LINE__;
+const T_6 = __LINE__ ?? "bar";
+
+var_dump(T_1);
+var_dump(T_2);
+var_dump(T_3);
+var_dump(T_4);
+var_dump(T_5);
+var_dump(T_6);
+
+var_dump((function(){ static $var = null ?? A[1]['undefined']['index'] ?? 1; return $var; })());
+var_dump((function(){ static $var = null ?? A['undefined']['index'] ?? 2; return $var; })());
+var_dump((function(){ static $var = null ?? A[1][0][2] ?? 3; return $var; })());
+var_dump((function(){ static $var = A[1][0][2] ?? 4; return $var; })());
+
+var_dump((new class { public $var = null ?? A[1]['undefined']['index'] ?? 1; })->var);
+var_dump((new class { public $var = null ?? A['undefined']['index'] ?? 2; })->var);
+var_dump((new class { public $var = null ?? A[1][0][2] ?? 3; })->var);
+var_dump((new class { public $var = A[1][0][2] ?? 4; })->var);
+
+?>
+--EXPECTF--
+int(1)
+int(2)
+int(3)
+int(4)
+int(%d)
+int(%d)
+int(1)
+int(2)
+int(3)
+int(4)
+int(1)
+int(2)
+int(3)
+int(4)
@@ -0,0 +1,11 @@
+--TEST--
+Constant expressions with empty dimension fetch on coalesce
+--FILE--
+<?php
+
+const A = [][] ?? 1;
+
+?>
+--EXPECTF--
+Fatal error: Cannot use [] for reading in %s.php on line %d
+
@@ -35,10 +35,12 @@ const T_19 = [
    false => false,
    true => true,
 ];
+eval("const T_20x = 'a';");
+const T_20 = null ?: (T_20x . 'bc');

 var_dump(
    T_1, T_2, T_3, T_4, T_5, T_6, T_7, T_8, T_9, T_10,
-    T_11, T_12, T_13, T_14, T_15, T_16, T_17, T_18, T_19
+    T_11, T_12, T_13, T_14, T_15, T_16, T_17, T_18, T_19, T_20
 );

 ?>
@@ -75,3 +77,4 @@ array(6) {
  [1]=>
  bool(true)
 }
+string(3) "abc"
@@ -0,0 +1,15 @@
+--TEST--
+Crash when using dynamic call syntax with fully qualified name in a namespace
+--FILE--
+<?php
+
+namespace Foo;
+try {
+    ('\bar')();
+} catch (\Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Call to undefined function bar()
@@ -3,10 +3,12 @@ Testing each() with array and object
 --FILE--
 <?php

-$foo = each(new stdClass);
+$a = new stdClass;
+$foo = each($a);
 var_dump($foo);

-var_dump(each(new stdClass));
+$a = new stdClass;
+var_dump(each($a));

 $a = array(new stdClass);
 var_dump(each($a));
@@ -0,0 +1,37 @@
+--TEST--
+Cannot "yield from" from force closed generator
+--FILE--
+<?php
+
+function gen1() {
+    echo "gen1\n";
+    yield 1;
+}
+
+function gen2() {
+    try {
+        echo "try\n";
+        yield from gen1();
+    } finally {
+        echo "finally\n";
+        yield from gen1();
+    }
+}
+
+try {
+    $gen = gen2();
+    $gen->rewind();
+    unset($gen);
+} catch (Error $e) {
+    echo $e, "\n";
+}
+
+?>
+--EXPECTF--
+try
+gen1
+finally
+Error: Cannot use "yield from" in a force-closed generator in %s:%d
+Stack trace:
+#0 %s(%d): gen2()
+#1 {main}
@@ -80,7 +80,6 @@ class Obj
    function __FILE__(){ echo __METHOD__, PHP_EOL; }
    function __DIR__(){ echo __METHOD__, PHP_EOL; }
    function __NAMESPACE__(){ echo __METHOD__, PHP_EOL; }
-    function __halt_compiler(){ echo __METHOD__, PHP_EOL; }
 }

 $obj = new Obj;
@@ -160,7 +159,6 @@ $obj->__LINE__();
 $obj->__FILE__();
 $obj->__DIR__();
 $obj->__NAMESPACE__();
-$obj->__halt_compiler();

 echo "\nDone\n";

@@ -240,6 +238,5 @@ Obj::__LINE__
 Obj::__FILE__
 Obj::__DIR__
 Obj::__NAMESPACE__
-Obj::__halt_compiler

 Done
@@ -80,7 +80,6 @@ class Obj
    static function __FILE__(){ echo __METHOD__, PHP_EOL; }
    static function __DIR__(){ echo __METHOD__, PHP_EOL; }
    static function __NAMESPACE__(){ echo __METHOD__, PHP_EOL; }
-    static function __halt_compiler(){ echo __METHOD__, PHP_EOL; }
 }

 Obj::empty();
@@ -158,7 +157,6 @@ Obj::__LINE__();
 Obj::__FILE__();
 Obj::__DIR__();
 Obj::__NAMESPACE__();
-Obj::__halt_compiler();

 echo "\nDone\n";

@@ -238,6 +236,5 @@ Obj::__LINE__
 Obj::__FILE__
 Obj::__DIR__
 Obj::__NAMESPACE__
-Obj::__halt_compiler

 Done
@@ -79,7 +79,6 @@ class Obj
    const __FILE__ = '__FILE__';
    const __DIR__ = '__DIR__';
    const __NAMESPACE__ = '__NAMESPACE__';
-    const __HALT_COMPILER = '__halt_compiler';
 }

 echo Obj::EMPTY, PHP_EOL;
@@ -156,7 +155,6 @@ echo Obj::__LINE__, PHP_EOL;
 echo Obj::__FILE__, PHP_EOL;
 echo Obj::__DIR__, PHP_EOL;
 echo Obj::__NAMESPACE__, PHP_EOL;
-echo Obj::__HALT_COMPILER, PHP_EOL;

 echo "\nDone\n";

@@ -235,6 +233,5 @@ __LINE__
 __FILE__
 __DIR__
 __NAMESPACE__
-__halt_compiler

 Done
@@ -0,0 +1,18 @@
+--TEST--
+Leak when using an invalid parent:: reference in a constant definition
+--FILE--
+<?php
+
+class A {
+    const B = parent::C;
+}
+
+try {
+    A::B;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Cannot access parent:: when current class scope has no parent
@@ -2,6 +2,13 @@
 int memory_get_peak_usage ([ bool $real_usage = false ] );
 --CREDITS--
 marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
+--SKIPIF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+?>
 --INI--
 memory_limit=-1
 --FILE--
@@ -0,0 +1,25 @@
+--TEST--
+Indirect modification of isref by-value return value not possible
+--FILE--
+<?php
+
+class A {
+    public $b;
+}
+
+$arr = [];
+
+$a = new A;
+$a->b =& $arr;
+
+(new ReflectionProperty('A', 'b'))->getValue($a)[] = 42;
+
+var_dump($a);
+
+?>
+--EXPECT--
+object(A)#1 (1) {
+  ["b"]=>
+  &array(0) {
+  }
+}
@@ -0,0 +1,15 @@
+--TEST--
+Class declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    class Bar {}
+}
+
+namespace Bazzle {
+    use Foo\Bar;
+    class Bar {}
+}
+--EXPECTF--
+Fatal error: Cannot declare class Bazzle\Bar because the name is already in use in %s on line %d
@@ -0,0 +1,15 @@
+--TEST--
+Function declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    function bar() {}
+}
+
+namespace Bazzle {
+    use function Foo\bar;
+    function bar() {}
+}
+--EXPECTF--
+Fatal error: Cannot declare function Bazzle\bar because the name is already in use in %s on line %d
@@ -0,0 +1,15 @@
+--TEST--
+Class declaration colliding with import (in namespace)
+--FILE--
+<?php
+
+namespace Foo {
+    const BAR = 42;
+}
+
+namespace Bazzle {
+    use const Foo\BAR;
+    const BAR = 24;
+}
+--EXPECTF--
+Fatal error: Cannot declare const Bazzle\BAR because the name is already in use in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Leak in QM_ASSIGN when unwrapping references (rc=1)
+--FILE--
+<?php
+
+function &ref() {
+    $str = "str";
+    $str .= "str";
+    return $str;
+}
+
+var_dump(true ? ref() : ref());
+var_dump(ref() ?: ref());
+var_dump(ref() ?? ref());
+
+?>
+--EXPECT--
+string(6) "strstr"
+string(6) "strstr"
+string(6) "strstr"
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71978 (Existence of return type hint affects other compatibility rules)
+--FILE--
+<?php
+class A {
+	function foo(int $a) {}
+}
+class B extends A {
+	function foo(string $a) {}
+}
+class A1 {
+	function foo(int $a): int {}
+}
+class B1 extends A1 {
+	function foo(string $a): int {}
+}
+?>
+--EXPECTF--
+Warning: Declaration of B::foo(string $a) should be compatible with A::foo(int $a) in %s on line %d
+
+Warning: Declaration of B1::foo(string $a): int should be compatible with A1::foo(int $a): int in %s on line %d
@@ -16,4 +16,4 @@ class C implements IFoo {
 }

 --EXPECTF--
-Fatal error: Declaration of TFoo::oneArgument() must be compatible with IFoo::oneArgument($a) in %s on line %d
+Fatal error: Declaration of C::oneArgument() must be compatible with IFoo::oneArgument($a) in %s on line %d
@@ -3358,6 +3358,7 @@ again:
 					memcpy(ZSTR_VAL(*callable_name), ZSTR_VAL(ce->name), ZSTR_LEN(ce->name));
 					memcpy(ZSTR_VAL(*callable_name) + ZSTR_LEN(ce->name), "::__invoke", sizeof("::__invoke"));
 				}
+				fcc->initialized = 1;
 				return 1;
 			}
 			if (callable_name) {
@@ -476,8 +476,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;

 /** Build zend_call_info/cache from a zval*
 *
- * Caller is responsible to provide a return value, otherwise the we will crash.
- * fci->retval_ptr_ptr = NULL;
+ * Caller is responsible to provide a return value (fci->retval), otherwise the we will crash.
 * In order to pass parameters the following members need to be set:
 * fci->param_count = 0;
 * fci->params = NULL;
@@ -337,6 +337,22 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 				zval_dtor(&op1);
 			}
 			break;
+		case ZEND_AST_COALESCE:
+			if (UNEXPECTED(zend_ast_evaluate(&op1, ast->child[0], scope) != SUCCESS)) {
+				ret = FAILURE;
+				break;
+			}
+			if (Z_TYPE(op1) > IS_NULL) {
+				*result = op1;
+			} else {
+				if (UNEXPECTED(zend_ast_evaluate(result, ast->child[1], scope) != SUCCESS)) {
+					zval_dtor(&op1);
+					ret = FAILURE;
+					break;
+				}
+				zval_dtor(&op1);
+			}
+			break;
 		case ZEND_AST_UNARY_PLUS:
 			if (UNEXPECTED(zend_ast_evaluate(&op2, ast->child[0], scope) != SUCCESS)) {
 				ret = FAILURE;
@@ -385,6 +401,10 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 			}
 			break;
 		case ZEND_AST_DIM:
+			if (ast->child[1] == NULL) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
+			}
+
 			if (UNEXPECTED(zend_ast_evaluate(&op1, ast->child[0], scope) != SUCCESS)) {
 				ret = FAILURE;
 			} else if (UNEXPECTED(zend_ast_evaluate(&op2, ast->child[1], scope) != SUCCESS)) {
@@ -393,7 +413,12 @@ ZEND_API int zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *sc
 			} else {
 				zval tmp;

-				zend_fetch_dimension_by_zval(&tmp, &op1, &op2);
+				if (ast->attr == ZEND_DIM_IS) {
+					zend_fetch_dimension_by_zval_is(&tmp, &op1, &op2, IS_CONST);
+				} else {
+					zend_fetch_dimension_by_zval(&tmp, &op1, &op2);
+				}
+
 				if (UNEXPECTED(Z_ISREF(tmp))) {
 					ZVAL_DUP(result, Z_REFVAL(tmp));
 				} else {
@@ -922,6 +947,21 @@ static void zend_ast_export_zval(smart_str *str, zval *zv, int priority, int ind
 	}
 }

