Update versions/dates for PHP 7.1.0RC3

Merge branch 'PHP-7.0' into PHP-7.1
Merge branch 'PHP-5.6' into PHP-7.0
2026-11-13 12:10:50 +00:00 · 2016-09-29 00:47:21 +00:00 · 2016-09-29 00:59:50 +02:00 · 2016-09-29 00:58:02 +02:00 · 2016-09-29 00:55:36 +02:00 · 2016-09-28 23:30:28 +01:00
358 changed files with 7921 additions and 5647 deletions
@@ -0,0 +1,16 @@
+; http://editorconfig.org/
+
+root = true
+
+[*.{c,h}]
+charset                  = UTF-8
+end_of_line              = LF
+indent_size              = 4
+indent_style             = tab
+insert_final_newline     = true
+tab_width                = 4
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size              = 2
+indent_style             = space
@@ -148,6 +148,7 @@ tests/*/*/*.sh
 */tests/*/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
+*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log
@@ -108,8 +108,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Unknown
-MAINTENANCE:         Odd fixes
+PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
+MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -1,6 +1,102 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 7.1.0RC1
+29 Sep 2016, PHP 7.1.0RC3
+
+- Core:
+  . Fixed bug #73156 (segfault on undefined function). (Dmitry)
+  . Fixed bug #73163 (PHP hangs if error handler throws while accessing undef
+    const in default value). (Nikita)
+  . Fixed bug #73172 (parse error: Invalid numeric literal). (Nikita, Anatol)
+  . Fixed bug #73181 (parse_str() without a second argument leads to crash).
+    (Nikita)
+
+- COM:
+  . Fixed bug #73126 (Cannot pass parameter 1 by reference). (Anatol)
+  . Fixed bug #69579 (Invalid free in extension trait). (John Boehr)
+
+- GD:
+  . Fixed bug #50194 (imagettftext broken on transparent background w/o
+    alphablending). (cmb)
+  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
+    cmb)
+  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
+    (Mark Plomer, cmb)
+  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
+  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
+  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
+    files). (cmb)
+  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
+
+- JSON:
+  . Fixed bug #73113 (Segfault with throwing JsonSerializable). (julien)
+
+- PCRE:
+  . Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported
+    on s390). (Anatol)
+
+- PDO_DBlib:
+  . Fixed bug #72414 (Never quote values as raw binary data). (Adam Baratz)
+  . Allow \PDO::setAttribute() to set query timeouts. (Adam Baratz)
+  . Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
+    (Adam Baratz)
+  . Add common PDO test suite. (Adam Baratz)
+  . Free error and message strings when cleaning up PDO instances.
+    (Adam Baratz)
+  . Fixed bug #67130 (\PDOStatement::nextRowset() should succeed when all rows
+    in current rowset haven't been fetched). (Peter LeBrun)
+  . Ignore potentially misleading dberr values. (Chris Kings-Lynne)
+
+- phpdbg:
+  . Added generator command for inspection of currently alive generators. (Bob)
+
+- Reflection
+  . Undo backwards compatiblity break in ReflectionType->__toString() and
+    deprecate via documentation instead. (Nikita)
+
+- Session:
+  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
+    (cmb)
+
+15 Sep 2016, PHP 7.1.0RC2
+
+- Core:
+  . Fixed bug #73067 (__debugInfo crashes when throwing an exception).
+    (Laruence)
+  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+    zend_virtual_cwd.c). (cmb)
+  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
+
+- Filter:
+  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
+    FILTER_FLAG_NO_PRIV_RANGE). (julien)
+  . Fixed bug #73054 (default option ignored when object passed to int filter).
+    (cmb)
+
+-GD:
+  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
+    (cmb)
+
+- Mbstring
+  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion) (Yasuo)
+  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
+    (Yasuo)
+
+- Opcache:
+  . Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp()
+    function). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
+    (Jakub Zelenka)
+
+- Session:
+  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
+    (Yasuo)
+
+- SQLite3:
+  . Updated to SQLite3 3.14.2. (cmb)
+
+01 Sep 2016, PHP 7.1.0RC1

 - Core:
  . Fixed bug #72944 (Null pointer deref in zval_delref_p). (Dmitry)
@@ -31,6 +127,7 @@ PHP                                                                        NEWS
 - Intl:
  . Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF
    sequence). (cmb)
+  . Fixed bug #73007 (add locale length check). (Stas)

 - JSON:
  . Implemented earlier return when json_encode fails, fixes bugs #68992
@@ -47,13 +144,22 @@ PHP                                                                        NEWS
  . Implemented stringify 'uniqueidentifier' fields.
    (Alexander Zhuravlev, Adam Baratz)

+- Phar:
+  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
+    phar_parse_zipfile). (Stas)
+  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
+    phar_parse_tarfile). (Stas)
+
 - Reflection:
  . Reverted prepending \ for class names. (Trowski)

 - Session:
  . Fixed bug #72940 (SID always return "name=ID", even if session
    cookie exist). (Yasuo)
-  . Implemented session_gc() and session_create_id() functions. (Yasuo)
+  . Implemented session_gc() (Yasuo)
+    https://wiki.php.net/rfc/session-create-id
+  . Implemented session_create_id() (Yasuo)
+    https://wiki.php.net/rfc/session-gc

 - SimpleXML:
  . Fixed bug #72971 (SimpleXML isset/unset do not respect namespace). (Nikita)
@@ -144,6 +250,7 @@ PHP                                                                        NEWS

 - SPL:
  . Fixed bug #72888 (Segfault on clone on splFileObject). (Laruence)
+  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)

 - SQLite3:
  . Updated to SQLite3 3.14.0. (cmb)
@@ -267,6 +374,8 @@ PHP                                                                        NEWS
    (Stas)
  . Fixed bug #72799 (wddx_deserialize null dereference in
    php_wddx_pop_element). (Stas)
+  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
+  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)

 - XMLRPC:
  . Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing
@@ -49,9 +49,9 @@ PHP 7.1 UPGRADE NOTES
    the notice level only.
  . Don't call destructors of incompletely constructed objects, even if they
    are kept referenced. See bug #29368 and Zend/tests/bug29368_1.phpt.
-  . call_user_func() will now consistently fail to perform calls to functions
-    that accept reference arguments. Previously this sometimes worked if
-    call_user_func() was used outside a namespace.
+  . call_user_func() will now consistently throw a warning if a function with
+    reference arguments is called. However, call_user_func() will no longer
+    abort the call in this case.
  . rand() and srand() are now aliases of mt_rand() and mt_srand().
    Consequently the output of the following functions has changed:
     . rand()
@@ -61,7 +61,7 @@ PHP 7.1 UPGRADE NOTES
  . Fixes to random number generators mean that mt_rand() now produces a
    different sequence of outputs to previous versions. If you relied on
    mt_srand() to produce a deterministic sequence, it can be called using
-    mt_srand($seed, MT_RAND_PHP) to produce old the sequences.
+    mt_srand($seed, MT_RAND_PHP) to produce the old sequences.
  . URL rewriter has been improved.
     . Use dedicated buffer for Session module rewrite and User rewrite.
     . Full path URL rewrite is supported. Allowed domain can be specified.
@@ -76,6 +76,10 @@ PHP 7.1 UPGRADE NOTES
  . Calling a function with less arguments than mandatory declared ones in
    signature now issues a Fatal Error (Error Exception) instead of a Warning.
    (RFC https://wiki.php.net/rfc/too_few_args).
+  . The error message for E_RECOVERABLE errors has been changed from "Catchable
+    fatal error" to "Recoverable fatal error".
+  . The empty index operator (e.g. $str[] = $x) is not supported for strings
+    anymore, and throws a fatal error instead of silently converting to array.

 - JSON:
  . The serialize_precision is used instead of precision when encoding double
@@ -103,7 +107,7 @@ PHP 7.1 UPGRADE NOTES
     . session.entropy_length
  . New INIs and defaults
     . session.sid_length (Number of session ID characters - 22 to 256.
-       (php.ini-* default: 26 Compitled default: 32)
+       (php.ini-* default: 26 Compiled default: 32)
     . session.sid_bits_per_character (Bits used per character. 4 to 6.
       php.ini-* default: 5 Compiled default: 4)
    Length of old session ID string is determined as follows
@@ -122,11 +126,8 @@ PHP 7.1 UPGRADE NOTES

 - Reflection:
  . The behavior of ReflectionMethod::invoke() and ::invokeArgs() has been
-    aligned, what causes slightly different behavior than before for some
+    aligned, which causes slightly different behavior than before for some
    pathological cases.
-  . ReflectionType::__toString() will now return the type name with a leading
-    "?" if it is nullable. To retrieve the type name without leading "?" the new
-    ReflectionNamedType::getName() method can be used.

 ========================================
 2. New Features
@@ -236,6 +237,12 @@ PHP 7.1 UPGRADE NOTES
  . Added pcntl_signal_get_handler() that returns the current signal handler
    for a particular signal.

+- Session:
+  . Added session_gc() that performs session data garbage collection.
+    https://wiki.php.net/rfc/session-gc
+  . Added session_create_id() for creating custom session ID.
+    https://wiki.php.net/rfc/session-create-id
+
 - Standard:
  . Added is_iterable() that determines if a value will be accepted by the new
    iterable pseudo-type.
@@ -262,7 +269,7 @@ PHP 7.1 UPGRADE NOTES

 - DBA:
  . Data modification functions (e.g.: dba_insert()) now throw an instance of
-    Error instead of triggering a catchable fatal error if the key is does not
+    Error instead of triggering a catchable fatal error if the key does not
    contain exactly two elements.