+static void zend_ast_export_class_no_header(smart_str *str, zend_ast_decl *decl, int indent) {
+	if (decl->child[0]) {
+		smart_str_appends(str, " extends ");
+		zend_ast_export_ns_name(str, decl->child[0], 0, indent);
+	}
+	if (decl->child[1]) {
+		smart_str_appends(str, " implements ");
+		zend_ast_export_ex(str, decl->child[1], 0, indent);
+	}
+	smart_str_appends(str, " {\n");
+	zend_ast_export_stmt(str, decl->child[2], indent + 1);
+	zend_ast_export_indent(str, indent);
+	smart_str_appends(str, "}");
+}
+
 #define BINARY_OP(_op, _p, _pl, _pr) do { \
 		op = _op; \
 		p = _p; \
@@ -1048,18 +1088,8 @@ tail_call:
 				smart_str_appends(str, "class ");
 			}
 			smart_str_appendl(str, ZSTR_VAL(decl->name), ZSTR_LEN(decl->name));
-			if (decl->child[0]) {
-				smart_str_appends(str, " extends ");
-				zend_ast_export_ns_name(str, decl->child[0], 0, indent);
-			}
-			if (decl->child[1]) {
-				smart_str_appends(str, " implements ");
-				zend_ast_export_ex(str, decl->child[1], 0, indent);
-			}
-			smart_str_appends(str, " {\n");
-			zend_ast_export_stmt(str, decl->child[2], indent + 1);
-			zend_ast_export_indent(str, indent);
-			smart_str_appends(str, "}\n");
+			zend_ast_export_class_no_header(str, decl, indent);
+			smart_str_appendc(str, '\n');
 			break;

 		/* list nodes */
@@ -1187,7 +1217,11 @@ simple_list:
 			if (ast->child[0]->kind == ZEND_AST_ENCAPS_LIST) {
 				zend_ast_export_encaps_list(str, '`', (zend_ast_list*)ast->child[0], indent);
 			} else {
-				zend_ast_export_ex(str, ast->child[0], 0, indent);
+				zval *zv;
+				ZEND_ASSERT(ast->child[0]->kind == ZEND_AST_ZVAL);
+				zv = zend_ast_get_zval(ast->child[0]);
+				ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);
+				zend_ast_export_qstr(str, '`', Z_STR_P(zv));
 			}
 			smart_str_appendc(str, '`');
 			break;
@@ -1344,10 +1378,20 @@ simple_list:
 			break;
 		case ZEND_AST_NEW:
 			smart_str_appends(str, "new ");
-			zend_ast_export_ns_name(str, ast->child[0], 0, indent);
-			smart_str_appendc(str, '(');
-			zend_ast_export_ex(str, ast->child[1], 0, indent);
-			smart_str_appendc(str, ')');
+			if (ast->child[0]->kind == ZEND_AST_CLASS) {
+				smart_str_appends(str, "class");
+				if (zend_ast_get_list(ast->child[1])->children) {
+					smart_str_appendc(str, '(');
+					zend_ast_export_ex(str, ast->child[1], 0, indent);
+					smart_str_appendc(str, ')');
+				}
+				zend_ast_export_class_no_header(str, (zend_ast_decl *) ast->child[0], indent);
+			} else {
+				zend_ast_export_ns_name(str, ast->child[0], 0, indent);
+				smart_str_appendc(str, '(');
+				zend_ast_export_ex(str, ast->child[1], 0, indent);
+				smart_str_appendc(str, ')');
+			}
 			break;
 		case ZEND_AST_INSTANCEOF:
 			zend_ast_export_ex(str, ast->child[0], 0, indent);
@@ -704,7 +704,8 @@ ZEND_FUNCTION(error_reporting)
 #endif

 	old_error_reporting = EG(error_reporting);
-	if(ZEND_NUM_ARGS() != 0) {
+	if (ZEND_NUM_ARGS() != 0) {
+		zend_string *new_val = zval_get_string(err);
 		do {
 			zend_ini_entry *p = EG(error_reporting_ini_entry);

@@ -730,7 +731,7 @@ ZEND_FUNCTION(error_reporting)
 				zend_string_release(p->value);
 			}

-			p->value = zval_get_string(err);
+			p->value = new_val;
 			if (Z_TYPE_P(err) == IS_LONG) {
 				EG(error_reporting) = Z_LVAL_P(err);
 			} else {
@@ -1183,7 +1184,7 @@ ZEND_FUNCTION(get_object_vars)

 	zobj = Z_OBJ_P(obj);

-	if (!zobj->ce->default_properties_count && properties == zobj->properties) {
+	if (!zobj->ce->default_properties_count && properties == zobj->properties && !ZEND_HASH_GET_APPLY_COUNT(properties)) {
 		/* fast copy */
 		if (EXPECTED(zobj->handlers == &std_object_handlers)) {
 			if (EXPECTED(!(GC_FLAGS(properties) & IS_ARRAY_IMMUTABLE))) {
@@ -2387,8 +2388,10 @@ ZEND_FUNCTION(debug_print_backtrace)
 			if (object) {
 				if (func->common.scope) {
 					class_name = func->common.scope->name;
-				} else {
+				} else if (object->handlers->get_class_name == std_object_handlers.get_class_name) {
 					class_name = object->ce->name;
+				} else {
+					class_name = object->handlers->get_class_name(object);
 				}

 				call_type = "->";
@@ -2448,6 +2451,11 @@ ZEND_FUNCTION(debug_print_backtrace)
 		if (class_name) {
 			ZEND_PUTS(ZSTR_VAL(class_name));
 			ZEND_PUTS(call_type);
+			if (object
+			  && !func->common.scope
+			  && object->handlers->get_class_name != std_object_handlers.get_class_name) {
+				zend_string_release(class_name);
+			}
 		}
 		zend_printf("%s(", function_name);
 		if (Z_TYPE(arg_array) != IS_UNDEF) {
@@ -2607,9 +2615,12 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 			if (object) {
 				if (func->common.scope) {
 					add_assoc_str_ex(&stack_frame, "class", sizeof("class")-1, zend_string_copy(func->common.scope->name));
-				} else {
+				} else if (object->handlers->get_class_name == std_object_handlers.get_class_name) {
 					add_assoc_str_ex(&stack_frame, "class", sizeof("class")-1, zend_string_copy(object->ce->name));
-
+				} else {
+					zend_string *class_name = object->handlers->get_class_name(object);
+					add_assoc_str_ex(&stack_frame, "class", sizeof("class")-1, class_name);
+					zend_string_release(class_name);
 				}
 				if ((options & DEBUG_BACKTRACE_PROVIDE_OBJECT) != 0) {
 					zval zv;
@@ -297,14 +297,10 @@ ZEND_API zval* zend_get_closure_this_ptr(zval *obj) /* {{{ */

 static zend_function *zend_closure_get_method(zend_object **object, zend_string *method, const zval *key) /* {{{ */
 {
-	zend_string *lc_name;
-
-	lc_name = zend_string_tolower(method);
-	if (zend_string_equals_literal(method, ZEND_INVOKE_FUNC_NAME)) {
-		zend_string_release(lc_name);
+	if (zend_string_equals_literal_ci(method, ZEND_INVOKE_FUNC_NAME)) {
 		return zend_get_closure_invoke_method(*object);
 	}
-	zend_string_release(lc_name);
+
 	return std_object_handlers.get_method(object, method, key);
 }
 /* }}} */
@@ -611,16 +611,29 @@ static inline void zend_end_loop(int cont_addr) /* {{{ */

 void zend_do_free(znode *op1) /* {{{ */
 {
-	if (op1->op_type==IS_TMP_VAR) {
-		zend_op *opline = get_next_op(CG(active_op_array));
+	if (op1->op_type == IS_TMP_VAR) {
+		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
+
+		while (opline->opcode == ZEND_END_SILENCE) {
+			opline--;
+		}
+
+		if (opline->result_type == IS_TMP_VAR && opline->result.var == op1->u.op.var) {
+			if (opline->opcode == ZEND_BOOL || opline->opcode == ZEND_BOOL_NOT) {
+				return;
+			}
+		}
+
+		opline = get_next_op(CG(active_op_array));

 		opline->opcode = ZEND_FREE;
 		SET_NODE(opline->op1, op1);
 		SET_UNUSED(opline->op2);
-	} else if (op1->op_type==IS_VAR) {
+	} else if (op1->op_type == IS_VAR) {
 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
-
-		while (opline->opcode == ZEND_END_SILENCE || opline->opcode == ZEND_EXT_FCALL_END || opline->opcode == ZEND_OP_DATA) {
+		while (opline->opcode == ZEND_END_SILENCE ||
+				opline->opcode == ZEND_EXT_FCALL_END ||
+				opline->opcode == ZEND_OP_DATA) {
 			opline--;
 		}
 		if (opline->result_type == IS_VAR
@@ -650,7 +663,7 @@ void zend_do_free(znode *op1) /* {{{ */
 					SET_UNUSED(opline->op2);
 					return;
 				}
-				if (opline->result_type==IS_VAR
+				if (opline->result_type == IS_VAR
 					&& opline->result.var == op1->u.op.var) {
 					if (opline->opcode == ZEND_NEW) {
 						opline->result_type |= EXT_TYPE_UNUSED;
@@ -760,6 +773,7 @@ zend_string *zend_resolve_non_class_name(

 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
+		*is_fully_qualified = 1;
 		return zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
 	}

@@ -1203,7 +1217,7 @@ ZEND_API int zend_unmangle_property_name_ex(const zend_string *name, const char

 	*class_name = NULL;

-	if (ZSTR_VAL(name)[0] != '\0') {
+	if (!ZSTR_LEN(name) || ZSTR_VAL(name)[0] != '\0') {
 		*prop_name = ZSTR_VAL(name);
 		if (prop_len) {
 			*prop_len = ZSTR_LEN(name);
@@ -3056,19 +3070,9 @@ int zend_compile_func_cuf(znode *result, zend_ast_list *args, zend_string *lcnam
 		zend_ast *arg_ast = args->child[i];
 		znode arg_node;
 		zend_op *opline;
-		zend_bool send_user = 0;

-		if (zend_is_variable(arg_ast) && !zend_is_call(arg_ast)) {
-			zend_compile_var(&arg_node, arg_ast, BP_VAR_FUNC_ARG | (i << BP_VAR_SHIFT));
-			send_user = 1;
-		} else {
-			zend_compile_expr(&arg_node, arg_ast);
-			if (arg_node.op_type & (IS_VAR|IS_CV)) {
-				send_user = 1;
-			}
-		}
-
-		if (send_user) {
+		zend_compile_expr(&arg_node, arg_ast);
+		if (arg_node.op_type & (IS_VAR|IS_CV)) {
 			opline = zend_emit_op(NULL, ZEND_SEND_USER, &arg_node, NULL);
 		} else {
 			opline = zend_emit_op(NULL, ZEND_SEND_VAL, &arg_node, NULL);
@@ -3155,6 +3159,14 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return FAILURE;
 	}

+	if (zend_string_equals_literal(lcname, "assert")) {
+		return zend_compile_assert(result, args, lcname, fbc);
+	}
+
+	if (CG(compiler_options) & ZEND_COMPILE_NO_BUILTINS) {
+		return FAILURE;
+	}
+
 	if (zend_string_equals_literal(lcname, "strlen")) {
 		return zend_compile_func_strlen(result, args);
 	} else if (zend_string_equals_literal(lcname, "is_null")) {
@@ -3185,8 +3197,6 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return zend_compile_func_cufa(result, args, lcname);
 	} else if (zend_string_equals_literal(lcname, "call_user_func")) {
 		return zend_compile_func_cuf(result, args, lcname);
-	} else if (zend_string_equals_literal(lcname, "assert")) {
-		return zend_compile_assert(result, args, lcname, fbc);
 	} else {
 		return FAILURE;
 	}
@@ -4015,16 +4025,32 @@ void zend_compile_switch(zend_ast *ast) /* {{{ */

 	znode expr_node, case_node;
 	zend_op *opline;
-	uint32_t *jmpnz_opnums = safe_emalloc(sizeof(uint32_t), cases->children, 0);
-	uint32_t opnum_default_jmp;
+	uint32_t *jmpnz_opnums, opnum_default_jmp;

 	zend_compile_expr(&expr_node, expr_ast);

+	if (cases->children == 1 && cases->child[0]->child[0] == NULL) {
+		/* we have to take care about the case that only have one default branch,
+		 * expr result will not be unrefed in this case, but it should be like in ZEND_CASE */
+		zend_ast *stmt_ast = cases->child[0]->child[1];
+		if (expr_node.op_type == IS_VAR || expr_node.op_type == IS_TMP_VAR) {
+			zend_emit_op(NULL, ZEND_FREE, &expr_node, NULL);
+		} else if (expr_node.op_type == IS_CONST) {
+			zval_dtor(&expr_node.u.constant);
+		}
+
+		zend_begin_loop(ZEND_NOP, NULL);
+		zend_compile_stmt(stmt_ast);
+		zend_end_loop(get_next_op_number(CG(active_op_array)));
+		return;
+	}
+
 	zend_begin_loop(ZEND_FREE, &expr_node);

 	case_node.op_type = IS_TMP_VAR;
 	case_node.u.op.var = get_temporary_variable(CG(active_op_array));

+	jmpnz_opnums = safe_emalloc(sizeof(uint32_t), cases->children, 0);
 	for (i = 0; i < cases->children; ++i) {
 		zend_ast *case_ast = cases->child[i];
 		zend_ast *cond_ast = case_ast->child[0];
@@ -4471,8 +4497,9 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 			zend_error_noreturn(E_COMPILE_ERROR, "Redefinition of parameter $%s",
 				ZSTR_VAL(name));
 		} else if (zend_string_equals_literal(name, "this")) {
-			if (op_array->scope && (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
-				zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
+			if ((op_array->scope || (op_array->fn_flags & ZEND_ACC_CLOSURE))
+					&& (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use $this as parameter");
 			}
 			op_array->this_var = var_node.u.op.var;
 		}
@@ -4636,7 +4663,7 @@ void zend_begin_method_decl(zend_op_array *op_array, zend_string *name, zend_boo
 	zend_string *lcname;

 	if (in_interface) {
-		if ((op_array->fn_flags & ZEND_ACC_PPP_MASK) != ZEND_ACC_PUBLIC) {
+		if (!is_public || (op_array->fn_flags & (ZEND_ACC_FINAL|ZEND_ACC_ABSTRACT))) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Access type for interface method "
 				"%s::%s() must be omitted", ZSTR_VAL(ce->name), ZSTR_VAL(name));
 		}
@@ -4798,15 +4825,16 @@ void zend_begin_method_decl(zend_op_array *op_array, zend_string *name, zend_boo
 static void zend_begin_func_decl(znode *result, zend_op_array *op_array, zend_ast_decl *decl) /* {{{ */
 {
 	zend_ast *params_ast = decl->child[0];
-	zend_string *name = decl->name, *lcname;
+	zend_string *unqualified_name, *name, *lcname;
 	zend_op *opline;

-	op_array->function_name = name = zend_prefix_with_ns(name);
-
+	unqualified_name = decl->name;
+	op_array->function_name = name = zend_prefix_with_ns(unqualified_name);
 	lcname = zend_string_tolower(name);

 	if (FC(imports_function)) {
-		zend_string *import_name = zend_hash_find_ptr(FC(imports_function), lcname);
+		zend_string *import_name = zend_hash_find_ptr_lc(
+			FC(imports_function), ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name));
 		if (import_name && !zend_string_equals_ci(lcname, import_name)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare function %s "
 				"because the name is already in use", ZSTR_VAL(name));
@@ -5189,7 +5217,7 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 	zend_ast *extends_ast = decl->child[0];
 	zend_ast *implements_ast = decl->child[1];
 	zend_ast *stmt_ast = decl->child[2];
-	zend_string *name, *lcname, *import_name = NULL;
+	zend_string *name, *lcname;
 	zend_class_entry *ce = zend_arena_alloc(&CG(arena), sizeof(zend_class_entry));
 	zend_op *opline;
 	znode declare_node, extends_node;
@@ -5198,31 +5226,25 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 	znode original_implementing_class = FC(implementing_class);

 	if (EXPECTED((decl->flags & ZEND_ACC_ANON_CLASS) == 0)) {
+		zend_string *unqualified_name = decl->name;
+
 		if (CG(active_class_entry)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Class declarations may not be nested");
 		}
-		name = decl->name;
-		zend_assert_valid_class_name(name);
-		lcname = zend_string_tolower(name);
-		if (FC(current_namespace)) {
-			name = zend_prefix_with_ns(name);

-			zend_string_release(lcname);
-			lcname = zend_string_tolower(name);
-		} else {
-			zend_string_addref(name);
-		}
+		zend_assert_valid_class_name(unqualified_name);
+		name = zend_prefix_with_ns(unqualified_name);
+		name = zend_new_interned_string(name);
+		lcname = zend_string_tolower(name);

 		if (FC(imports)) {
-			import_name = zend_hash_find_ptr(FC(imports), lcname);
+			zend_string *import_name = zend_hash_find_ptr_lc(
+				FC(imports), ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name));
+			if (import_name && !zend_string_equals_ci(lcname, import_name)) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare class %s "
+						"because the name is already in use", ZSTR_VAL(name));
+			}
 		}
-
-		if (import_name && !zend_string_equals_ci(lcname, import_name)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare class %s "
-					"because the name is already in use", ZSTR_VAL(name));
-		}
-
-		name = zend_new_interned_string(name);
 	} else {
 		name = zend_generate_anon_class_name(decl->lex_pos);
 		lcname = zend_string_tolower(name);
@@ -5298,10 +5320,6 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */

 	CG(active_class_entry) = ce;

-	if (implements_ast) {
-		zend_compile_implements(&declare_node, implements_ast);
-	}
-
 	zend_compile_stmt(stmt_ast);

 	/* Reset lineno for final opcodes and errors */
@@ -5358,11 +5376,15 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 		zend_emit_op(NULL, ZEND_BIND_TRAITS, &declare_node, NULL);
 	}

+	if (implements_ast) {
+		zend_compile_implements(&declare_node, implements_ast);
+	}
+
 	if (!(ce->ce_flags & (ZEND_ACC_INTERFACE|ZEND_ACC_EXPLICIT_ABSTRACT_CLASS))
-		&& (extends_ast || ce->num_interfaces > 0)
+		&& (extends_ast || implements_ast)
 	) {
 		zend_verify_abstract_class(ce);
-		if (ce->num_interfaces && !(ce->ce_flags & ZEND_ACC_IMPLEMENT_TRAITS)) {
+		if (implements_ast) {
 			zend_emit_op(NULL, ZEND_VERIFY_ABSTRACT_CLASS, &declare_node, NULL);
 		}
 	}
@@ -5573,26 +5595,26 @@ void zend_compile_const_decl(zend_ast *ast) /* {{{ */
 		zend_ast *const_ast = list->child[i];
 		zend_ast *name_ast = const_ast->child[0];
 		zend_ast *value_ast = const_ast->child[1];
-		zend_string *name = zend_ast_get_str(name_ast);
+		zend_string *unqualified_name = zend_ast_get_str(name_ast);

-		zend_string *import_name;
+		zend_string *name;
 		znode name_node, value_node;
 		zval *value_zv = &value_node.u.constant;

 		value_node.op_type = IS_CONST;
 		zend_const_expr_to_zval(value_zv, value_ast);

-		if (zend_lookup_reserved_const(ZSTR_VAL(name), ZSTR_LEN(name))) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot redeclare constant '%s'", ZSTR_VAL(name));
+		if (zend_lookup_reserved_const(ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name))) {
+			zend_error_noreturn(E_COMPILE_ERROR,
+				"Cannot redeclare constant '%s'", ZSTR_VAL(unqualified_name));
 		}

-		name = zend_prefix_with_ns(name);
+		name = zend_prefix_with_ns(unqualified_name);
 		name = zend_new_interned_string(name);

-		if (FC(imports_const)
-			&& (import_name = zend_hash_find_ptr(FC(imports_const), name))
-		) {
-			if (!zend_string_equals(import_name, name)) {
+		if (FC(imports_const)) {
+			zend_string *import_name = zend_hash_find_ptr(FC(imports_const), unqualified_name);
+			if (import_name && !zend_string_equals(import_name, name)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare const %s because "
 					"the name is already in use", ZSTR_VAL(name));
 			}
@@ -6054,7 +6076,7 @@ void zend_compile_short_circuiting(znode *result, zend_ast *ast) /* {{{ */

 				zval_ptr_dtor(&right_node.u.constant);
 			} else {
-				zend_emit_op(result, ZEND_BOOL, &right_node, NULL);
+				zend_emit_op_tmp(result, ZEND_BOOL, &right_node, NULL);
 			}
 		}

@@ -6819,7 +6841,7 @@ zend_bool zend_is_allowed_in_const_expr(zend_ast_kind kind) /* {{{ */
 		|| kind == ZEND_AST_CONDITIONAL || kind == ZEND_AST_DIM
 		|| kind == ZEND_AST_ARRAY || kind == ZEND_AST_ARRAY_ELEM
 		|| kind == ZEND_AST_CONST || kind == ZEND_AST_CLASS_CONST
-		|| kind == ZEND_AST_MAGIC_CONST;
+		|| kind == ZEND_AST_MAGIC_CONST || kind == ZEND_AST_COALESCE;
 }
 /* }}} */

@@ -6953,14 +6975,16 @@ void zend_const_expr_to_zval(zval *result, zend_ast *ast) /* {{{ */
 	zend_compile_const_expr(&ast);
 	if (ast->kind == ZEND_AST_ZVAL) {
 		ZVAL_COPY_VALUE(result, zend_ast_get_zval(ast));
-
-		/* Kill this branch of the original AST, as it was already destroyed.
-		 * It would be nice to find a better solution to this problem in the
-		 * future. */
-		orig_ast->kind = 0;
 	} else {
 		ZVAL_NEW_AST(result, zend_ast_copy(ast));
+		/* destroy the ast here, it might have been replaced */
+		zend_ast_destroy(ast);
 	}
+
+	/* Kill this branch of the original AST, as it was already destroyed.
+	 * It would be nice to find a better solution to this problem in the
+	 * future. */
+	orig_ast->kind = 0;
 }
 /* }}} */

@@ -7371,6 +7395,30 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */

 			zend_ct_eval_unary_pm(&result, ast->kind, zend_ast_get_zval(ast->child[0]));
 			break;
+		case ZEND_AST_COALESCE:
+			/* Set isset fetch indicator here, opcache disallows runtime altering of the AST */
+			if (ast->child[0]->kind == ZEND_AST_DIM) {
+				ast->child[0]->attr = ZEND_DIM_IS;
+			}
+			zend_eval_const_expr(&ast->child[0]);
+
+			if (ast->child[0]->kind != ZEND_AST_ZVAL) {
+				/* ensure everything was compile-time evaluated at least once */
+				zend_eval_const_expr(&ast->child[1]);
+				return;
+			}
+
+			if (Z_TYPE_P(zend_ast_get_zval(ast->child[0])) == IS_NULL) {
+				zend_eval_const_expr(&ast->child[1]);
+				*ast_ptr = ast->child[1];
+				ast->child[1] = NULL;
+				zend_ast_destroy(ast);
+			} else {
+				*ast_ptr = ast->child[0];
+				ast->child[0] = NULL;
+				zend_ast_destroy(ast);
+			}
+			return;
 		case ZEND_AST_CONDITIONAL:
 		{
 			zend_ast **child, *child_ast;
@@ -7404,6 +7452,11 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
 			}

+			/* Set isset fetch indicator here, opcache disallows runtime altering of the AST */
+			if (ast->attr == ZEND_DIM_IS && ast->child[0]->kind == ZEND_AST_DIM) {
+				ast->child[0]->attr = ZEND_DIM_IS;
+			}
+
 			zend_eval_const_expr(&ast->child[0]);
 			zend_eval_const_expr(&ast->child[1]);
 			if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
@@ -889,6 +889,8 @@ ZEND_API void zend_assert_valid_class_name(const zend_string *const_name);
 #define ZEND_SEND_BY_REF     1
 #define ZEND_SEND_PREFER_REF 2

+#define ZEND_DIM_IS 1
+
 static zend_always_inline int zend_check_arg_send_type(const zend_function *zf, uint32_t arg_num, uint32_t mask)
 {
 	arg_num--;
@@ -1009,6 +1011,9 @@ END_EXTERN_C()
 /* force IS_OBJ_USE_GUARDS for all classes */
 #define ZEND_COMPILE_GUARDS						(1<<9)