 - DOM:
@@ -0,0 +1,25 @@
+--TEST--
+Next free element may overflow in array literals
+--FILE--
+<?php
+
+$i = PHP_INT_MAX;
+$array = [$i => 42, new stdClass];
+var_dump($array);
+
+const FOO = [PHP_INT_MAX => 42, "foo"];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -0,0 +1,56 @@
+--TEST--
+Various null return conditions of dim/obj assignments
+--FILE--
+<?php
+
+function test() {
+    $array = [PHP_INT_MAX => 42];
+    $true = true;
+
+    var_dump($array[] = 123);
+    var_dump($array[[]] = 123);
+    var_dump($array[new stdClass] = 123);
+    var_dump($true[123] = 456);
+
+    var_dump($array[] += 123);
+    var_dump($array[[]] += 123);
+    var_dump($array[new stdClass] += 123);
+    var_dump($true[123] += 456);
+
+    var_dump($true->foo = 123);
+    var_dump($true->foo += 123);
+}
+
+test();
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+NULL
+
+Warning: Illegal offset type in %s on line %d
+NULL
+
+Warning: Illegal offset type in %s on line %d
+NULL
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+NULL
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+NULL
+
+Warning: Illegal offset type in %s on line %d
+NULL
+
+Warning: Illegal offset type in %s on line %d
+NULL
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+NULL
+
+Warning: Attempt to assign property of non-object in %s on line %d
+NULL
+
+Warning: Attempt to assign property of non-object in %s on line %d
+NULL
@@ -7,7 +7,7 @@ $r = new ReflectionMethod($f, '__invoke');
 var_dump($r->getParameters()[0]->getName());
 var_dump($r->getParameters()[0]->getClass());
 echo $r->getParameters()[0], "\n";
-echo $r->getReturnType(),"\n";
+echo $r->getReturnType()->getName(), "\n";
 echo $r,"\n";
 ?>
 --EXPECT--
@@ -7,4 +7,4 @@ $var11 = new StdClass();
 $var16 = error_reporting($var11);
 ?>
 --EXPECTF--
-Catchable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d
+Recoverable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d
@@ -0,0 +1,21 @@
+--TEST--
+Bug #73067 (__debugInfo crashes when throwing an exception)
+--FILE--
+<?php
+
+class Debug
+{
+	public function __debugInfo()
+	{
+		throw new Exception("Test Crash");
+	}
+}
+
+try {
+	var_dump(new Debug());
+} catch (Exception $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+Fatal error: __debuginfo() must return an array in %sbug73067.php on line %d
@@ -0,0 +1,50 @@
+--TEST--
+iBug #73156 (segfault on undefined function)
+--FILE--
+<?php
+class A {
+    public function __call($name, $args) {
+        eval('$args = array(); var_dump(debug_backtrace());');
+    }
+}
+
+$a = new A();
+
+$a->test("test");
+?>
+--EXPECTF--
+array(2) {
+  [0]=>
+  array(3) {
+    ["file"]=>
+    string(%d) "%sbug73156.php"
+    ["line"]=>
+    int(4)
+    ["function"]=>
+    string(4) "eval"
+  }
+  [1]=>
+  array(7) {
+    ["file"]=>
+    string(%d) "%sbug73156.php"
+    ["line"]=>
+    int(10)
+    ["function"]=>
+    string(6) "__call"
+    ["class"]=>
+    string(1) "A"
+    ["object"]=>
+    object(A)#%d (0) {
+    }
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(2) {
+      [0]=>
+      string(4) "test"
+      [1]=>
+      array(0) {
+      }
+    }
+  }
+}
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73163 (PHP hangs if error handler throws while accessing undef const in default value)
+--FILE--
+<?php
+
+function doSomething(string $value = UNDEFINED) {
+}
+
+set_error_handler(function($errno, $errstr) {
+    throw new Exception($errstr);
+});
+
+doSomething();
+
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: Use of undefined constant UNDEFINED - assumed 'UNDEFINED' in %s:%d
+Stack trace:
+#0 %s(%d): {closure}(%s)
+#1 %s(%d): doSomething()
+#2 {main}
+  thrown in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73181: parse_str() without a second argument leads to crash
+--FILE--
+<?php
+
+function x() {
+    parse_str("1&x");
+    var_dump(get_defined_vars());
+}
+
+x();
+
+?>
+--EXPECT--
+array(2) {
+  [1]=>
+  string(0) ""
+  ["x"]=>
+  string(0) ""
+}
@@ -0,0 +1,17 @@
+--TEST--
+call_user_func() behavior when passing literal to reference parameter
+--FILE--
+<?php
+
+namespace Foo;
+
+var_dump(call_user_func('sort', []));
+var_dump(\call_user_func('sort', []));
+
+?>
+--EXPECTF--
+Warning: Parameter 1 to sort() expected to be a reference, value given in %s on line %d
+bool(true)
+
+Warning: Parameter 1 to sort() expected to be a reference, value given in %s on line %d
+bool(true)
@@ -22,4 +22,4 @@ NULL
 Notice: Undefined property: A::$1 in %sclass_properties_const.php on line %d
 NULL

-Catchable fatal error: Object of class Closure could not be converted to string in %sclass_properties_const.php on line %d
+Recoverable fatal error: Object of class Closure could not be converted to string in %sclass_properties_const.php on line %d
@@ -29,7 +29,7 @@ foreach ($callables as $callable) {
 	foreach ($refl->getParameters() as $param) {
 		if ($param->hasType()) {
 			$type = $param->getType();
-			echo $type->__toString() . "\n";
+			echo $type->getName() . "\n";
 		}
 	}
 }
@@ -0,0 +1,15 @@
+--TEST--
+Constexpr arrays should be able to handle resource keys
+--FILE--
+<?php
+
+const FOO = [STDIN => 42];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Notice: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -25,4 +25,4 @@ throw new my_exception;

 ?>
 --EXPECT--
-Catchable fatal error: Object of class stdClass could not be converted to string in Unknown on line 0
+Recoverable fatal error: Object of class stdClass could not be converted to string in Unknown on line 0
@@ -26,4 +26,4 @@ bool(true)
 bool(true)
 bool(false)

-Catchable fatal error: Object of class stdClass could not be converted to string in %s on line %d
+Recoverable fatal error: Object of class stdClass could not be converted to string in %s on line %d
@@ -0,0 +1,11 @@
+--TEST--
+Cannot use empty elements in keyed array destructuring
+--FILE--
+<?php
+
+$array = ['a' => 1, 'b' => 2];
+['a' => $a, , 'b' => $b] = $array;
+
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array entries in keyed array assignment in %s on line %d
@@ -25,7 +25,7 @@ $foo = new foo;
 $foo->testFoo(new foo);
 $foo->testBar(new bar);
 $foo->testBaz(new baz);
-$foo->testFoo(new stdClass); // Catchable fatal error
+$foo->testFoo(new stdClass); // Recoverable fatal error

 ?>
 --EXPECTF--
@@ -0,0 +1,20 @@
+--TEST--
+Bug #69579 (Internal trait double-free)
+--SKIPIF--
+<?php
+if (!PHP_DEBUG) die("skip only run in debug version");
+?>
+--FILE--
+<?php
+
+class Bar{
+  use _ZendTestTrait;
+}
+
+$bar = new Bar();
+var_dump($bar->testMethod());
+// destruction causes a double-free and explodes
+
+?>
+--EXPECT--
+bool(true)
@@ -12,8 +12,8 @@ final class e { }
 var_dump(get_declared_traits());

 ?>
--EXPECT--
-array(1) {
-  [0]=>
+--EXPECTF--
+array(%d) {%A
+  [%d]=>
  string(1) "c"
 }
@@ -13,8 +13,8 @@ namespace test {
 }

 ?>
--EXPECT--
-array(1) {
-  [0]=>
+--EXPECTF--
+array(%d) {%A
+  [%d]=>
  string(6) "test\c"
 }
@@ -13,13 +13,15 @@ var_dump(get_declared_traits());

 ?>
 --EXPECTF--
-%astring(1) "a"
+array(%d) {%A
+  [%d]=>
+  string(1) "a"
  [%d]=>
  string(1) "d"
  [%d]=>
  string(1) "e"
 }
-array(1) {
-  [0]=>
+array(%d) {%A
+  [%d]=>
  string(1) "c"
 }
@@ -202,7 +202,6 @@ ZEND_API char *zend_zval_type_name(const zval *arg) /* {{{ */
 }
 /* }}} */

-#ifdef FAST_ZPP
 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_parameters_count_error(int num_args, int min_num_args, int max_num_args) /* {{{ */
 {
 	zend_function *active_function = EG(current_execute_data)->func;
@@ -298,7 +297,6 @@ ZEND_API int ZEND_FASTCALL zend_parse_arg_class(zval *arg, zend_class_entry **pc
 	return 1;
 }
 /* }}} */
-#endif

 ZEND_API int ZEND_FASTCALL zend_parse_arg_bool_weak(zval *arg, zend_bool *dest) /* {{{ */
 {
@@ -1857,7 +1855,7 @@ static int zend_startup_module_zval(zval *zv) /* {{{ */
 {
 	zend_module_entry *module = Z_PTR_P(zv);

-	return zend_startup_module_ex(module);
+	return (zend_startup_module_ex(module) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
 /* }}} */

@@ -2160,7 +2158,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
 		internal_function->prototype = NULL;
 		if (ptr->flags) {
 			if (!(ptr->flags & ZEND_ACC_PPP_MASK)) {
-				if (ptr->flags != ZEND_ACC_DEPRECATED || scope) {
+				if (ptr->flags != ZEND_ACC_DEPRECATED && scope) {
 					zend_error(error_type, "Invalid access level for %s%s%s() - access must be exactly one of public, protected or private", scope ? ZSTR_VAL(scope->name) : "", scope ? "::" : "", ptr->fname);
 				}
 				internal_function->fn_flags = ZEND_ACC_PUBLIC | ptr->flags;
@@ -2911,7 +2909,7 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 	zend_string *mname, *cname;
 	zend_string *lmname;
 	const char *colon;
-	size_t clen, mlen;
+	size_t clen;
 	HashTable *ftable;
 	int call_via_handler = 0;
 	zend_class_entry *scope;
@@ -2964,6 +2962,8 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		colon > Z_STRVAL_P(callable) &&
 		*(colon-1) == ':'
 	) {
+		size_t mlen;
+
 		colon--;
 		clen = colon - Z_STRVAL_P(callable);
 		mlen = Z_STRLEN_P(callable) - clen - 2;
@@ -2996,7 +2996,6 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		mname = zend_string_init(Z_STRVAL_P(callable) + clen + 2, mlen, 0);
 	} else if (ce_org) {
 		/* Try to fetch find static method of given class. */
-		mlen = Z_STRLEN_P(callable);
 		mname = Z_STR_P(callable);
 		zend_string_addref(mname);
 		ftable = &ce_org->function_table;
@@ -676,13 +676,11 @@ END_EXTERN_C()

 /* Fast parameter parsing API */

-/* This API should be used only for really often used functions.
- * (Keep the original parsing code and wrap usage with #ifndef FAST_ZPP)
+/* Fast ZPP is always enabled now; this define is left in for compatibility
+ * with any existing conditional compilation blocks.
 */
 #define FAST_ZPP 1

-#ifdef FAST_ZPP
-
 #define Z_EXPECTED_TYPES(_) \
 	_(Z_EXPECTED_LONG,		"integer") \
 	_(Z_EXPECTED_BOOL,		"boolean") \
@@ -1045,8 +1043,6 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 #define Z_PARAM_VARIADIC(spec, dest, dest_num) \
 	Z_PARAM_VARIADIC_EX(spec, dest, dest_num, 0)

-#endif /* FAST_ZPP */
-
 /* End of new parameter parsing API */

 /* Inlined implementations shared by new and old parameter parsing APIs */
@@ -2602,9 +2602,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(zend_mm_heap));
 		alloc_globals->mm_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
-		alloc_globals->mm_heap->custom_heap.std._malloc = malloc;
+		alloc_globals->mm_heap->custom_heap.std._malloc = __zend_malloc;
 		alloc_globals->mm_heap->custom_heap.std._free = free;
-		alloc_globals->mm_heap->custom_heap.std._realloc = realloc;
+		alloc_globals->mm_heap->custom_heap.std._realloc = __zend_realloc;
 		return;
 	}
 #endif
@@ -181,7 +181,11 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 {
 	switch (Z_TYPE_P(offset)) {
 		case IS_UNDEF:
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), expr);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), expr)) {
+				zend_error(E_WARNING,
+					"Cannot add element to the array as the next element is already occupied");
+				zval_ptr_dtor(expr);
+			}
 			break;
 		case IS_STRING:
 			zend_symtable_update(Z_ARRVAL_P(result), Z_STR_P(offset), expr);
@@ -202,6 +206,10 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 		case IS_DOUBLE:
 			zend_hash_index_update(Z_ARRVAL_P(result), zend_dval_to_lval(Z_DVAL_P(offset)), expr);
 			break;
+		case IS_RESOURCE:
+			zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(offset), Z_RES_HANDLE_P(offset));
+			zend_hash_index_update(Z_ARRVAL_P(result), Z_RES_HANDLE_P(offset), expr);
+			break;
 		default:
 			zend_throw_error(NULL, "Illegal offset type");
 			return FAILURE;
@@ -34,6 +34,7 @@
 #if ZEND_DEBUG
 static zend_class_entry *zend_test_interface;
 static zend_class_entry *zend_test_class;
+static zend_class_entry *zend_test_trait;
 static zend_object_handlers zend_test_class_handlers;
 #endif

@@ -306,6 +307,16 @@ static int zend_test_class_call_method(zend_string *method, zend_object *object,
 	return 0;
 }
 /* }}} */
+
+static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
+	RETURN_TRUE;
+}
+/* }}} */
+
+static zend_function_entry zend_test_trait_methods[] = {
+    ZEND_ME(_ZendTestTrait, testMethod, arginfo_zend__void, ZEND_ACC_PUBLIC)
+    ZEND_FE_END
+};
 #endif

 static const zend_function_entry builtin_functions[] = { /* {{{ */
@@ -403,6 +414,11 @@ ZEND_MINIT_FUNCTION(core) { /* {{{ */
 	memcpy(&zend_test_class_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
 	zend_test_class_handlers.get_method = zend_test_class_method_get;
 	zend_test_class_handlers.call_method = zend_test_class_call_method;
+
+	INIT_CLASS_ENTRY(class_entry, "_ZendTestTrait", zend_test_trait_methods);
+	zend_test_trait = zend_register_internal_class(&class_entry);
+	zend_test_trait->ce_flags |= ZEND_ACC_TRAIT;
+	zend_declare_property_null(zend_test_trait, "testProp", sizeof("testProp")-1, ZEND_ACC_PUBLIC);
 #endif

 	return SUCCESS;
@@ -622,15 +638,9 @@ ZEND_FUNCTION(strlen)
 {
 	zend_string *s;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &s) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(s)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	RETVAL_LONG(ZSTR_LEN(s));
 }
@@ -770,16 +780,10 @@ ZEND_FUNCTION(error_reporting)
 	zval *err = NULL;
 	int old_error_reporting;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|z", &err) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(0, 1)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_ZVAL(err)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	old_error_reporting = EG(error_reporting);
 	if (ZEND_NUM_ARGS() != 0) {
@@ -893,18 +897,12 @@ ZEND_FUNCTION(define)
 	int case_sensitive = CONST_CS;
 	zend_constant c;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sz|b", &name, &val, &non_cs) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_STR(name)
 		Z_PARAM_ZVAL(val)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(non_cs)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (non_cs) {
 		case_sensitive = 0;
@@ -985,15 +983,9 @@ ZEND_FUNCTION(defined)
 {
 	zend_string *name;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (zend_get_constant_ex(name, zend_get_executed_scope(), ZEND_FETCH_CLASS_SILENT)) {
 		RETURN_TRUE;
@@ -1094,18 +1086,12 @@ static void is_a_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool only_subclass) /*
 	zend_bool allow_string = only_subclass;
 	zend_bool retval;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS|b", &obj, &class_name, &allow_string) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_ZVAL(obj)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(allow_string)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 	/*
 	 * allow_string - is_a default is no, is_subclass_of is yes.
 	 *   if it's allowed, then the autoloader will be called if the class does not exist.
@@ -1246,15 +1232,9 @@ ZEND_FUNCTION(get_object_vars)
 	zend_string *key;
 	zend_object *zobj;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "o", &obj) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (Z_OBJ_HT_P(obj)->get_properties == NULL) {
 		RETURN_FALSE;
@@ -1392,16 +1372,11 @@ ZEND_FUNCTION(method_exists)
 	zend_string *lcname;
 	zend_class_entry * ce;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS", &klass, &method_name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 2)
 		Z_PARAM_ZVAL(klass)
 		Z_PARAM_STR(method_name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
+	
 	if (Z_TYPE_P(klass) == IS_OBJECT) {
 		ce = Z_OBJCE_P(klass);
 	} else if (Z_TYPE_P(klass) == IS_STRING) {
@@ -1497,17 +1472,11 @@ ZEND_FUNCTION(class_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &class_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(class_name)[0] == '\\') {
@@ -1540,17 +1509,11 @@ ZEND_FUNCTION(interface_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &iface_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(iface_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(iface_name)[0] == '\\') {
@@ -1582,17 +1545,11 @@ ZEND_FUNCTION(trait_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &trait_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(trait_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (!autoload) {
 		if (ZSTR_VAL(trait_name)[0] == '\\') {
@@ -1625,15 +1582,9 @@ ZEND_FUNCTION(function_exists)
 	zend_function *func;
 	zend_string *lcname;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Ignore leading "\" */
@@ -2342,9 +2293,33 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(arg_array)) {
 			if (call->func->type == ZEND_USER_FUNCTION) {
-				uint32_t first_extra_arg = call->func->op_array.num_args;
+				uint32_t first_extra_arg = MIN(num_args, call->func->op_array.num_args);

-				if (ZEND_CALL_NUM_ARGS(call) > first_extra_arg) {
+				if (UNEXPECTED(ZEND_CALL_INFO(call) & ZEND_CALL_HAS_SYMBOL_TABLE)) {
+					/* In case of attached symbol_table, values on stack may be invalid
+					 * and we have to access them through symbol_table
+					 * See: https://bugs.php.net/bug.php?id=73156
+					 */
+					zend_string *arg_name;
+					zval *arg;
+
+					while (i < first_extra_arg) {
+						arg_name = call->func->op_array.vars[i];
+						arg = zend_hash_find_ind(call->symbol_table, arg_name);
+						if (arg) {
+							if (Z_OPT_REFCOUNTED_P(arg)) {
+								Z_ADDREF_P(arg);
+							}
+							n++;
+							ZEND_HASH_FILL_ADD(arg);
+						} else {
+							zval tmp;
+							ZVAL_UNDEF(&tmp);
+							ZEND_HASH_FILL_ADD(&tmp);
+						}
+						i++;
+					}
+				} else {
 					while (i < first_extra_arg) {
 						if (EXPECTED(Z_TYPE_INFO_P(p) != IS_UNDEF)) {
 							if (Z_OPT_REFCOUNTED_P(p)) {
@@ -2356,8 +2331,8 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 						p++;
 						i++;
 					}
-					p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 				}
+				p = ZEND_CALL_VAR_NUM(call, call->func->op_array.last_var + call->func->op_array.T);
 			}

 			while (i < num_args) {
@@ -2211,6 +2211,7 @@ ZEND_API int zend_is_smart_branch(zend_op *opline) /* {{{ */
 		case ZEND_ISSET_ISEMPTY_VAR:
 		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
 		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
 		case ZEND_INSTANCEOF:
 		case ZEND_TYPE_CHECK:
 		case ZEND_DEFINED:
@@ -2803,37 +2804,58 @@ static void zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_styl
 }
 /* }}} */

-static void zend_compile_unkeyed_list_assign(zend_ast_list *list, znode *expr_node, zend_bool old_style) /* {{{ */
+static void zend_compile_list_assign(
+		znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style) /* {{{ */
 {
+	zend_ast_list *list = zend_ast_get_list(ast);
 	uint32_t i;
 	zend_bool has_elems = 0;
+	zend_bool is_keyed =
+		list->children > 0 && list->child[0] != NULL && list->child[0]->child[1] != NULL;

 	for (i = 0; i < list->children; ++i) {
 		zend_ast *elem_ast = list->child[i];
-		zend_ast *var_ast;
+		zend_ast *var_ast, *key_ast;
 		znode fetch_result, dim_node;

 		if (elem_ast == NULL) {
-			continue;
+			if (is_keyed) {
+				zend_error(E_COMPILE_ERROR,
+					"Cannot use empty array entries in keyed array assignment");
+			} else {
+				continue;
+			}
 		}
+
 		if (elem_ast->attr) {
 			zend_error(E_COMPILE_ERROR, "[] and list() assignments cannot be by reference");
 		}

 		var_ast = elem_ast->child[0];
+		key_ast = elem_ast->child[1];
 		has_elems = 1;