+/* disable builtin special case function calls */
+#define ZEND_COMPILE_NO_BUILTINS				(1<<10)
+
 /* The default value for CG(compiler_options) */
 #define ZEND_COMPILE_DEFAULT					ZEND_COMPILE_HANDLE_OP_ARRAY

@@ -299,7 +299,6 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 	zend_constant *c;
 	const char *colon;
 	zend_class_entry *ce = NULL;
-	zend_string *class_name;
 	const char *name = ZSTR_VAL(cname);
 	size_t name_len = ZSTR_LEN(cname);

@@ -315,13 +314,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 		int class_name_len = colon - name - 1;
 		size_t const_name_len = name_len - class_name_len - 2;
 		zend_string *constant_name = zend_string_init(colon + 1, const_name_len, 0);
-		char *lcname;
+		zend_string *class_name = zend_string_init(name, class_name_len, 0);
 		zval *ret_constant = NULL;
-		ALLOCA_FLAG(use_heap)

-		class_name = zend_string_init(name, class_name_len, 0);
-		lcname = do_alloca(class_name_len + 1, use_heap);
-		zend_str_tolower_copy(lcname, name, class_name_len);
 		if (!scope) {
 			if (EG(current_execute_data)) {
 				scope = EG(scope);
@@ -330,48 +325,43 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 			}
 		}

-		if (class_name_len == sizeof("self")-1 &&
-		    !memcmp(lcname, "self", sizeof("self")-1)) {
+		if (zend_string_equals_literal_ci(class_name, "self")) {
 			if (UNEXPECTED(!scope)) {
 				zend_throw_error(NULL, "Cannot access self:: when no class scope is active");
-				return NULL;
+				goto failure;
 			}
 			ce = scope;
-		} else if (class_name_len == sizeof("parent")-1 &&
-		           !memcmp(lcname, "parent", sizeof("parent")-1)) {
+		} else if (zend_string_equals_literal_ci(class_name, "parent")) {
 			if (UNEXPECTED(!scope)) {
 				zend_throw_error(NULL, "Cannot access parent:: when no class scope is active");
-				return NULL;
+				goto failure;
 			} else if (UNEXPECTED(!scope->parent)) {
 				zend_throw_error(NULL, "Cannot access parent:: when current class scope has no parent");
-				return NULL;
+				goto failure;
 			} else {
 				ce = scope->parent;
 			}
-		} else if (class_name_len == sizeof("static")-1 &&
-		           !memcmp(lcname, "static", sizeof("static")-1)) {
+		} else if (zend_string_equals_literal_ci(class_name, "static")) {
 			ce = zend_get_called_scope(EG(current_execute_data));
 			if (UNEXPECTED(!ce)) {
 				zend_throw_error(NULL, "Cannot access static:: when no class scope is active");
-				return NULL;
+				goto failure;
 			}
 		} else {
 			ce = zend_fetch_class(class_name, flags);
 		}
-		free_alloca(lcname, use_heap);
 		if (ce) {
 			ret_constant = zend_hash_find(&ce->constants_table, constant_name);
 			if (ret_constant == NULL) {
 				if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
 					zend_throw_error(NULL, "Undefined class constant '%s::%s'", ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
-					zend_string_release(class_name);
-					zend_string_free(constant_name);
-					return NULL;
 				}
 			} else if (Z_ISREF_P(ret_constant)) {
 				ret_constant = Z_REFVAL_P(ret_constant);
 			}
 		}
+
+failure:
 		zend_string_release(class_name);
 		zend_string_free(constant_name);
 		if (ret_constant && Z_CONSTANT_P(ret_constant)) {
@@ -563,11 +563,13 @@ static void _build_trace_args(zval *arg, smart_str *str) /* {{{ */
 		case IS_ARRAY:
 			smart_str_appends(str, "Array, ");
 			break;
-		case IS_OBJECT:
+		case IS_OBJECT: {
+			zend_string *class_name = Z_OBJ_HANDLER_P(arg, get_class_name)(Z_OBJ_P(arg));
 			smart_str_appends(str, "Object(");
-			smart_str_appends(str, ZSTR_VAL(Z_OBJCE_P(arg)->name));
+			smart_str_appends(str, ZSTR_VAL(class_name));
 			smart_str_appends(str, "), ");
 			break;
+		}
 	}
 }
 /* }}} */
@@ -1912,6 +1912,12 @@ ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *
 	zend_fetch_dimension_address_read_R(result, container, dim, IS_TMP_VAR);
 }

+ZEND_API void zend_fetch_dimension_by_zval_is(zval *result, zval *container, zval *dim, int dim_type)
+{
+	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS);
+}
+
+
 static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type)
 {
    if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
@@ -296,6 +296,7 @@ ZEND_API zend_class_entry *zend_fetch_class_by_name(zend_string *class_name, con
 void zend_verify_abstract_class(zend_class_entry *ce);

 ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *dim);
+ZEND_API void zend_fetch_dimension_by_zval_is(zval *result, zval *container, zval *dim, int dim_type);

 ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data_ptr, uint32_t var);

@@ -295,8 +295,8 @@ void shutdown_executor(void) /* {{{ */
 		}

 		zend_stack_clean(&EG(user_error_handlers_error_reporting), NULL, 1);
-		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
-		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
+		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
+		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
 	} zend_end_try();

 	zend_try {
@@ -397,7 +397,7 @@ void shutdown_executor(void) /* {{{ */

 	zend_shutdown_fpu();

-#ifdef ZEND_DEBUG
+#if ZEND_DEBUG
 	if (EG(ht_iterators_used) && !CG(unclean_shutdown)) {
 		zend_error(E_WARNING, "Leaked %" PRIu32 " hashtable iterators", EG(ht_iterators_used));
 	}
@@ -786,6 +786,9 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 	if (func->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) {
 		if (func->common.fn_flags & ZEND_ACC_ABSTRACT) {
 			zend_throw_error(NULL, "Cannot call abstract method %s::%s()", ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (EG(current_execute_data) == &dummy_execute_data) {
+				EG(current_execute_data) = dummy_execute_data.prev_execute_data;
+			}
 			return FAILURE;
 		}
 		if (func->common.fn_flags & ZEND_ACC_DEPRECATED) {
@@ -31,7 +31,8 @@ static zend_object_handlers zend_generator_handlers;

 static zend_object *zend_generator_create(zend_class_entry *class_type);

-static void zend_generator_cleanup_unfinished_execution(zend_generator *generator) /* {{{ */
+static void zend_generator_cleanup_unfinished_execution(
+		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
 {
 	zend_execute_data *execute_data = generator->execute_data;

@@ -47,7 +48,7 @@ static void zend_generator_cleanup_unfinished_execution(zend_generator *generato
 		EG(vm_stack_end) = generator->stack->end;
 		EG(vm_stack) = generator->stack;

-		zend_cleanup_unfinished_execution(execute_data, op_num, 0);
+		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);

 		generator->stack = EG(vm_stack);
 		generator->stack->top = EG(vm_stack_top);
@@ -85,7 +86,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator);
+			zend_generator_cleanup_unfinished_execution(generator, 0);
 		}

 		/* Free closure object */
@@ -151,8 +152,11 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	/* If a finally block was found we jump directly to it and
 	 * resume the generator. */
 	if (finally_op_num) {
-		zval *fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
+		zval *fast_call;

+		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+
+		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
 		EG(exception) = NULL;
 		fast_call->u2.lineno = (uint32_t)-1;
@@ -1794,7 +1794,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 	target->pDestructor = source->pDestructor;

 	if (source->nNumUsed == 0) {
-		target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
@@ -1819,7 +1819,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 			target->nInternalPointer = idx;
 		}
 	} else if (source->u.flags & HASH_FLAG_PACKED) {
-		target->u.flags = (source->u.flags & ~HASH_FLAG_PERSISTENT) | HASH_FLAG_APPLY_PROTECTION;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION;
 		target->nTableMask = source->nTableMask;
 		target->nNumUsed = source->nNumUsed;
 		target->nNumOfElements = source->nNumOfElements;
@@ -1842,7 +1842,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 			target->nInternalPointer = idx;
 		}
 	} else {
-		target->u.flags = (source->u.flags & ~HASH_FLAG_PERSISTENT) | HASH_FLAG_APPLY_PROTECTION;
+		target->u.flags = (source->u.flags & ~(HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION;
 		target->nTableMask = source->nTableMask;
 		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = HT_INVALID_IDX;
@@ -319,6 +319,14 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 			return 0;
 		}

+#if 0
+		// This introduces BC break described at https://bugs.php.net/bug.php?id=72119
+		if (proto_arg_info->type_hint && proto_arg_info->allow_null && !fe_arg_info->allow_null) {
+			/* incompatible nullability */
+			return 0;
+		}
+#endif
+
 		/* by-ref constraints on arguments are invariant */
 		if (fe_arg_info->pass_by_reference != proto_arg_info->pass_by_reference) {
 			return 0;
@@ -483,6 +491,8 @@ static ZEND_COLD zend_string *zend_get_function_declaration(const zend_function
 				} else {
 					smart_str_appends(&str, "NULL");
 				}
+			} else if (arg_info->type_hint && arg_info->allow_null) {
+				smart_str_appends(&str, " = NULL");
 			}

 			if (++i < num_args) {
@@ -563,17 +573,31 @@ static void do_inheritance_check_on_method(zend_function *child, zend_function *
 	}

 	if (child->common.prototype && (
-		child->common.prototype->common.fn_flags & (ZEND_ACC_ABSTRACT | ZEND_ACC_HAS_RETURN_TYPE)
+		child->common.prototype->common.fn_flags & ZEND_ACC_ABSTRACT
 	)) {
-		if (UNEXPECTED(!zend_do_perform_implementation_check(child, child->common.prototype))) {
-			zend_string *method_prototype = zend_get_function_declaration(child->common.prototype);
-			zend_string *child_prototype = zend_get_function_declaration(child);
-			zend_error_noreturn(E_COMPILE_ERROR, "Declaration of %s must be compatible with %s", ZSTR_VAL(child_prototype), ZSTR_VAL(method_prototype));
-		}
-	} else if (UNEXPECTED(!zend_do_perform_implementation_check(child, parent))) {
+		parent = child->common.prototype;
+	}
+	if (UNEXPECTED(!zend_do_perform_implementation_check(child, parent))) {
+		int error_level;
+		const char *error_verb;
 		zend_string *method_prototype = zend_get_function_declaration(parent);
 		zend_string *child_prototype = zend_get_function_declaration(child);
-		zend_error(E_WARNING, "Declaration of %s should be compatible with %s", ZSTR_VAL(child_prototype), ZSTR_VAL(method_prototype));
+
+		if (child->common.prototype && (
+			child->common.prototype->common.fn_flags & ZEND_ACC_ABSTRACT
+		)) {
+			error_level = E_COMPILE_ERROR;
+			error_verb = "must";
+		} else if ((parent->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE) &&
+                   (!(child->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE) ||
+		            !zend_do_perform_type_hint_check(child, child->common.arg_info - 1, parent, parent->common.arg_info - 1))) {
+			error_level = E_COMPILE_ERROR;
+			error_verb = "must";
+		} else {
+			error_level = E_WARNING;
+			error_verb = "should";
+		}
+		zend_error(error_level, "Declaration of %s %s be compatible with %s", ZSTR_VAL(child_prototype), error_verb, ZSTR_VAL(method_prototype));
 		zend_string_free(child_prototype);
 		zend_string_free(method_prototype);
 	}
@@ -636,7 +660,8 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
 				int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
 				int child_num = OBJ_PROP_TO_NUM(child_info->offset);

-				zval_ptr_dtor(&(ce->default_properties_table[parent_num]));
+				/* Don't keep default properties in GC (thry may be freed by opcache) */
+				zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
 				ce->default_properties_table[parent_num] = ce->default_properties_table[child_num];
 				ZVAL_UNDEF(&ce->default_properties_table[child_num]);
 				child_info->offset = parent_info->offset;
@@ -272,7 +272,7 @@ reserved_non_modifiers:
 	| T_THROW | T_USE | T_INSTEADOF | T_GLOBAL | T_VAR | T_UNSET | T_ISSET | T_EMPTY | T_CONTINUE | T_GOTO
 	| T_FUNCTION | T_CONST | T_RETURN | T_PRINT | T_YIELD | T_LIST | T_SWITCH | T_ENDSWITCH | T_CASE | T_DEFAULT | T_BREAK
 	| T_ARRAY | T_CALLABLE | T_EXTENDS | T_IMPLEMENTS | T_NAMESPACE | T_TRAIT | T_INTERFACE | T_CLASS
-	| T_CLASS_C | T_TRAIT_C | T_FUNC_C | T_METHOD_C | T_LINE | T_FILE | T_DIR | T_NS_C | T_HALT_COMPILER
+	| T_CLASS_C | T_TRAIT_C | T_FUNC_C | T_METHOD_C | T_LINE | T_FILE | T_DIR | T_NS_C
 ;

 semi_reserved:
@@ -63,7 +63,6 @@ typedef struct _zend_heredoc_label {
 } zend_heredoc_label;

 BEGIN_EXTERN_C()
-int zend_compare_file_handles(zend_file_handle *fh1, zend_file_handle *fh2);
 ZEND_API void zend_save_lexical_state(zend_lex_state *lex_state);
 ZEND_API void zend_restore_lexical_state(zend_lex_state *lex_state);
 ZEND_API int zend_prepare_string_for_scanning(zval *str, char *filename);
@@ -552,6 +552,31 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 		goto exit;
 	}

+	/* magic isset */
+	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
+		zval tmp_object, tmp_result;
+		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+
+		if (!((*guard) & IN_ISSET)) {
+			ZVAL_COPY(&tmp_object, object);
+			ZVAL_UNDEF(&tmp_result);
+
+			*guard |= IN_ISSET;
+			zend_std_call_issetter(&tmp_object, member, &tmp_result);
+			*guard &= ~IN_ISSET;
+	
+			if (!zend_is_true(&tmp_result)) {
+				retval = &EG(uninitialized_zval);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_result);
+				goto exit;
+			}
+
+			zval_ptr_dtor(&tmp_object);
+			zval_ptr_dtor(&tmp_result);
+		}
+	}
+
 	/* magic get */
 	if (zobj->ce->__get) {
 		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
@@ -710,13 +735,26 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 	zval tmp;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
-		if(offset == NULL) {
+		if (offset == NULL) {
 			/* [] construct */
-			ZVAL_UNDEF(&tmp);
+			ZVAL_NULL(&tmp);
 			offset = &tmp;
 		} else {
 			SEPARATE_ARG_IF_REF(offset);
 		}
+
+		if (type == BP_VAR_IS) {
+			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
+			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
+				return NULL;
+			}
+			if (!i_zend_is_true(rv)) {
+				zval_ptr_dtor(rv);
+				return &EG(uninitialized_zval);
+			}
+			zval_ptr_dtor(rv);
+		}
+
 		zend_call_method_with_1_params(object, ce, NULL, "offsetget", rv, offset);

 		zval_ptr_dtor(offset);
@@ -1030,6 +1068,7 @@ ZEND_API int zend_check_protected(zend_class_entry *ce, zend_class_entry *scope)

 ZEND_API zend_function *zend_get_call_trampoline_func(zend_class_entry *ce, zend_string *method_name, int is_static) /* {{{ */
 {
+	size_t mname_len;
 	zend_op_array *func;
 	zend_function *fbc = is_static ? ce->__callstatic : ce->__call;

@@ -1062,8 +1101,8 @@ ZEND_API zend_function *zend_get_call_trampoline_func(zend_class_entry *ce, zend

 	//??? keep compatibility for "\0" characters
 	//??? see: Zend/tests/bug46238.phpt
-	if (UNEXPECTED(strlen(ZSTR_VAL(method_name)) != ZSTR_LEN(method_name))) {
-		func->function_name = zend_string_init(ZSTR_VAL(method_name), strlen(ZSTR_VAL(method_name)), 0);
+	if (UNEXPECTED((mname_len = strlen(ZSTR_VAL(method_name))) != ZSTR_LEN(method_name))) {
+		func->function_name = zend_string_init(ZSTR_VAL(method_name), mname_len, 0);
 	} else {
 		func->function_name = zend_string_copy(method_name);
 	}
@@ -44,12 +44,9 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
 ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 {
 	if (objects->top > 1) {
-		zend_object **obj_ptr = objects->object_buckets + 1;
-		zend_object **end = objects->object_buckets + objects->top;
-
-		do {
-			zend_object *obj = *obj_ptr;
-
+		uint32_t i;
+		for (i = 1; i < objects->top; i++) {
+			zend_object *obj = objects->object_buckets[i];
 			if (IS_OBJ_VALID(obj)) {
 				if (!(GC_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
 					GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED;
@@ -58,8 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 					GC_REFCOUNT(obj)--;
 				}
 			}
-			obj_ptr++;
-		} while (obj_ptr != end);
+		}
 	}
 }

@@ -597,7 +597,9 @@ try_again:
 					if (obj_ht) {
 						zval arr;

-						if (!Z_OBJCE_P(op)->default_properties_count && obj_ht == Z_OBJ_P(op)->properties) {
+						if (!Z_OBJCE_P(op)->default_properties_count &&
+							obj_ht == Z_OBJ_P(op)->properties &&
+							!ZEND_HASH_GET_APPLY_COUNT(Z_OBJ_P(op)->properties)) {
 							/* fast copy */
 							if (EXPECTED(Z_OBJ_P(op)->handlers == &std_object_handlers)) {
 								ZVAL_ARR(&arr, obj_ht);
@@ -2925,6 +2927,9 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 		if (i == needle_len) {
 			return p;
 		}
+		if (UNEXPECTED(p == end)) {
+			return NULL;
+		}
 		p += td[(unsigned char)(p[needle_len])];
 	}

@@ -4416,7 +4416,7 @@ ZEND_API double zend_hex_strtod(const char *str, const char **endptr)
 	int any = 0;
 	double value = 0;

-	if (strlen(str) < 2) {
+	if (s[0] == '\0' || s[1] == '\0') {
 		if (endptr != NULL) {
 			*endptr = str;
 		}
@@ -4456,7 +4456,7 @@ ZEND_API double zend_oct_strtod(const char *str, const char **endptr)
 	double value = 0;
 	int any = 0;

-	if (strlen(str) < 1) {
+	if (str[0] == '\0') {
 		if (endptr != NULL) {
 			*endptr = str;
 		}
@@ -4491,7 +4491,7 @@ ZEND_API double zend_bin_strtod(const char *str, const char **endptr)
 	double 		value = 0;
 	int 		any = 0;

-	if (strlen(str) < 2) {
+	if (str[0] == '\0' || str[1] == '\0') {
 		if (endptr != NULL) {
 			*endptr = str;
 		}
@@ -915,6 +915,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i

 			pbuffer = (REPARSE_DATA_BUFFER *)do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
 			if (pbuffer == NULL) {
+				CloseHandle(hLink);
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
@@ -1186,7 +1187,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	int add_slash;
 	void *tmp;

-	if (path_length == 0 || path_length >= MAXPATHLEN-1) {
+	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
 #ifdef ZEND_WIN32
 		_set_errno(EINVAL);
 #else
@@ -744,13 +744,18 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMPVAR|
 		/* here we are sure we are dealing with an object */
 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_NULL(EX_VAR(opline->result.var));
+				}
+			} else {
+				ZVAL_DEREF(zptr);
+				SEPARATE_ZVAL_NOREF(zptr);

-			ZVAL_DEREF(zptr);
-			SEPARATE_ZVAL_NOREF(zptr);
-
-			binary_op(zptr, zptr, value);
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_COPY(EX_VAR(opline->result.var), zptr);
+				binary_op(zptr, zptr, value);
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_COPY(EX_VAR(opline->result.var), zptr);
+				}
 			}
 		} else {
 			zend_assign_op_overloaded_property(object, property, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), value, binary_op, (UNEXPECTED(RETURN_VALUE_USED(opline)) ? EX_VAR(opline->result.var) : NULL));
@@ -1150,28 +1155,32 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMPVAR|C
 		}

 		/* here we are sure we are dealing with an object */
-
 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
-
-			if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
-				if (inc) {
-					fast_long_increment_function(zptr);
-				} else {
-					fast_long_decrement_function(zptr);
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_NULL(EX_VAR(opline->result.var));
 				}
 			} else {
-				ZVAL_DEREF(zptr);
-				SEPARATE_ZVAL_NOREF(zptr);
-
-				if (inc) {
-					increment_function(zptr);
+				if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
+					if (inc) {
+						fast_long_increment_function(zptr);
+					} else {
+						fast_long_decrement_function(zptr);
+					}
 				} else {
-					decrement_function(zptr);
+					ZVAL_DEREF(zptr);
+					SEPARATE_ZVAL_NOREF(zptr);
+
+					if (inc) {
+						increment_function(zptr);
+					} else {
+						decrement_function(zptr);
+					}
+				}
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_COPY(EX_VAR(opline->result.var), zptr);
 				}
-			}
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_COPY(EX_VAR(opline->result.var), zptr);
 			}
 		} else {
 			zend_pre_incdec_overloaded_property(object, property, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), inc, (UNEXPECTED(RETURN_VALUE_USED(opline)) ? EX_VAR(opline->result.var) : NULL));
@@ -1232,22 +1241,25 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMPVAR|

 		if (EXPECTED(Z_OBJ_HT_P(object)->get_property_ptr_ptr)
 			&& EXPECTED((zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL))) != NULL)) {
-
-			if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
-				ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
-				if (inc) {
-					fast_long_increment_function(zptr);
-				} else {
-					fast_long_decrement_function(zptr);
-				}
+			if (UNEXPECTED(zptr == &EG(error_zval))) {
+				ZVAL_NULL(EX_VAR(opline->result.var));
 			} else {
-				ZVAL_DEREF(zptr);
-				ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
-				zval_opt_copy_ctor(zptr);
-				if (inc) {
-					increment_function(zptr);
+				if (EXPECTED(Z_TYPE_P(zptr) == IS_LONG)) {
+					ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
+					if (inc) {
+						fast_long_increment_function(zptr);
+					} else {
+						fast_long_decrement_function(zptr);
+					}
 				} else {
-					decrement_function(zptr);
+					ZVAL_DEREF(zptr);
+					ZVAL_COPY_VALUE(EX_VAR(opline->result.var), zptr);
+					zval_opt_copy_ctor(zptr);
+					if (inc) {
+						increment_function(zptr);
+					} else {
+						decrement_function(zptr);
+					}
 				}
 			}
 		} else {
@@ -4287,27 +4299,24 @@ ZEND_VM_HANDLER(106, ZEND_SEND_VAR_NO_REF, VAR, ANY)

 	varptr = GET_OP1_ZVAL_PTR(BP_VAR_R);

-	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
-	     (Z_VAR_FLAGS_P(varptr) & IS_VAR_RET_REF)) &&
-	    (Z_ISREF_P(varptr) || Z_TYPE_P(varptr) == IS_OBJECT)) {
+	if (EXPECTED(Z_ISREF_P(varptr) ||
+	    ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
+	     (opline->extended_value & ZEND_ARG_SEND_SILENT) :
+	     ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num
+	    )))) {
+		arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+		ZVAL_COPY_VALUE(arg, varptr);

-		ZVAL_MAKE_REF(varptr);
-	} else {
-		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
-			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
-			!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {
-			SAVE_OPLINE();
-			zend_error(E_NOTICE, "Only variables should be passed by reference");
-			arg = ZEND_CALL_VAR(EX(call), opline->result.var);
-			ZVAL_COPY_VALUE(arg, varptr);
-			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-		}
+		ZEND_VM_NEXT_OPCODE();
 	}

+	SAVE_OPLINE();
+	zend_error(E_NOTICE, "Only variables should be passed by reference");
+
 	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
 	ZVAL_COPY_VALUE(arg, varptr);

-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

 ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
@@ -4413,7 +4422,7 @@ ZEND_VM_C_LABEL(send_again):

 		zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, zend_hash_num_elements(ht));

-		if (OP1_TYPE != IS_CONST && OP1_TYPE != IS_TMP_VAR && Z_IMMUTABLE_P(args)) {
+		if ((OP1_TYPE & (IS_VAR|IS_CV)) && Z_REFCOUNT_P(args) > 1) {
 			uint32_t i;
 			int separate = 0;