-		dim_node.op_type = IS_CONST;
-		ZVAL_LONG(&dim_node.u.constant, i);
+		if (is_keyed) {
+			if (key_ast == NULL) {
+				zend_error(E_COMPILE_ERROR,
+					"Cannot mix keyed and unkeyed array entries in assignments");
+			}
+
+			zend_compile_expr(&dim_node, key_ast);
+		} else {
+			if (key_ast != NULL) {
+				zend_error(E_COMPILE_ERROR,
+					"Cannot mix keyed and unkeyed array entries in assignments");
+			}
+
+			dim_node.op_type = IS_CONST;
+			ZVAL_LONG(&dim_node.u.constant, i);
+		}

 		if (expr_node->op_type == IS_CONST) {
 			Z_TRY_ADDREF(expr_node->u.constant);
 		}

-		if (elem_ast->child[1] != NULL) {
-			zend_error(E_COMPILE_ERROR, "Cannot mix keyed and unkeyed array entries in assignments");
-		}
-
 		zend_verify_list_assign_target(var_ast, old_style);

 		zend_emit_op(&fetch_result, ZEND_FETCH_LIST, expr_node, &dim_node);
@@ -2844,55 +2866,6 @@ static void zend_compile_unkeyed_list_assign(zend_ast_list *list, znode *expr_no
 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use empty list");
 	}

-}
-/* }}} */
-
-static void zend_compile_keyed_list_assign(zend_ast_list *list, znode *expr_node, zend_bool old_style) /* {{{ */
-{
-	uint32_t i;
-
-	for (i = 0; i < list->children; ++i) {
-		zend_ast *pair_ast = list->child[i];
-		zend_ast *var_ast = pair_ast->child[0];
-		zend_ast *key_ast = pair_ast->child[1];
-		znode fetch_result, dim_node;
-
-		if (pair_ast->attr) {
-			zend_error(E_COMPILE_ERROR, "[] and list() assignments cannot be by reference");
-		}
-
-		if (key_ast == NULL) {
-			zend_error(E_COMPILE_ERROR, "Cannot mix keyed and unkeyed array entries in assignments");
-		}
-
-		zend_compile_expr(&dim_node, key_ast);
-
-		if (expr_node->op_type == IS_CONST) {
-			Z_TRY_ADDREF(expr_node->u.constant);
-		}
-
-		if (var_ast == NULL) {
-			zend_error(E_COMPILE_ERROR, "Cannot use empty array entries in keyed array");
-		}
-
-		zend_verify_list_assign_target(var_ast, old_style);
-
-		zend_emit_op(&fetch_result, ZEND_FETCH_LIST, expr_node, &dim_node);
-		zend_emit_assign_znode(var_ast, &fetch_result);
-	}
-}
-/* }}} */
-
-static void zend_compile_list_assign(znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style) /* {{{ */
-{
-	zend_ast_list *list = zend_ast_get_list(ast);
-
-	if (list->children > 0 && list->child[0] != NULL && list->child[0]->child[1] != NULL /* has key */) {
-		zend_compile_keyed_list_assign(list, expr_node, old_style);
-	} else {
-		zend_compile_unkeyed_list_assign(list, expr_node, old_style);
-	}
-
 	*result = *expr_node;
 }
 /* }}} */
@@ -3411,6 +3384,22 @@ int zend_compile_func_typecheck(znode *result, zend_ast_list *args, uint32_t typ
 }
 /* }}} */

+int zend_compile_func_cast(znode *result, zend_ast_list *args, uint32_t type) /* {{{ */
+{
+	znode arg_node;
+	zend_op *opline;
+
+	if (args->children != 1 || args->child[0]->kind == ZEND_AST_UNPACK) {
+		return FAILURE;
+	}
+
+	zend_compile_expr(&arg_node, args->child[0]);
+	opline = zend_emit_op_tmp(result, ZEND_CAST, &arg_node, NULL);
+	opline->extended_value = type;
+	return SUCCESS;
+}
+/* }}} */
+
 int zend_compile_func_defined(znode *result, zend_ast_list *args) /* {{{ */
 {
 	zend_string *name;
@@ -3575,12 +3564,8 @@ int zend_compile_func_cuf(znode *result, zend_ast_list *args, zend_string *lcnam
 		zend_op *opline;

 		zend_compile_expr(&arg_node, arg_ast);
-		if (arg_node.op_type & (IS_VAR|IS_CV)) {
-			opline = zend_emit_op(NULL, ZEND_SEND_USER, &arg_node, NULL);
-		} else {
-			opline = zend_emit_op(NULL, ZEND_SEND_VAL, &arg_node, NULL);
-		}

+		opline = zend_emit_op(NULL, ZEND_SEND_USER, &arg_node, NULL);
 		opline->op2.num = i;
 		opline->result.var = (uint32_t)(zend_intptr_t)ZEND_CALL_ARG(NULL, i);
 	}
@@ -3676,6 +3661,16 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return zend_compile_func_typecheck(result, args, IS_OBJECT);
 	} else if (zend_string_equals_literal(lcname, "is_resource")) {
 		return zend_compile_func_typecheck(result, args, IS_RESOURCE);
+	} else if (zend_string_equals_literal(lcname, "boolval")) {
+		return zend_compile_func_cast(result, args, _IS_BOOL);
+	} else if (zend_string_equals_literal(lcname, "intval")) {
+		return zend_compile_func_cast(result, args, IS_LONG);
+	} else if (zend_string_equals_literal(lcname, "floatval")
+		|| zend_string_equals_literal(lcname, "doubleval")
+	) {
+		return zend_compile_func_cast(result, args, IS_DOUBLE);
+	} else if (zend_string_equals_literal(lcname, "strval")) {
+		return zend_compile_func_cast(result, args, IS_STRING);
 	} else if (zend_string_equals_literal(lcname, "defined")) {
 		return zend_compile_func_defined(result, args);
 	} else if (zend_string_equals_literal(lcname, "chr") && type == BP_VAR_R) {
@@ -6633,7 +6628,11 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 					break;
 			}
 		} else {
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), value);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), value)) {
+				zval_ptr_dtor_nogc(value);
+				zval_ptr_dtor(result);
+				return 0;
+			}
 		}
 	}

@@ -587,8 +587,6 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_class_entry *scope) /* {{{ */
 				ZVAL_EMPTY_STRING(p);
 			}
 		} else if (UNEXPECTED((const_value = zend_get_constant_ex(Z_STR_P(p), scope, Z_CONST_FLAGS_P(p))) == NULL)) {
-			char *actual = Z_STRVAL_P(p);
-
 			if (UNEXPECTED(EG(exception))) {
 				RESET_CONSTANT_VISITED(p);
 				return FAILURE;
@@ -603,26 +601,29 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_class_entry *scope) /* {{{ */
 					return FAILURE;
 				} else {
 					zend_string *save = Z_STR_P(p);
+					char *actual = Z_STRVAL_P(p);
 					size_t actual_len = Z_STRLEN_P(p);
 					char *slash = (char *) zend_memrchr(actual, '\\', actual_len);
 					if (slash) {
 						actual = slash + 1;
 						actual_len -= (actual - Z_STRVAL_P(p));
-						if (inline_change) {
-							zend_string *s = zend_string_init(actual, actual_len, 0);
-							Z_STR_P(p) = s;
-							Z_TYPE_FLAGS_P(p) = IS_TYPE_REFCOUNTED | IS_TYPE_COPYABLE;
-						}
 					}

-					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'",  actual,  actual);
+					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
+					if (EG(exception)) {
+						RESET_CONSTANT_VISITED(p);
+						return FAILURE;
+					}
+
 					if (!inline_change) {
 						ZVAL_STRINGL(p, actual, actual_len);
 					} else {
-						Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
-							IS_STRING_EX : IS_INTERNED_STRING_EX;
-						if (save && ZSTR_VAL(save) != actual) {
+						if (slash) {
+							ZVAL_STRINGL(p, actual, actual_len);
 							zend_string_release(save);
+						} else {
+							Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
+								IS_STRING_EX : IS_INTERNED_STRING_EX;
 						}
 					}
 				}
@@ -31,7 +31,7 @@ static zend_object_handlers zend_generator_handlers;

 static zend_object *zend_generator_create(zend_class_entry *class_type);

-static void zend_restore_call_stack(zend_generator *generator) /* {{{ */
+ZEND_API void zend_generator_restore_call_stack(zend_generator *generator) /* {{{ */
 {
 	zend_execute_data *call, *new_call, *prev_call = NULL;

@@ -57,7 +57,7 @@ static void zend_restore_call_stack(zend_generator *generator) /* {{{ */
 }
 /* }}} */

-static zend_execute_data* zend_freeze_call_stack(zend_execute_data *execute_data) /* {{{ */
+ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *execute_data) /* {{{ */
 {
 	size_t used_stack;
 	zend_execute_data *call, *new_call, *prev_call = NULL;
@@ -106,7 +106,7 @@ static void zend_generator_cleanup_unfinished_execution(
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
-			zend_restore_call_stack(generator);
+			zend_generator_restore_call_stack(generator);
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, 0);
 	}
@@ -808,7 +808,7 @@ try_again:

 		if (UNEXPECTED(generator->frozen_call_stack)) {
 			/* Restore frozen call-stack */
-			zend_restore_call_stack(generator);
+			zend_generator_restore_call_stack(generator);
 		}

 		/* Resume execution */
@@ -820,7 +820,7 @@ try_again:
 		if (EXPECTED(generator->execute_data) &&
 		    UNEXPECTED(generator->execute_data->call)) {
 			/* Frize call-stack */
-			generator->frozen_call_stack = zend_freeze_call_stack(generator->execute_data);
+			generator->frozen_call_stack = zend_generator_freeze_call_stack(generator->execute_data);
 		}

 		/* Restore executor globals */
@@ -980,15 +980,9 @@ ZEND_METHOD(Generator, send)
 	zval *value;
 	zend_generator *generator, *root;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &value) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(value)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	generator = (zend_generator *) Z_OBJ_P(getThis());

@@ -1024,15 +1018,9 @@ ZEND_METHOD(Generator, throw)
 	zval *exception, exception_copy;
 	zend_generator *generator;