@@ -4425,7 +4434,7 @@ ZEND_VM_C_LABEL(send_again):
 				}
 			}
 			if (separate) {
-				zval_copy_ctor(args);
+				SEPARATE_ARRAY(args);
 				ht = Z_ARRVAL_P(args);
 			}
 		}
@@ -4439,7 +4448,7 @@ ZEND_VM_C_LABEL(send_again):

 			top = ZEND_CALL_ARG(EX(call), arg_num);
 			if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
-				if (!Z_IMMUTABLE_P(args)) {
+				if (Z_REFCOUNT_P(args) == 1) {
 					ZVAL_MAKE_REF(arg);
 					Z_ADDREF_P(arg);
 					ZVAL_REF(top, Z_REF_P(arg));
@@ -4582,6 +4591,7 @@ ZEND_VM_HANDLER(119, ZEND_SEND_ARRAY, ANY, ANY)
 		EX(call)->func = (zend_function*)&zend_pass_function;
 		EX(call)->called_scope = NULL;
 		Z_OBJ(EX(call)->This) = NULL;
+		ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
 	} else {
 		uint32_t arg_num;
 		HashTable *ht;
@@ -4591,22 +4601,6 @@ ZEND_VM_C_LABEL(send_array):
 		ht = Z_ARRVAL_P(args);
 		zend_vm_stack_extend_call_frame(&EX(call), 0, zend_hash_num_elements(ht));

-		if (OP1_TYPE != IS_CONST && OP1_TYPE != IS_TMP_VAR && Z_IMMUTABLE_P(args)) {
-			int separate = 0;
-
-			/* check if any of arguments are going to be passed by reference */
-			for (arg_num = 0; arg_num < zend_hash_num_elements(ht); arg_num++) {
-				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num + 1)) {
-					separate = 1;
-					break;
-				}
-			}
-			if (separate) {
-				zval_copy_ctor(args);
-				ht = Z_ARRVAL_P(args);
-			}
-		}
-
 		arg_num = 1;
 		param = ZEND_CALL_ARG(EX(call), 1);
 		ZEND_HASH_FOREACH_VAL(ht, arg) {
@@ -4629,24 +4623,18 @@ ZEND_VM_C_LABEL(send_array):
 						EX(call)->func = (zend_function*)&zend_pass_function;
 						EX(call)->called_scope = NULL;
 						Z_OBJ(EX(call)->This) = NULL;
-
+						ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
 						break;
 					}
-
-					ZVAL_NEW_REF(arg, arg);
 				}
-				Z_ADDREF_P(arg);
-			} else{
+			} else {
 				if (Z_ISREF_P(arg) &&
 				    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
 					/* don't separate references for __call */
 					arg = Z_REFVAL_P(arg);
 				}
-				if (Z_OPT_REFCOUNTED_P(arg)) {
-					Z_ADDREF_P(arg);
-				}
 			}
-			ZVAL_COPY_VALUE(param, arg);
+			ZVAL_COPY(param, arg);
 			ZEND_CALL_NUM_ARGS(EX(call))++;
 			arg_num++;
 			param++;
@@ -4666,46 +4654,35 @@ ZEND_VM_HANDLER(120, ZEND_SEND_USER, VAR|CV, ANY)
 	arg = GET_OP1_ZVAL_PTR(BP_VAR_R);
 	param = ZEND_CALL_VAR(EX(call), opline->result.var);

-	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {
-		if (UNEXPECTED(!Z_ISREF_P(arg))) {
+	if (UNEXPECTED(ARG_MUST_BE_SENT_BY_REF(EX(call)->func, opline->op2.num))) {
+		zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
+			opline->op2.num,
+			EX(call)->func->common.scope ? ZSTR_VAL(EX(call)->func->common.scope->name) : "",
+			EX(call)->func->common.scope ? "::" : "",
+			ZSTR_VAL(EX(call)->func->common.function_name));

-			if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, opline->op2.num)) {
-
-				zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
-					opline->op2.num,
-					EX(call)->func->common.scope ? ZSTR_VAL(EX(call)->func->common.scope->name) : "",
-					EX(call)->func->common.scope ? "::" : "",
-					ZSTR_VAL(EX(call)->func->common.function_name));
-
-				if (ZEND_CALL_INFO(EX(call)) & ZEND_CALL_CLOSURE) {
-					OBJ_RELEASE((zend_object*)EX(call)->func->common.prototype);
-				}
-				if (Z_OBJ(EX(call)->This)) {
-					OBJ_RELEASE(Z_OBJ(EX(call)->This));
-				}
-				ZVAL_UNDEF(param);
-				EX(call)->func = (zend_function*)&zend_pass_function;
-				EX(call)->called_scope = NULL;
-				Z_OBJ(EX(call)->This) = NULL;
-
-				FREE_OP1();
-				ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-			}
-
-			ZVAL_NEW_REF(arg, arg);
+		if (ZEND_CALL_INFO(EX(call)) & ZEND_CALL_CLOSURE) {
+			OBJ_RELEASE((zend_object*)EX(call)->func->common.prototype);
 		}
-		Z_ADDREF_P(arg);
+		if (Z_OBJ(EX(call)->This)) {
+			OBJ_RELEASE(Z_OBJ(EX(call)->This));
+		}
+		ZVAL_UNDEF(param);
+		EX(call)->func = (zend_function*)&zend_pass_function;
+		EX(call)->called_scope = NULL;
+		Z_OBJ(EX(call)->This) = NULL;
+		ZEND_SET_CALL_INFO(EX(call), ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
+
+		FREE_OP1();
+		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	} else {
 		if (Z_ISREF_P(arg) &&
 		    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
 			/* don't separate references for __call */
 			arg = Z_REFVAL_P(arg);
 		}
-		if (Z_OPT_REFCOUNTED_P(arg)) {
-			Z_ADDREF_P(arg);
-		}
 	}
-	ZVAL_COPY_VALUE(param, arg);
+	ZVAL_COPY(param, arg);

 	FREE_OP1();
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -4724,7 +4701,7 @@ ZEND_VM_HANDLER(63, ZEND_RECV, ANY, ANY)
 		zval *param = _get_zval_ptr_cv_undef_BP_VAR_W(execute_data, opline->result.var);

 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num)))) {
+		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num)) || EG(exception))) {
 			HANDLE_EXCEPTION();
 		}
 	}
@@ -4762,7 +4739,7 @@ ZEND_VM_HANDLER(64, ZEND_RECV_INIT, ANY, CONST)
 		zval *default_value = EX_CONSTANT(opline->op2);

 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, default_value, CACHE_ADDR(Z_CACHE_SLOT_P(default_value))))) {
+		if (UNEXPECTED(!zend_verify_arg_type(EX(func), arg_num, param, default_value, CACHE_ADDR(Z_CACHE_SLOT_P(default_value))) || EG(exception))) {
 			HANDLE_EXCEPTION();
 		}
 	}
@@ -4891,7 +4868,7 @@ ZEND_VM_HANDLER(48, ZEND_CASE, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	SAVE_OPLINE();
 	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
 		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-	} else if ((OP1_TYPE & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+	} else if ((OP1_TYPE & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
 		/* Don't keep lock on reference, lock the value instead */
 		if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
 			ZVAL_UNREF(op1);
@@ -6766,9 +6743,10 @@ ZEND_VM_HANDLER(152, ZEND_JMP_SET, CONST|TMP|VAR|CV, ANY)
 		} else if (OP1_TYPE == IS_VAR && ref) {
 			zend_reference *r = Z_REF_P(ref);

-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 			if (UNEXPECTED(--GC_REFCOUNT(r) == 0)) {
 				efree_size(r, sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(value)) {
+				Z_ADDREF_P(value);
 			}
 		}
 		ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
@@ -6806,9 +6784,10 @@ ZEND_VM_HANDLER(169, ZEND_COALESCE, CONST|TMP|VAR|CV, ANY)
 		} else if (OP1_TYPE == IS_VAR && ref) {
 			zend_reference *r = Z_REF_P(ref);

-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 			if (UNEXPECTED(--GC_REFCOUNT(r) == 0)) {
 				efree_size(r, sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(value)) {
+				Z_ADDREF_P(value);
 			}
 		}
 		ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
@@ -6823,30 +6802,36 @@ ZEND_VM_HANDLER(22, ZEND_QM_ASSIGN, CONST|TMP|VAR|CV, ANY)
 	USE_OPLINE
 	zend_free_op free_op1;
 	zval *value;
+	zval *result = EX_VAR(opline->result.var);

 	value = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
 	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
 		SAVE_OPLINE();
 		GET_OP1_UNDEF_CV(value, BP_VAR_R);
-		ZVAL_NULL(EX_VAR(opline->result.var));
+		ZVAL_NULL(result);
 		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}

-	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && Z_ISREF_P(value)) {
-		ZVAL_COPY(EX_VAR(opline->result.var), Z_REFVAL_P(value));
-		if (OP1_TYPE == IS_VAR) {
+	if (OP1_TYPE == IS_CV) {
+		ZVAL_DEREF(value);
+		ZVAL_COPY(result, value);
+	} else if (OP1_TYPE == IS_VAR) {
+		if (UNEXPECTED(Z_ISREF_P(value))) {
+			ZVAL_COPY_VALUE(result, Z_REFVAL_P(value));
 			if (UNEXPECTED(Z_DELREF_P(value) == 0)) {
 				efree_size(Z_REF_P(value), sizeof(zend_reference));
+			} else if (Z_OPT_REFCOUNTED_P(result)) {
+				Z_ADDREF_P(result);
 			}
+		} else {
+			ZVAL_COPY_VALUE(result, value);
 		}
 	} else {
-		ZVAL_COPY_VALUE(EX_VAR(opline->result.var), value);
+		ZVAL_COPY_VALUE(result, value);
 		if (OP1_TYPE == IS_CONST) {
 			if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
-				zval_copy_ctor_func(EX_VAR(opline->result.var));
+				zval_copy_ctor_func(result);
 			}
-		} else if (OP1_TYPE == IS_CV) {
-			if (Z_OPT_REFCOUNTED_P(value)) Z_ADDREF_P(value);
 		}
 	}
 	ZEND_VM_NEXT_OPCODE();
@@ -7289,11 +7274,12 @@ ZEND_VM_HANDLER(156, ZEND_SEPARATE, VAR, UNUSED)
 	if (UNEXPECTED(Z_ISREF_P(var_ptr))) {
 		if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) {
 			ZVAL_UNREF(var_ptr);
+		} else if (!(Z_VAR_FLAGS_P(var_ptr) & IS_VAR_RET_REF)) {
+			Z_DELREF_P(var_ptr);
+			ZVAL_COPY(var_ptr, Z_REFVAL_P(var_ptr));
 		}
-	} else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) {
-		Z_DELREF_P(var_ptr);
-		ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr);
 	}
+
 	ZEND_VM_NEXT_OPCODE();
 }

@@ -7451,6 +7437,12 @@ ZEND_VM_HANDLER(142, ZEND_YIELD_FROM, CONST|TMP|VAR|CV, ANY)
 	SAVE_OPLINE();
 	val = GET_OP1_ZVAL_PTR_DEREF(BP_VAR_R);

+	if (UNEXPECTED(generator->flags & ZEND_GENERATOR_FORCED_CLOSE)) {
+		zend_throw_error(NULL, "Cannot use \"yield from\" in a force-closed generator");
+		FREE_OP1();
+		HANDLE_EXCEPTION();
+	}
+
 	if (Z_TYPE_P(val) == IS_ARRAY) {
 		ZVAL_COPY_VALUE(&generator->values, val);
 		if (OP1_TYPE != IS_TMP_VAR && Z_OPT_REFCOUNTED_P(val)) {
@@ -2672,10 +2672,14 @@ AC_DEFUN([PHP_CONFIG_NICE],[

 EOF

+  clean_configure_args=$ac_configure_args
  for var in CFLAGS CXXFLAGS CPPFLAGS LDFLAGS EXTRA_LDFLAGS_PROGRAM LIBS CC CXX; do
    eval val=\$$var
    if test -n "$val"; then
      echo "$var='$val' \\" >> $1
+      if test `expr "X$ac_configure_args" : ".*${var}.*"` != 0; then
+        clean_configure_args=$(echo $clean_configure_args | sed -e "s/'$var=$val'//")
+      fi
    fi
  done

@@ -2685,7 +2689,8 @@ EOF
  else 
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND [$]0"
  fi
-  for arg in $ac_configure_args; do
+
+  for arg in $clean_configure_args; do
    if test `expr -- $arg : "'.*"` = 0; then
      if test `expr -- $arg : "-.*"` = 0 && test `expr -- $arg : ".*=.*"` = 0; then
        continue;
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=5
-PHP_EXTRA_VERSION="RC1"
+PHP_RELEASE_VERSION=9
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -207,6 +207,21 @@ static void php_str2num(bc_num *num, char *str)
 }
 /* }}} */

+/* {{{ split_bc_num
+   Convert to bc_num detecting scale */
+static bc_num split_bc_num(bc_num num) {
+	bc_num newnum;
+	if (num->n_refs >= 1) {
+		return num;
+	}
+	newnum = _bc_new_num_ex(0, 0, 0);
+	*newnum = *num;
+	newnum->n_refs = 1;
+	num->n_refs--;
+	return newnum;
+}
+/* }}} */
+
 /* {{{ proto string bcadd(string left_operand, string right_operand [, int scale])
   Returns the sum of two arbitrary precision numbers */
 PHP_FUNCTION(bcadd)
@@ -233,6 +248,7 @@ PHP_FUNCTION(bcadd)
 	bc_add (first, second, &result, scale);

 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -270,6 +286,7 @@ PHP_FUNCTION(bcsub)
 	bc_sub (first, second, &result, scale);

 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -307,6 +324,7 @@ PHP_FUNCTION(bcmul)
 	bc_multiply (first, second, &result, scale);

 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -345,6 +363,7 @@ PHP_FUNCTION(bcdiv)
 	switch (bc_divide(first, second, &result, scale)) {
 		case 0: /* OK */
 			if (result->n_scale > scale) {
+				result = split_bc_num(result);
 				result->n_scale = scale;
 			}
 			RETVAL_STR(bc_num2str(result));
@@ -420,8 +439,9 @@ PHP_FUNCTION(bcpowmod)
 	scale_int = (int) ((int)scale < 0 ? 0 : scale);

 	if (bc_raisemod(first, second, mod, &result, scale_int) != -1) {
-		if (result->n_scale > scale) {
-			result->n_scale = (int)scale;
+		if (result->n_scale > scale_int) {
+			result = split_bc_num(result);
+			result->n_scale = scale_int;
 		}
 		RETVAL_STR(bc_num2str(result));
 	} else {
@@ -462,6 +482,7 @@ PHP_FUNCTION(bcpow)
 	bc_raise (first, second, &result, scale);

 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -496,6 +517,7 @@ PHP_FUNCTION(bcsqrt)

 	if (bc_sqrt (&result, scale) != 0) {
 		if (result->n_scale > scale) {
+			result = split_bc_num(result);
 			result->n_scale = scale;
 		}
 		RETVAL_STR(bc_num2str(result));
@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+string(3) "0.0"
+bc math warning: non-zero scale in exponent
@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+bc math warning: non-zero scale in exponent
+string(3) "0.0"
@@ -148,7 +148,11 @@ static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count)
 		just_read = BZ2_bzread(self->bz_file, buf, to_read);

 		if (just_read < 1) {
-			stream->eof = 0 == just_read;
+			/* it is not safe to keep reading after an error, see #72613 */
+			stream->eof = 1;
+			if (just_read < 0) {
+				return -1;
+			}
 			break;
 		}

@@ -0,0 +1,15 @@
+--TEST--
+Bug #72447: Type Confusion in php_bz2_filter_create()
+--SKIPIF--
+<?php if (!extension_loaded("bz2")) print "skip"; ?>
+--FILE--
+<?php
+$input = "AAAAAAAA";
+$param = array('blocks' => $input);
+
+$fp = fopen('testfile', 'w');
+stream_filter_append($fp, 'bzip2.compress', STREAM_FILTER_WRITE, $param);
+fclose($fp);
+?>
+--EXPECTF--
+Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate. (0) in %s%ebug72447.php on line %d
@@ -0,0 +1,23 @@
+--TEST--
+Bug #72613 (Inadequate error handling in bzread())
+--SKIPIF--
+<?php if (!extension_loaded("bz2")) print "skip"; ?>
+--FILE--
+<?php
+$fp = bzopen(__DIR__.'/72613.bz2', 'r');
+if ($fp === FALSE) {
+    exit("ERROR: bzopen()");
+}
+$data = "";
+while (!feof($fp)) {
+    $res = bzread($fp);
+    if ($res === FALSE) {
+        exit("ERROR: bzread()");
+    }
+    $data .= $res;
+}
+bzclose($fp);
+?>
+DONE
+--EXPECT--
+DONE
@@ -1007,6 +1007,13 @@ PHP_FUNCTION(variant_date_from_timestamp)
 	tzset();
 	ttstamp = timestamp;
 	tmv = localtime(&ttstamp);
+#if ZEND_ENABLE_ZVAL_LONG64
+	/* Invalid after 23:59:59, December 31, 3000, UTC */
+	if (!tmv) {
+		php_error_docref(NULL, E_WARNING, "Invalid timestamp " ZEND_LONG_FMT, timestamp);
+		RETURN_FALSE;
+	}
+#endif
 	memset(&systime, 0, sizeof(systime));

 	systime.wDay = tmv->tm_mday;
@@ -0,0 +1,16 @@
+--TEST--
+Bug #72498 variant_date_from_timestamp null dereference
+--SKIPIF--
+<?php # vim:ft=php
+if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present";
+if (PHP_INT_SIZE != 8) print  "skip 64-bit only";
+?>
+--FILE--
+<?php
+
+$v1 = PHP_INT_MAX;
+var_dump(variant_date_from_timestamp($v1));
+?>
+--EXPECTF--
+Warning: variant_date_from_timestamp(): Invalid timestamp %d in %sbug72498.php on line %d
+bool(false)
@@ -567,6 +567,13 @@ PHP_MINFO_FUNCTION(curl)
 #endif
 #if LIBCURL_VERSION_NUM >= 0x072600 /* 7.38.0 */
 			{"GSSAPI", CURL_VERSION_GSSAPI},
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072800 /* 7.40.0 */
+			{"KERBEROS5", CURL_VERSION_KERBEROS5},
+			{"UNIX_SOCKETS", CURL_VERSION_UNIX_SOCKETS},
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072f00 /* 7.47.0 */
+			{"PSL", CURL_VERSION_PSL},
 #endif
 			{NULL, 0}
 		};
@@ -847,11 +854,6 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4);
 	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5);

-#if LIBCURL_VERSION_NUM >= 0x071200 /* Available since 7.18.0 */
-	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4A);
-	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5_HOSTNAME);
-#endif
-
 	/* Curl Share constants */
 	REGISTER_CURL_CONSTANT(CURLSHOPT_NONE);
 	REGISTER_CURL_CONSTANT(CURLSHOPT_SHARE);
@@ -860,9 +862,6 @@ PHP_MINIT_FUNCTION(curl)
 	/* Curl Http Version constants (CURLOPT_HTTP_VERSION) */
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_0);
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_1);
-#if LIBCURL_VERSION_NUM >= 0x072100 /* 7.33.0 */
-	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2_0);
-#endif
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_NONE);

 	/* Curl Lock constants */
@@ -892,9 +891,6 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_VERSION_KERBEROS4);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_LIBZ);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_SSL);
-#if LIBCURL_VERSION_NUM >= 0x072100 /* 7.33.0 */
-	REGISTER_CURL_CONSTANT(CURL_VERSION_HTTP2);
-#endif

 #if LIBCURL_VERSION_NUM >= 0x070a06 /* Available since 7.10.6 */
 	REGISTER_CURL_CONSTANT(CURLOPT_HTTPAUTH);
@@ -999,6 +995,7 @@ PHP_MINIT_FUNCTION(curl)
 #endif

 #if LIBCURL_VERSION_NUM >= 0x071000 /* Available since 7.16.0 */
+	REGISTER_CURL_CONSTANT(CURLE_SSL_CACERT_BADFILE);
 	REGISTER_CURL_CONSTANT(CURLOPT_SSL_SESSIONID_CACHE);
 	REGISTER_CURL_CONSTANT(CURLMOPT_PIPELINING);
 #endif
@@ -1056,6 +1053,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLPAUSE_SEND_CONT);
 	REGISTER_CURL_CONSTANT(CURL_READFUNC_PAUSE);
 	REGISTER_CURL_CONSTANT(CURL_WRITEFUNC_PAUSE);
+
+	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4A);
+	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5_HOSTNAME);
 #endif

 #if LIBCURL_VERSION_NUM >= 0x071202 /* Available since 7.18.2 */
@@ -1088,6 +1088,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLOPT_PROXYPASSWORD);
 	REGISTER_CURL_CONSTANT(CURLOPT_PROXYUSERNAME);
 	REGISTER_CURL_CONSTANT(CURLOPT_USERNAME);
+	REGISTER_CURL_CONSTANT(CURL_REDIR_POST_301);
+	REGISTER_CURL_CONSTANT(CURL_REDIR_POST_302);
+	REGISTER_CURL_CONSTANT(CURL_REDIR_POST_ALL);
 #endif

 #if LIBCURL_VERSION_NUM >= 0x071303 /* Available since 7.19.3 */
@@ -1117,6 +1120,12 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLPROTO_SFTP);
 	REGISTER_CURL_CONSTANT(CURLPROTO_TELNET);
 	REGISTER_CURL_CONSTANT(CURLPROTO_TFTP);
+
+	REGISTER_CURL_CONSTANT(CURLPROXY_HTTP_1_0);
+
+	REGISTER_CURL_CONSTANT(CURLFTP_CREATE_DIR);
+	REGISTER_CURL_CONSTANT(CURLFTP_CREATE_DIR_NONE);
+	REGISTER_CURL_CONSTANT(CURLFTP_CREATE_DIR_RETRY);
 #endif

 #if LIBCURL_VERSION_NUM >= 0x071306 /* Available since 7.19.6 */
@@ -1152,8 +1161,8 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_PLAY);
 	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_RECEIVE);
 	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_RECORD);
-	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_SETUP);
 	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_SET_PARAMETER);
+	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_SETUP);
 	REGISTER_CURL_CONSTANT(CURL_RTSPREQ_TEARDOWN);
 #endif

@@ -1196,6 +1205,7 @@ PHP_MINIT_FUNCTION(curl)
 #endif

 #if LIBCURL_VERSION_NUM >= 0x071600 /* Available since 7.22.0 */
+	REGISTER_CURL_CONSTANT(CURLAUTH_NTLM_WB);
 	REGISTER_CURL_CONSTANT(CURLGSSAPI_DELEGATION_FLAG);
 	REGISTER_CURL_CONSTANT(CURLGSSAPI_DELEGATION_POLICY_FLAG);
 	REGISTER_CURL_CONSTANT(CURLOPT_GSSAPI_DELEGATION);
@@ -1215,18 +1225,119 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLSSLOPT_ALLOW_BEAST);
 #endif

+#if LIBCURL_VERSION_NUM >= 0x071901 /* Available since 7.25.1 */
+	REGISTER_CURL_CONSTANT(CURL_REDIR_POST_303);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x071c00 /* Available since 7.28.0 */
+	REGISTER_CURL_CONSTANT(CURLSSH_AUTH_AGENT);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x071e00 /* Available since 7.30.0 */
+	REGISTER_CURL_CONSTANT(CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE);
+	REGISTER_CURL_CONSTANT(CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE);
+	REGISTER_CURL_CONSTANT(CURLMOPT_MAX_HOST_CONNECTIONS);
+	REGISTER_CURL_CONSTANT(CURLMOPT_MAX_PIPELINE_LENGTH);
+	REGISTER_CURL_CONSTANT(CURLMOPT_MAX_TOTAL_CONNECTIONS);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x071f00 /* Available since 7.31.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_SASL_IR);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072100 /* Available since 7.33.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_DNS_INTERFACE);
+	REGISTER_CURL_CONSTANT(CURLOPT_DNS_LOCAL_IP4);
+	REGISTER_CURL_CONSTANT(CURLOPT_DNS_LOCAL_IP6);
+	REGISTER_CURL_CONSTANT(CURLOPT_XOAUTH2_BEARER);
+
+	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2_0);
+	REGISTER_CURL_CONSTANT(CURL_VERSION_HTTP2);
+#endif
+
 #if LIBCURL_VERSION_NUM >= 0x072200 /* Available since 7.34.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_LOGIN_OPTIONS);
+
 	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_0);
 	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_1);
 	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_2);
 #endif