-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &exception) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(exception)
 	ZEND_PARSE_PARAMETERS_END();
-#endif

 	ZVAL_DUP(&exception_copy, exception);

@@ -105,6 +105,9 @@ void zend_register_generator_ce(void);
 ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished_execution);
 ZEND_API void zend_generator_resume(zend_generator *generator);

+ZEND_API void zend_generator_restore_call_stack(zend_generator *generator);
+ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *execute_data);
+
 void zend_generator_yield_from(zend_generator *generator, zend_generator *from);
 ZEND_API zend_execute_data *zend_generator_check_placeholder_frame(zend_execute_data *ptr);

@@ -1420,13 +1420,17 @@ ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht)
 		} else if (ht->nNumUsed == ht->nNumOfElements) {
 			do {
 				i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-				zend_string_release(p->key);
+				if (EXPECTED(p->key)) {
+					zend_string_release(p->key);
+				}
 			} while (++p != end);
 		} else {
 			do {
 				if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF)) {
 					i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-					zend_string_release(p->key);
+					if (EXPECTED(p->key)) {
+						zend_string_release(p->key);
+					}
 				}
 			} while (++p != end);
 		}
@@ -1227,6 +1227,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
 	function_add_ref(fn);
 	new_fn = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
 	memcpy(new_fn, fn, sizeof(zend_op_array));
+	new_fn->common.fn_flags |= ZEND_ACC_ARENA_ALLOCATED;
 	fn = zend_hash_update_ptr(&ce->function_table, key, new_fn);
 	zend_add_magic_methods(ce, key, fn);
 }
@@ -182,6 +182,7 @@ ZEND_API HashTable *zend_std_get_debug_info(zval *object, int *is_temp) /* {{{ *
 		return ht;
 	}

+	zend_clear_exception();
 	zend_error_noreturn(E_ERROR, ZEND_DEBUGINFO_FUNC_NAME "() must return an array");

 	return NULL; /* Compilers are dumb and don't understand that noreturn means that the function does NOT need a return value... */
@@ -170,7 +170,7 @@ zend_memnstr(const char *haystack, const char *needle, size_t needle_len, const
 		return NULL;
 	}

-	if (EXPECTED(off_s < 1024 || needle_len < 3)) {
+	if (EXPECTED(off_s < 1024 || needle_len < 9)) {	/* glibc memchr is faster when needle is too short */
 		end -= needle_len;

 		while (p <= end) {
@@ -520,7 +520,10 @@ static zend_always_inline void fast_long_decrement_function(zval *op1)

 static zend_always_inline void fast_long_add_function(zval *result, zval *op1, zval *op2)
 {
-#if defined(__GNUC__) && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
+#if defined(__GNUC__) && defined(__i386__) \
+	&& !(4 == __GNUC__ && 8 == __GNUC_MINOR__) \
+	&& !(4 == __GNUC__ && 9 == __GNUC_MINOR__ && (defined(__PIC__) || defined(__PIE__)))
+	/* Position-independent builds fail with gcc-4.9.x */
 	__asm__(
 		"movl	(%1), %%eax\n\t"
 		"addl   (%2), %%eax\n\t"
@@ -606,7 +609,10 @@ static zend_always_inline int fast_add_function(zval *result, zval *op1, zval *o

 static zend_always_inline void fast_long_sub_function(zval *result, zval *op1, zval *op2)
 {
-#if defined(__GNUC__) && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
+#if defined(__GNUC__) && defined(__i386__) && \
+	!(4 == __GNUC__ && 8 == __GNUC_MINOR__) && \
+	!(4 == __GNUC__ && 9 == __GNUC_MINOR__ && (defined(__PIC__) || defined(__PIE__)))
+	/* Position-independent builds fail with gcc-4.9.x */
 	__asm__(
 		"movl	(%1), %%eax\n\t"
 		"subl   (%2), %%eax\n\t"
@@ -64,8 +64,8 @@ typedef unsigned long int uint32_t;
 # endif
 #endif

-#ifdef HAVE_LOCALE_H
-#define USE_LOCALE 1
+#ifdef USE_LOCALE
+#undef USE_LOCALE
 #endif

 #ifdef WORDS_BIGENDIAN
@@ -328,32 +328,19 @@ CWD_API int php_sys_stat_ex(const char *path, zend_stat_t *buf, int lstat) /* {{
 		buf->st_dev = buf->st_rdev = 0;
 	} else {
 		wchar_t cur_path[MAXPATHLEN+1];
-		DWORD len = sizeof(cur_path);
-		wchar_t *tmp = cur_path;

-		while(1) {
-			DWORD r = GetCurrentDirectoryW(len, tmp);
-			if (r < len) {
-				if (tmp[1] == L':') {
-					if (pathw[0] >= L'A' && pathw[0] <= L'Z') {
-						buf->st_dev = buf->st_rdev = pathw[0] - L'A';
-					} else {
-						buf->st_dev = buf->st_rdev = pathw[0] - L'a';
-					}
+		if (NULL != _wgetcwd(cur_path, sizeof(cur_path)/sizeof(wchar_t))) {
+			if (cur_path[1] == L':') {
+				if (pathw[0] >= L'A' && pathw[0] <= L'Z') {
+					buf->st_dev = buf->st_rdev = pathw[0] - L'A';
 				} else {
-					buf->st_dev = buf->st_rdev = -1;
+					buf->st_dev = buf->st_rdev = pathw[0] - L'a';
 				}
-				break;
-			} else if (!r) {
-				buf->st_dev = buf->st_rdev = -1;
-				break;
 			} else {
-				len = r+1;
-				tmp = (wchar_t*)malloc(len*sizeof(wchar_t));
+				buf->st_dev = buf->st_rdev = -1;
 			}
-		}
-		if (tmp != cur_path) {
-			free(tmp);
+		} else {
+			buf->st_dev = buf->st_rdev = -1;
 		}
 	}

@@ -934,7 +921,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			wchar_t * reparsetarget;
 			BOOL isVolume = FALSE;
 			char *printname = NULL, *substitutename = NULL;
-			int printname_len, substitutename_len;
+			int substitutename_len;
 			int substitutename_off = 0;

 			if(++(*ll) > LINK_MAX) {
@@ -969,7 +956,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i

 			if(pbuffer->ReparseTag == IO_REPARSE_TAG_SYMLINK) {
 				reparsetarget = pbuffer->SymbolicLinkReparseBuffer.ReparseTarget;
-				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
 				isabsolute = (pbuffer->SymbolicLinkReparseBuffer.Flags == 0) ? 1 : 0;
 				printname = php_win32_ioutil_w_to_any(reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR));
 				if (!printname) {
@@ -992,7 +978,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			else if(pbuffer->ReparseTag == IO_REPARSE_TAG_MOUNT_POINT) {
 				isabsolute = 1;
 				reparsetarget = pbuffer->MountPointReparseBuffer.ReparseTarget;
-				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
 				printname = php_win32_ioutil_w_to_any(reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR));
 				if (!printname) {
 					free_alloca(pbuffer, use_heap_large);
@@ -1940,7 +1925,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 {
-	int command_length;
+	size_t command_length;
 	int dir_length, extra = 0;
 	char *command_line;
 	char *ptr, *dir;
@@ -216,9 +216,22 @@ ZEND_VM_HANDLER(6, ZEND_SL, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;

+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)
+			&& EXPECTED((zend_ulong)Z_LVAL_P(op2) < SIZEOF_ZEND_LONG * 8)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) << Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	shift_left_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -231,9 +244,22 @@ ZEND_VM_HANDLER(7, ZEND_SR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;

+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)
+			&& EXPECTED((zend_ulong)Z_LVAL_P(op2) < SIZEOF_ZEND_LONG * 8)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) >> Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	shift_right_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -608,9 +634,21 @@ ZEND_VM_HANDLER(9, ZEND_BW_OR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;

+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) | Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_or_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -623,9 +661,21 @@ ZEND_VM_HANDLER(10, ZEND_BW_AND, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;

+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) & Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_and_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -638,9 +688,21 @@ ZEND_VM_HANDLER(11, ZEND_BW_XOR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;

+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_xor_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -4654,30 +4716,24 @@ ZEND_VM_C_LABEL(send_array):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

-ZEND_VM_HANDLER(120, ZEND_SEND_USER, VAR|CV, NUM)
+ZEND_VM_HANDLER(120, ZEND_SEND_USER, CONST|TMP|VAR|CV, NUM)
 {
 	USE_OPLINE
 	zval *arg, *param;
 	zend_free_op free_op1;

 	SAVE_OPLINE();
-	arg = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	arg = GET_OP1_ZVAL_PTR_DEREF(BP_VAR_R);
 	param = ZEND_CALL_VAR(EX(call), opline->result.var);

 	if (UNEXPECTED(ARG_MUST_BE_SENT_BY_REF(EX(call)->func, opline->op2.num))) {
-		ZVAL_DEREF(arg);
 		zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
 			opline->op2.num,
 			EX(call)->func->common.scope ? ZSTR_VAL(EX(call)->func->common.scope->name) : "",
 			EX(call)->func->common.scope ? "::" : "",
 			ZSTR_VAL(EX(call)->func->common.function_name));
-	} else {
-		if (Z_ISREF_P(arg) &&
-		    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
-			/* don't separate references for __call */
-			arg = Z_REFVAL_P(arg);
-		}
 	}
+
 	ZVAL_COPY(param, arg);

 	FREE_OP1();
@@ -5230,7 +5286,10 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -332,7 +332,7 @@ static uint32_t zend_vm_opcodes_flags[187] = {
 	0x00001001,
 	0x01000703,
 	0x00000000,
-	0x00001001,
+	0x00001003,
 	0x00000007,
 	0x00000003,
 	0x07000003,
@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=1
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION="RC3"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -309,7 +309,6 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
 							}

 							f.num_args = bindptr.lpfuncdesc->cParams;
-							zend_set_function_arg_flags((zend_function*)&f);

 							ITypeInfo_ReleaseFuncDesc(TI, bindptr.lpfuncdesc);
 							break;
@@ -335,15 +334,14 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
 			}
 		}

-		if (fptr) {
-			/* save this method in the cache */
-			if (!obj->method_cache) {
-				ALLOC_HASHTABLE(obj->method_cache);
-				zend_hash_init(obj->method_cache, 2, NULL, function_dtor, 0);
-			}
-
-			zend_hash_update_mem(obj->method_cache, name, &f, sizeof(f));
+		zend_set_function_arg_flags((zend_function*)&f);
+		/* save this method in the cache */
+		if (!obj->method_cache) {
+			ALLOC_HASHTABLE(obj->method_cache);
+			zend_hash_init(obj->method_cache, 2, NULL, function_dtor, 0);
 		}
+
+		zend_hash_update_mem(obj->method_cache, name, &f, sizeof(f));
 	}

 	if (fptr) {
@@ -3724,8 +3724,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 									if (fgot < ImageInfo->Thumbnail.size) {
 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
+										efree(ImageInfo->Thumbnail.data);
+										ImageInfo->Thumbnail.data = NULL;
+									} else {
+										exif_thumbnail_build(ImageInfo);
 									}
-									exif_thumbnail_build(ImageInfo);
 								}
 							}
 						}
@@ -397,7 +397,7 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
 			} else {
 				ZVAL_FALSE(value);
 			}
-			return;
+			goto handle_default;
 		}
 	}

@@ -406,6 +406,7 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval

 	filter_func.function(value, flags, options, charset);

+handle_default:
 	if (options && (Z_TYPE_P(options) == IS_ARRAY || Z_TYPE_P(options) == IS_OBJECT) &&
 		((flags & FILTER_NULL_ON_FAILURE && Z_TYPE_P(value) == IS_NULL) ||
 		(!(flags & FILTER_NULL_ON_FAILURE) && Z_TYPE_P(value) == IS_FALSE)) &&
@@ -789,8 +789,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
 				if (
 					(ip[0] == 10) ||
-					(ip[0] == 169 && ip[1] == 254) ||
-					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
+					(ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31) ||
 					(ip[0] == 192 && ip[1] == 168)
 				) {
 					RETURN_VALIDATION_FAILED
@@ -800,19 +799,9 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_RES_RANGE) {
 				if (
 					(ip[0] == 0) ||
-					(ip[0] == 10) ||
-					(ip[0] == 100 && (ip[1] >= 64 && ip[1] <= 127)) ||
+					(ip[0] >= 240) ||
 					(ip[0] == 127) ||
-					(ip[0] == 169 && ip[1] == 254) ||
-					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
-					(ip[0] == 192 && ip[1] == 0 && ip[2] == 0) ||
-					(ip[0] == 192 && ip[1] == 0 && ip[2] == 2) ||
-					(ip[0] == 192 && ip[1] == 88 && ip[2] == 99) ||
-					(ip[0] == 192 && ip[1] == 168) ||
-					(ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) ||
-					(ip[0] == 198 && ip[1] == 51 && ip[2] == 100) ||
-					(ip[0] == 203 && ip[1] == 0 && ip[2] == 113) ||
-					(ip[0] >= 224 && ip[0] <= 255)
+					(ip[0] == 169 && ip[1] == 254)
 				) {
 					RETURN_VALIDATION_FAILED
 				}
@@ -41,9 +41,9 @@ string(9) "127.0.0.1"
 bool(false)
 string(12) "192.0.34.166"
 bool(false)
-bool(false)
-bool(false)
-bool(false)
+string(9) "192.0.0.1"
+string(10) "100.64.0.0"
+string(15) "100.127.255.255"
 string(12) "192.0.34.166"
 bool(false)
 string(15) "255.255.255.255"
@@ -0,0 +1,23 @@
+--TEST--
+Bug #73054 (default option ignored when object passed to int filter)
+--SKIPIF--
+<?php
+if (!extension_loaded('filter')) die('skip filter extension not available');
+?>
+--FILE--
+<?php
+var_dump(
+    filter_var(new stdClass, FILTER_VALIDATE_INT, [
+        'options' => ['default' => 2],
+    ]),
+    filter_var(new stdClass, FILTER_VALIDATE_INT, [
+        'options' => ['default' => 2],
+        'flags' => FILTER_NULL_ON_FAILURE
+    ])
+);
+?>
+===DONE===
+--EXPECT--
+int(2)
+int(2)
+===DONE===
@@ -85,8 +85,8 @@ string(10) "10.0.0.0/8"
 bool(false)
 bool(false)
 string(14) "168.254.0.0/16"
-bool(false)
-bool(false)
+string(11) "169.254.0.0"
+string(15) "169.254.255.255"
 string(13) "172.16.0.0/12"
 bool(false)
 bool(false)
@@ -97,11 +97,11 @@ string(9) "0.0.0.0/8"
 bool(false)
 bool(false)
 string(10) "10.0.0.0/8"
-bool(false)
-bool(false)
+string(8) "10.0.0.0"
+string(14) "10.255.255.255"
 string(12) "10.64.0.0/10"
-bool(false)
-bool(false)
+string(10) "100.64.0.0"
+string(15) "100.127.255.255"
 string(11) "127.0.0.0/8"
 bool(false)
 bool(false)
@@ -109,32 +109,32 @@ string(14) "169.254.0.0/16"
 bool(false)
 bool(false)
 string(13) "172.16.0.0/12"
-bool(false)
-bool(false)
+string(10) "172.16.0.0"
+string(10) "172.31.0.0"
 string(12) "192.0.0.0/24"
-bool(false)
-bool(false)
+string(9) "192.0.0.0"
+string(11) "192.0.0.255"
 string(12) "192.0.0.0/29"
-bool(false)
-bool(false)
+string(9) "192.0.0.0"
+string(9) "192.0.0.7"
 string(12) "192.0.2.0/24"
-bool(false)
-bool(false)
+string(9) "192.0.2.0"
+string(11) "192.0.2.255"
 string(13) "198.18.0.0/15"
-bool(false)
-bool(false)
+string(10) "198.18.0.0"
+string(14) "198.19.255.255"
 string(15) "198.51.100.0/24"
-bool(false)
-bool(false)
+string(12) "198.51.100.0"
+string(14) "198.51.100.255"
 string(14) "192.88.99.0/24"
-bool(false)
-bool(false)
+string(11) "192.88.99.0"
+string(13) "192.88.99.255"
 string(14) "192.168.0.0/16"
-bool(false)
-bool(false)
+string(11) "192.168.0.0"
+string(15) "192.168.255.255"
 string(14) "203.0.113.0/24"
-bool(false)
-bool(false)
+string(11) "203.0.113.0"
+string(13) "203.0.113.255"
 string(11) "240.0.0.0/4"
-bool(false)
+string(9) "224.0.0.0"
 bool(false)
@@ -8,7 +8,7 @@ if (PHP_GD != "no") {
 	if (
 		CHECK_LIB("libjpeg_a.lib;libjpeg.lib", "gd", PHP_GD) &&
 		CHECK_LIB("freetype_a.lib;freetype.lib", "gd", PHP_GD) &&
-		CHECK_HEADER_ADD_INCLUDE("ft2build.h", "CFLAGS_GD", PHP_GD + ";" + PHP_PHP_BUILD + "\\include" + ";" + PHP_PHP_BUILD + "\\include\\freetype") &&
+		CHECK_HEADER_ADD_INCLUDE("ft2build.h", "CFLAGS_GD", PHP_GD + ";" + PHP_PHP_BUILD + "\\include\\freetype2;" + PHP_PHP_BUILD + "\\include\\freetype") &&
 		CHECK_LIB("libpng_a.lib;libpng.lib", "gd", PHP_GD) &&
 		CHECK_HEADER_ADD_INCLUDE("gd.h", "CFLAGS_GD", PHP_GD + ";ext\\gd\\libgd") &&
 		(CHECK_HEADER_ADD_INCLUDE("png.h", "CFLAGS_GD", PHP_GD +  ";" + PHP_PHP_BUILD + "\\include\\libpng16") ||
@@ -361,45 +361,45 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegif, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()

 #ifdef HAVE_GD_PNG
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagepng, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 #endif

 #ifdef HAVE_GD_WEBP
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewebp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 #endif

 #ifdef HAVE_GD_JPG
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagejpeg, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, quality)
 ZEND_END_ARG_INFO()
 #endif

 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewbmp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, foreground)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegd, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegd2, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, chunk_size)
 	ZEND_ARG_INFO(0, type)
 ZEND_END_ARG_INFO()
@@ -1521,7 +1521,7 @@ PHP_FUNCTION(imageistruecolor)
 /* }}} */

 /* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
-   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
+   Convert a true color image to a palette based image with a number of colors, optionally using dithering. */
 PHP_FUNCTION(imagetruecolortopalette)
 {
 	zval *IM;
@@ -1547,8 +1547,8 @@ PHP_FUNCTION(imagetruecolortopalette)
 }
 /* }}} */

-/* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
-   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
+/* {{{ proto void imagepalettetotruecolor(resource im)
+   Convert a palette based image to a true color image. */
 PHP_FUNCTION(imagepalettetotruecolor)
 {
 	zval *IM;
@@ -2546,11 +2546,11 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char

 	if (argc > 1) {
 		fn = file;
-		if (argc == 3) {
+		if (argc >= 3) {
 			q = quality;
-		}
-		if (argc == 4) {
-			t = type;
+			if (argc == 4) {
+				t = type;
+			}
 		}
 	}

@@ -2681,7 +2681,7 @@ PHP_FUNCTION(imagexbm)
 }
 /* }}} */

-/* {{{ proto bool imagegif(resource im [, string filename])
+/* {{{ proto bool imagegif(resource im [, mixed to])
   Output GIF image to browser or file */
 PHP_FUNCTION(imagegif)
 {
@@ -2690,7 +2690,7 @@ PHP_FUNCTION(imagegif)
 /* }}} */

 #ifdef HAVE_GD_PNG
-/* {{{ proto bool imagepng(resource im [, string filename])
+/* {{{ proto bool imagepng(resource im [, mixed to])
   Output PNG image to browser or file */
 PHP_FUNCTION(imagepng)
 {
@@ -2701,7 +2701,7 @@ PHP_FUNCTION(imagepng)


 #ifdef HAVE_GD_WEBP
-/* {{{ proto bool imagewebp(resource im [, string filename[, int quality]] )
+/* {{{ proto bool imagewebp(resource im [, mixed to[, int quality]] )
   Output WEBP image to browser or file */
 PHP_FUNCTION(imagewebp)
 {
@@ -2712,7 +2712,7 @@ PHP_FUNCTION(imagewebp)