-#if LIBCURL_VERSION_NUM >= 0x072B00 /* Available since 7.43.0 */
+#if LIBCURL_VERSION_NUM >= 0x072400 /* Available since 7.36.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_EXPECT_100_TIMEOUT_MS);
+	REGISTER_CURL_CONSTANT(CURLOPT_SSL_ENABLE_ALPN);
+	REGISTER_CURL_CONSTANT(CURLOPT_SSL_ENABLE_NPN);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072500 /* Available since 7.37.0 */
+	REGISTER_CURL_CONSTANT(CURLHEADER_SEPARATE);
+	REGISTER_CURL_CONSTANT(CURLHEADER_UNIFIED);
+	REGISTER_CURL_CONSTANT(CURLOPT_HEADEROPT);
+	REGISTER_CURL_CONSTANT(CURLOPT_PROXYHEADER);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072600 /* Available since 7.38.0 */
+	REGISTER_CURL_CONSTANT(CURLAUTH_NEGOTIATE);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072700 /* Available since 7.39.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_PINNEDPUBLICKEY);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072800 /* Available since 7.40.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_UNIX_SOCKET_PATH);
+
+	REGISTER_CURL_CONSTANT(CURLPROTO_SMB);
+	REGISTER_CURL_CONSTANT(CURLPROTO_SMBS);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072900 /* Available since 7.41.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_SSL_VERIFYSTATUS);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072a00 /* Available since 7.42.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_PATH_AS_IS);
+	REGISTER_CURL_CONSTANT(CURLOPT_SSL_FALSESTART);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072b00 /* Available since 7.43.0 */
+	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2);
+
+	REGISTER_CURL_CONSTANT(CURLOPT_PIPEWAIT);
+	REGISTER_CURL_CONSTANT(CURLOPT_PROXY_SERVICE_NAME);
+	REGISTER_CURL_CONSTANT(CURLOPT_SERVICE_NAME);
+
 	REGISTER_CURL_CONSTANT(CURLPIPE_NOTHING);
 	REGISTER_CURL_CONSTANT(CURLPIPE_HTTP1);
 	REGISTER_CURL_CONSTANT(CURLPIPE_MULTIPLEX);
 #endif

+#if LIBCURL_VERSION_NUM >= 0x072c00 /* Available since 7.44.0 */
+	REGISTER_CURL_CONSTANT(CURLSSLOPT_NO_REVOKE);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072d00 /* Available since 7.45.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_DEFAULT_PROTOCOL);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072e00 /* Available since 7.46.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_STREAM_WEIGHT);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x072f00 /* Available since 7.47.0 */
+	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2TLS);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x073000 /* Available since 7.48.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_TFTP_NO_OPTIONS);
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x073100 /* Available since 7.49.0 */
+	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE);
+	REGISTER_CURL_CONSTANT(CURLOPT_CONNECT_TO);
+	REGISTER_CURL_CONSTANT(CURLOPT_TCP_FASTOPEN);
+#endif
+
 #if CURLOPT_FTPASCII != 0
 	REGISTER_CURL_CONSTANT(CURLOPT_FTPASCII);
 #endif
@@ -2149,7 +2260,6 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 		case CURLOPT_CERTINFO:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
-		case CURLOPT_NOPROXY:
 		case CURLOPT_PROTOCOLS:
 		case CURLOPT_REDIR_PROTOCOLS:
 		case CURLOPT_SOCKS5_GSSAPI_NEC:
@@ -2179,6 +2289,36 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 		case CURLOPT_TCP_KEEPIDLE:
 		case CURLOPT_TCP_KEEPINTVL:
 #endif
+#if LIBCURL_VERSION_NUM >= 0x071f00 /* Available since 7.31.0 */
+		case CURLOPT_SASL_IR:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072400 /* Available since 7.36.0 */
+		case CURLOPT_EXPECT_100_TIMEOUT_MS:
+		case CURLOPT_SSL_ENABLE_ALPN:
+		case CURLOPT_SSL_ENABLE_NPN:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072500 /* Available since 7.37.0 */
+		case CURLOPT_HEADEROPT:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072900 /* Available since 7.41.0 */
+		case CURLOPT_SSL_VERIFYSTATUS:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072a00 /* Available since 7.42.0 */
+		case CURLOPT_PATH_AS_IS:
+		case CURLOPT_SSL_FALSESTART:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072b00 /* Available since 7.43.0 */
+		case CURLOPT_PIPEWAIT:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072e00 /* Available since 7.46.0 */
+		case CURLOPT_STREAM_WEIGHT:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x073000 /* Available since 7.48.0 */
+		case CURLOPT_TFTP_NO_OPTIONS:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x073100 /* Available since 7.49.0 */
+		case CURLOPT_TCP_FASTOPEN:
+#endif
 #if CURLOPT_MUTE != 0
 		case CURLOPT_MUTE:
 #endif
@@ -2240,6 +2380,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 		case CURLOPT_USERNAME:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
+		case CURLOPT_NOPROXY:
 		case CURLOPT_SOCKS5_GSSAPI_SERVICE:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071400 /* Available since 7.20.0 */
@@ -2262,6 +2403,19 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071900 /* Available since 7.25.0 */
 		case CURLOPT_MAIL_AUTH:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072200 /* Available since 7.34.0 */
+		case CURLOPT_LOGIN_OPTIONS:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072700 /* Available since 7.39.0 */
+		case CURLOPT_PINNEDPUBLICKEY:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072b00 /* Available since 7.43.0 */
+		case CURLOPT_PROXY_SERVICE_NAME:
+		case CURLOPT_SERVICE_NAME:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072d00 /* Available since 7.45.0 */
+		case CURLOPT_DEFAULT_PROTOCOL:
 #endif
 		{
 			zend_string *str = zval_get_string(zvalue);
@@ -2280,6 +2434,15 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 #if LIBCURL_VERSION_NUM >= 0x071400 /* Available since 7.20.0 */
 		case CURLOPT_RTSP_SESSION_ID:
 #endif
+#if LIBCURL_VERSION_NUM >= 0x072100 /* Available since 7.33.0 */
+		case CURLOPT_DNS_INTERFACE:
+		case CURLOPT_DNS_LOCAL_IP4:
+		case CURLOPT_DNS_LOCAL_IP6:
+		case CURLOPT_XOAUTH2_BEARER:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072800 /* Available since 7.40.0 */
+		case CURLOPT_UNIX_SOCKET_PATH:
+#endif
 #if LIBCURL_VERSION_NUM >= 0x071004 /* Available since 7.16.4 */
 		case CURLOPT_KRBLEVEL:
 #else
@@ -2424,6 +2587,12 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071503 /* Available since 7.21.3 */
 		case CURLOPT_RESOLVE:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072500 /* Available since 7.37.0 */
+		case CURLOPT_PROXYHEADER:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x073100 /* Available since 7.49.0 */
+		case CURLOPT_CONNECT_TO:
 #endif
 		{
 			zval *current;
@@ -2462,6 +2631,16 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 					case CURLOPT_RESOLVE:
 						name = "CURLOPT_RESOLVE";
 						break;
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072500 /* Available since 7.37.0 */
+					case CURLOPT_PROXYHEADER:
+						name = "CURLOPT_PROXYHEADER";
+						break;
+#endif
+#if LIBCURL_VERSION_NUM >= 0x073100 /* Available since 7.49.0 */
+					case CURLOPT_CONNECT_TO:
+						name = "CURLOPT_CONNECT_TO";
+						break;
 #endif
 				}
 				php_error_docref(NULL, E_WARNING, "You must pass either an object or an array with the %s argument", name);
@@ -3416,6 +3595,10 @@ PHP_FUNCTION(curl_unescape)
 		RETURN_FALSE;
 	}

+	if (str_len > INT_MAX) {
+		RETURN_FALSE;
+	}
+
 	if ((out = curl_easy_unescape(ch->cp, str, str_len, &out_len))) {
 		RETVAL_STRINGL(out, out_len);
 		curl_free(out);
@@ -416,6 +416,13 @@ static int _php_curl_multi_setopt(php_curlm *mh, zend_long option, zval *zvalue,
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071003 /* 7.16.3 */
 		case CURLMOPT_MAXCONNECTS:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x071e00 /* 7.30.0 */
+		case CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE:
+		case CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE:
+		case CURLMOPT_MAX_HOST_CONNECTIONS:
+		case CURLMOPT_MAX_PIPELINE_LENGTH:
+		case CURLMOPT_MAX_TOTAL_CONNECTIONS:
 #endif
 			error = curl_multi_setopt(mh->multi, option, zval_get_long(zvalue));
 			break;
@@ -8,13 +8,19 @@ include 'skipif.inc';
 --FILE--
 <?php

-$ch = curl_init('http://www.google.com/');
+include 'server.inc';
+$host = curl_cli_server_start();
+
+$url = "{$host}/get.php";
+
+$ch = curl_init($url);
 curl_setopt_array($ch, array(
 	CURLOPT_HEADER => false,
 	CURLOPT_RETURNTRANSFER => true,
 	CURLOPT_POST => true,
 	CURLOPT_INFILESIZE => 1,
 	CURLOPT_HTTPHEADER => array(
+		'Expect:',
 		'Content-Length: 1',
 	),
 	CURLOPT_READFUNCTION => 'curl_read',
@@ -7,8 +7,12 @@ include 'skipif.inc';
 ?>
 --FILE--
 <?php
+include 'server.inc';
+$host = curl_cli_server_start();

-$ch = curl_init('http://www.google.com/');
+$url = "{$host}/get.php";
+
+$ch = curl_init($url);
 curl_setopt_array($ch, array(
 	CURLOPT_HEADER => false,
 	CURLOPT_RETURNTRANSFER => true,
@@ -16,6 +20,7 @@ curl_setopt_array($ch, array(
 	CURLOPT_INFILESIZE => filesize(__FILE__),
 	CURLOPT_INFILE => fopen(__FILE__, 'r'),
 	CURLOPT_HTTPHEADER => array(
+		'Expect:',
 		'Content-Length: 1',
 	),
 	CURLOPT_READFUNCTION => 'curl_read',
@@ -42,6 +42,9 @@ SSPI => Yes
 TLS-SRP => No
 HTTP2 => No
 GSSAPI => No
+KERBEROS5 => Yes
+UNIX_SOCKETS => No
+PSL => No
 Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smtp, smtps, telnet, tftp
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
@@ -310,33 +310,33 @@ void timelib_dump_rel_time(timelib_rel_time *d)

 timelib_long timelib_parse_tz_cor(char **ptr)
 {
-        char *begin = *ptr, *end;
-        timelib_long  tmp;
+	char *begin = *ptr, *end;
+	timelib_long  tmp;

-        while (isdigit(**ptr) || **ptr == ':') {
-                ++*ptr;
-        }
-        end = *ptr;
-        switch (end - begin) {
-                case 1:
-                case 2:
-                        return HOUR(strtol(begin, NULL, 10));
-                        break;
-                case 3:
-                case 4:
-                        if (begin[1] == ':') {
-                                tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 2, NULL, 10);
-                                return tmp;
-                        } else if (begin[2] == ':') {
-                                tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
-                                return tmp;
-                        } else {
-                                tmp = strtol(begin, NULL, 10);
-                                return HOUR(tmp / 100) + tmp % 100;
-                        }
-                case 5:
-                        tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
-                        return tmp;
-        }
-        return 0;
+	while (isdigit(**ptr) || **ptr == ':') {
+		++*ptr;
+	}
+	end = *ptr;
+	switch (end - begin) {
+		case 1: /* H */
+		case 2: /* HH */
+			return HOUR(strtol(begin, NULL, 10));
+			break;
+		case 3: /* H:M */
+		case 4: /* H:MM, HH:M, HHMM */
+			if (begin[1] == ':') {
+				tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 2, NULL, 10);
+				return tmp;
+			} else if (begin[2] == ':') {
+				tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
+				return tmp;
+			} else {
+				tmp = strtol(begin, NULL, 10);
+				return HOUR(tmp / 100) + tmp % 100;
+			}
+		case 5: /* HH:MM */
+			tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
+			return tmp;
+	}
+	return 0;
 }
@@ -38,8 +38,8 @@
 # define timelib_free    free
 #endif

-#define TIMELIB_VERSION 201502
-#define TIMELIB_ASCII_VERSION "2015.02"
+#define TIMELIB_VERSION 201602
+#define TIMELIB_ASCII_VERSION "2016.02"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01