 #ifdef HAVE_GD_JPG
-/* {{{ proto bool imagejpeg(resource im [, string filename [, int quality]])
+/* {{{ proto bool imagejpeg(resource im [, mixed to [, int quality]])
   Output JPEG image to browser or file */
 PHP_FUNCTION(imagejpeg)
 {
@@ -2721,7 +2721,7 @@ PHP_FUNCTION(imagejpeg)
 /* }}} */
 #endif /* HAVE_GD_JPG */

-/* {{{ proto bool imagewbmp(resource im [, string filename [, int foreground]])
+/* {{{ proto bool imagewbmp(resource im [, mixed to [, int foreground]])
   Output WBMP image to browser or file */
 PHP_FUNCTION(imagewbmp)
 {
@@ -2729,7 +2729,7 @@ PHP_FUNCTION(imagewbmp)
 }
 /* }}} */

-/* {{{ proto bool imagegd(resource im [, string filename])
+/* {{{ proto bool imagegd(resource im [, mixed to])
   Output GD image to browser or file */
 PHP_FUNCTION(imagegd)
 {
@@ -2737,7 +2737,7 @@ PHP_FUNCTION(imagegd)
 }
 /* }}} */

-/* {{{ proto bool imagegd2(resource im [, string filename [, int chunk_size [, int type]]])
+/* {{{ proto bool imagegd2(resource im [, mixed to [, int chunk_size [, int type]]])
   Output GD2 image to browser or file */
 PHP_FUNCTION(imagegd2)
 {
@@ -3856,7 +3856,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 {
 	zval *IM, *EXT = NULL;
 	gdImagePtr im=NULL;
-	zend_long col = -1, x = -1, y = -1;
+	zend_long col = -1, x = 0, y = 0;
 	size_t str_len, fontname_len;
 	int i, brect[8];
 	double ptsize, angle;
@@ -191,21 +191,21 @@ static gdImagePtr _gd2CreateFromFile (gdIOCtxPtr in, int *sx, int *sy, int *cs,
 	}
 	if (im == NULL) {
 		GD2_DBG(php_gd_error("Could not create gdImage"));
-		goto fail1;
+		goto fail2;
 	}

 	if (!_gdGetColors(in, im, (*vers) == 2)) {
 		GD2_DBG(php_gd_error("Could not read color palette"));
-		goto fail2;
+		goto fail3;
 	}
 	GD2_DBG(php_gd_error("Image palette completed: %d colours", im->colorsTotal));

 	return im;

-fail2:
+fail3:
 	gdImageDestroy(im);
-	return 0;
-
+fail2:
+	gdFree(*cidx);
 fail1:
 	return 0;
 }
@@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)

 	/* Force fmt to a valid value since we don't return anything. */
 	if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) {
-		fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED;
+		fmt = GD2_FMT_COMPRESSED;
 	}
 	if (im->trueColor) {
 		fmt += 2;
@@ -689,8 +689,8 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
 	}

 	/* Work out number of chunks. */
-	ncx = im->sx / cs + 1;
-	ncy = im->sy / cs + 1;
+	ncx = (im->sx + cs - 1) / cs;
+	ncy = (im->sy + cs - 1) / cs;

 	/* Write the standard header. */
 	_gd2PutHeader (im, out, cs, fmt, ncx, ncy);
@@ -760,7 +760,7 @@ LOCAL (void)
  cinfo->colormap[2][icolor] = (JSAMPLE) ((c2total + (total >> 1)) / total);
 #else
  /* 2.0.16: Paul den Dulk found an occasion where total can be 0 */
-  if (count)
+  if (total)
    {
      nim->red[icolor] = (int) ((c0total + (total >> 1)) / total);
      nim->green[icolor] = (int) ((c1total + (total >> 1)) / total);
@@ -120,6 +120,14 @@ void gdImageWebpCtx (gdImagePtr im, gdIOCtx * outfile, int quantization)
 		quantization = 80;
 	}

+	if (overflow2(gdImageSX(im), 4)) {
+		return;
+	}
+
+	if (overflow2(gdImageSX(im) * 4, gdImageSY(im))) {
+		return;
+	}
+
 	argb = (uint8_t *)gdMalloc(gdImageSX(im) * 4 * gdImageSY(im));
 	if (!argb) {
 		return;
@@ -658,6 +658,8 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 				} else {
 					return "Unsupported ft_pixel_mode";
 				}
+				if (level == 0)  /* if background */
+					continue;
 				if ((fg >= 0) && (im->trueColor)) {
 					/* Consider alpha in the foreground color itself to be an
 					 * upper bound on how opaque things get, when truecolor is
@@ -747,9 +749,9 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 }

 static int
-gdroundupdown (FT_F26Dot6 v1, int updown)
+gdroundupdown (FT_F26Dot6 v1, int roundup)
 {
-	return (!updown) ? (v1 < 0 ? ((v1 - 63) >> 6) : v1 >> 6) : (v1 > 0 ? ((v1 + 63) >> 6) : v1 >> 6);
+	return (!roundup) ? v1 >> 6 : (v1 + 63) >> 6;
 }

 void gdFontCacheShutdown()
@@ -819,8 +821,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 	double cos_a = cos (angle);
 	int len, i = 0, ch;
 	int x1 = 0, y1 = 0;
-	int xb = x, yb = y;
-	int yd = 0;
 	font_t *font;
 	fontkey_t fontkey;
 	char *next;
@@ -981,9 +981,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			  penf.y = (penf.y - 32) & -64;		/* round to next pixel row */
 			  x1 = (int)(- penf.y * sin_a + 32) / 64;
 			  y1 = (int)(- penf.y * cos_a + 32) / 64;
-			  xb = x + x1;
-			  yb = y + y1;
-			  yd = 0;
 			  pen.x = pen.y = 0;
 			  previous = 0;		/* clear kerning flag */
 			  continue;
@@ -1073,31 +1070,32 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		/* retrieve kerning distance and move pen position */
 		if (use_kerning && previous && glyph_index) {
 			FT_Get_Kerning(face, previous, glyph_index, ft_kerning_default, &delta);
-			pen.x += delta.x;
+			pen.x += (int)(delta.x * cos_a);
+			pen.y -= (int)(delta.x * sin_a);
 			penf.x += delta.x;
 		}

-		/* load glyph image into the slot (erase previous one) */
-		if (FT_Load_Glyph(face, glyph_index, render_mode)) {
-			if (tmpstr) {
-				gdFree(tmpstr);
-			}
-			gdCacheDelete(tc_cache);
-			gdMutexUnlock(gdFontCacheMutex);
-			return "Problem loading glyph";
-		}
-
-		/* transform glyph image */
-		if (FT_Get_Glyph(slot, &image)) {
-			if (tmpstr) {
-				gdFree(tmpstr);
-			}
-			gdCacheDelete(tc_cache);
-			gdMutexUnlock(gdFontCacheMutex);
-			return "Problem loading glyph";
-		}
-
 		if (brect) { /* only if need brect */
+			/* load glyph image into the slot (erase previous one) */
+			if (FT_Load_Glyph(face, glyph_index, render_mode | FT_LOAD_IGNORE_TRANSFORM)) {
+				if (tmpstr) {
+					gdFree(tmpstr);
+				}
+				gdCacheDelete(tc_cache);
+				gdMutexUnlock(gdFontCacheMutex);
+				return "Problem loading glyph";
+			}
+
+			/* transform glyph image */
+			if (FT_Get_Glyph(slot, &image)) {
+				if (tmpstr) {
+					gdFree(tmpstr);
+				}
+				gdCacheDelete(tc_cache);
+				gdMutexUnlock(gdFontCacheMutex);
+				return "Problem loading glyph";
+			}
+
 			FT_Glyph_Get_CBox(image, ft_glyph_bbox_gridfit, &glyph_bbox);
 			glyph_bbox.xMin += penf.x;
 			glyph_bbox.yMin += penf.y;
@@ -1107,17 +1105,11 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 				glyph_bbox.xMax += slot->metrics.horiAdvance;
 			}
 			if (!i) { /* if first character, init BB corner values */
-				yd = slot->metrics.height - slot->metrics.horiBearingY;
 				bbox.xMin = glyph_bbox.xMin;
 				bbox.yMin = glyph_bbox.yMin;
 				bbox.xMax = glyph_bbox.xMax;
 				bbox.yMax = glyph_bbox.yMax;
 			} else {
-				FT_Pos desc;
-
-				if ( (desc = (slot->metrics.height - slot->metrics.horiBearingY)) > yd) {
-					yd = desc;
-				}
 				if (bbox.xMin > glyph_bbox.xMin) {
 					bbox.xMin = glyph_bbox.xMin;
 				}
@@ -1134,7 +1126,35 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			i++;
 		}

+		/* increment (unrotated) pen position */
+		penf.x += slot->metrics.horiAdvance;
+
 		if (render) {
+			if (!brect || angle != 0) {
+				/* reload the rotated glyph (for bbox we needed FT_LOAD_IGNORE_TRANSFORM - bbox is rotated later) */
+				FT_Done_Glyph(image);
+
+				/* load glyph image into the slot (erase previous one) */
+				if (FT_Load_Glyph(face, glyph_index, render_mode)) {
+					if (tmpstr) {
+						gdFree(tmpstr);
+					}
+					gdCacheDelete(tc_cache);
+					gdMutexUnlock(gdFontCacheMutex);
+					return "Problem loading glyph";
+				}
+
+				/* transform glyph image */
+				if (FT_Get_Glyph(slot, &image)) {
+					if (tmpstr) {
+						gdFree(tmpstr);
+					}
+					gdCacheDelete(tc_cache);
+					gdMutexUnlock(gdFontCacheMutex);
+					return "Problem loading glyph";
+				}
+			}
+
 			if (image->format != ft_glyph_format_bitmap && FT_Glyph_To_Bitmap(&image, ft_render_mode_normal, 0, 1)) {
 				FT_Done_Glyph(image);
 				if (tmpstr) {
@@ -1157,8 +1177,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		pen.x += image->advance.x >> 10;
 		pen.y -= image->advance.y >> 10;

-		penf.x += slot->metrics.horiAdvance;
-
 		FT_Done_Glyph(image);
 	}

@@ -1167,36 +1185,25 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		double d1 = sin (angle + 0.78539816339744830962);
 		double d2 = sin (angle - 0.78539816339744830962);

-		/* make the center of rotation at (0, 0) */
-		FT_BBox normbox;
-
-		normbox.xMin = 0;
-		normbox.yMin = 0;
-		normbox.xMax = bbox.xMax - bbox.xMin;
-		normbox.yMax = bbox.yMax - bbox.yMin;
-
-		brect[0] = brect[2] = brect[4] = brect[6] = (int)  (yd * sin_a);
-		brect[1] = brect[3] = brect[5] = brect[7] = (int)(- yd * cos_a);
-
-		/* rotate bounding rectangle */
-		brect[0] += (int) (normbox.xMin * cos_a - normbox.yMin * sin_a);
-		brect[1] += (int) (normbox.xMin * sin_a + normbox.yMin * cos_a);
-		brect[2] += (int) (normbox.xMax * cos_a - normbox.yMin * sin_a);
-		brect[3] += (int) (normbox.xMax * sin_a + normbox.yMin * cos_a);
-		brect[4] += (int) (normbox.xMax * cos_a - normbox.yMax * sin_a);
-		brect[5] += (int) (normbox.xMax * sin_a + normbox.yMax * cos_a);
-		brect[6] += (int) (normbox.xMin * cos_a - normbox.yMax * sin_a);
-		brect[7] += (int) (normbox.xMin * sin_a + normbox.yMax * cos_a);
+		/* rotate bounding rectangle (at 0, 0) */
+		brect[0] = (int) (bbox.xMin * cos_a - bbox.yMin * sin_a);
+		brect[1] = (int) (bbox.xMin * sin_a + bbox.yMin * cos_a);
+		brect[2] = (int) (bbox.xMax * cos_a - bbox.yMin * sin_a);
+		brect[3] = (int) (bbox.xMax * sin_a + bbox.yMin * cos_a);
+		brect[4] = (int) (bbox.xMax * cos_a - bbox.yMax * sin_a);
+		brect[5] = (int) (bbox.xMax * sin_a + bbox.yMax * cos_a);
+		brect[6] = (int) (bbox.xMin * cos_a - bbox.yMax * sin_a);
+		brect[7] = (int) (bbox.xMin * sin_a + bbox.yMax * cos_a);

 		/* scale, round and offset brect */
-		brect[0] = xb + gdroundupdown(brect[0], d2 > 0);
-		brect[1] = yb - gdroundupdown(brect[1], d1 < 0);
-		brect[2] = xb + gdroundupdown(brect[2], d1 > 0);
-		brect[3] = yb - gdroundupdown(brect[3], d2 > 0);
-		brect[4] = xb + gdroundupdown(brect[4], d2 < 0);
-		brect[5] = yb - gdroundupdown(brect[5], d1 > 0);
-		brect[6] = xb + gdroundupdown(brect[6], d1 < 0);
-		brect[7] = yb - gdroundupdown(brect[7], d2 < 0);
+		brect[0] = x + gdroundupdown(brect[0], d2 > 0);
+		brect[1] = y - gdroundupdown(brect[1], d1 < 0);
+		brect[2] = x + gdroundupdown(brect[2], d1 > 0);
+		brect[3] = y - gdroundupdown(brect[3], d2 > 0);
+		brect[4] = x + gdroundupdown(brect[4], d2 < 0);
+		brect[5] = y - gdroundupdown(brect[5], d1 > 0);
+		brect[6] = x + gdroundupdown(brect[6], d1 < 0);
+		brect[7] = y - gdroundupdown(brect[7], d2 < 0);
 	}

 	if (tmpstr) {
@@ -8,16 +8,13 @@ Bug #22544 (TrueColor transparency in PNG images).
 ?>
 --FILE--
 <?php
-	$dest = dirname(realpath(__FILE__)) . '/bug22544私はガラスを食べられます.png';
-	@unlink($dest);
 	$image = imageCreateTruecolor(640, 100);
 	$transparent = imageColorAllocate($image, 0, 0, 0);
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	imagegd($image, $dest);
-	echo md5_file($dest) . "\n";
-	@unlink($dest);
+	include_once __DIR__ . '/func.inc';
+	test_image_equals_file(__DIR__ . '/bug22544私はガラスを食べられます.png', $image);
 ?>
 --EXPECT--
-7643ef115f642a79c2de6e411f485ddd
+The images are equal.
@@ -8,16 +8,13 @@ Bug #22544 (TrueColor transparency in PNG images).
 ?>
 --FILE--
 <?php
-	$dest = dirname(realpath(__FILE__)) . '/bug22544.png';
-	@unlink($dest);
 	$image = imageCreateTruecolor(640, 100);
 	$transparent = imageColorAllocate($image, 0, 0, 0);
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	imagegd($image, $dest);
-	echo md5_file($dest) . "\n";
-	@unlink($dest);
+	include_once __DIR__ . '/func.inc';
+	test_image_equals_file(__DIR__ . '/bug22544.png', $image);
 ?>
 --EXPECT--
-7643ef115f642a79c2de6e411f485ddd
+The images are equal.
@@ -1,29 +1,53 @@
 --TEST--
-Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype < 2.4.10
+Bug #43073 (TrueType bounding box is wrong for angle<>0)
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
+$exp = [
+	[501,400, 611,400, 611,376, 501,376],
+	[492,361, 595,319, 586,296, 483,338],
+	[470,329, 549,251, 531,233, 453,312],
+	[439,307, 481,204, 458,195, 416,297],
+	[400,299, 400,189, 376,189, 376,299],
+	[361,307, 319,204, 296,213, 338,316],
+	[329,329, 251,250, 233,267, 311,346],
+	[307,360, 204,318, 195,341, 297,383],
+	[299,400, 189,400, 189,424, 299,424],
+	[307,438, 204,480, 213,503, 316,461],
+	[329,470, 250,548, 267,566, 346,488],
+	[360,492, 318,595, 341,604, 383,502],
+	[400,501, 400,611, 424,611, 424,501],
+	[438,492, 480,595, 503,586, 461,483],
+	[470,470, 548,549, 566,532, 488,453],
+	[492,439, 595,481, 604,458, 502,416]
+];
 $cwd = dirname(__FILE__);
 $font = "$cwd/Tuffy.ttf";
 $delta_t = 360.0 / 16; # Make 16 steps around
 $g = imagecreate(800, 800);
 $bgnd  = imagecolorallocate($g, 255, 255, 255);
 $black = imagecolorallocate($g, 0, 0, 0);
+$red = imagecolorallocate($g, 255, 0, 0);
 $x = 100;
 $y = 0;
 $cos_t = cos(deg2rad($delta_t));
 $sin_t = sin(deg2rad($delta_t));
-for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
+for ($angle = 0.0, $i = 0; $angle < 360.0; $angle += $delta_t, $i++) {
  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
-  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
-  echo $s;
+  imagepolygon($g, $bbox, 4, $red);
+  printf("%2d: ", $i);
+  for ($j = 0; $j < 8; $j++) {
+	if ($bbox[$j] >= $exp[$i][$j] - 1 && $bbox[$j] <= $exp[$i][$j] + 1) {
+		echo '.';
+	} else {
+		echo "(expected $exp[$i][$j], got $bbox[$j])";
+	}
+  }
+  echo "\n";
  $temp = $cos_t * $x + $sin_t * $y;
  $y    = $cos_t * $y - $sin_t * $x;
  $x    = $temp;
@@ -32,20 +56,20 @@ imagepng($g, "$cwd/bug43073.png");
 ?>
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
--EXPECTF--
-(500, 40%d), (610, 40%d), (610, 376), (500, 376)
-(492, 363), (591, 322), (580, 295), (480, 336)
-(470, 331), (548, 254), (527, 233), (449, 310)
-(439, 309), (483, 202), (461, 193), (416, 299)
-(40%d, 300), (40%d, 183), (38%d, 183), (38%d, 300)
-(362, 307), (316, 195), (291, 205), (337, 318)
-(330, 329), (246, 244), (224, 265), (308, 350)
-(308, 360), (202, 316), (190, 344), (296, 388)
-(300, %d), (18%d, %d), (18%d, 425), (%d, 425)
-(306, 437), (195, 483), (206, 510), (318, 464)
-(328, 469), (240, 557), (260, 578), (349, 491)
-(359, 491), (312, 607), (334, 616), (382, 501)
-(%d, 500), (%d, 618), (41%d, 618), (41%d, 500)
-(436, 493), (483, 607), (507, 597), (461, 482)
-(468, 471), (555, 558), (577, 538), (490, 450)
-(490, 440), (600, 485), (611, 457), (502, 412)
+--EXPECT--
+ 0: ........
+ 1: ........
+ 2: ........
+ 3: ........
+ 4: ........
+ 5: ........
+ 6: ........
+ 7: ........
+ 8: ........
+ 9: ........
+10: ........
+11: ........
+12: ........
+13: ........
+14: ........
+15: ........
@@ -1,51 +0,0 @@
--TEST--
-Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype >= 2.4.10
--SKIPIF--
-<?php
-	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
-?>
--FILE--
-<?php
-$cwd = dirname(__FILE__);
-$font = "$cwd/Tuffy.ttf";
-$delta_t = 360.0 / 16; # Make 16 steps around
-$g = imagecreate(800, 800);
-$bgnd  = imagecolorallocate($g, 255, 255, 255);
-$black = imagecolorallocate($g, 0, 0, 0);
-$x = 100;
-$y = 0;
-$cos_t = cos(deg2rad($delta_t));
-$sin_t = sin(deg2rad($delta_t));
-for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
-  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
-  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
-  echo $s;
-  $temp = $cos_t * $x + $sin_t * $y;
-  $y    = $cos_t * $y - $sin_t * $x;
-  $x    = $temp;
-}
-imagepng($g, "$cwd/bug43073.png");
-?>
--CLEAN--
-<?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
--EXPECTF--
-(500, 400), (610, 400), (610, 376), (500, 376)
-(492, 363), (591, 322), (580, 295), (480, 336)
-(470, 331), (548, 254), (527, 233), (449, 310)
-(439, 309), (483, 202), (461, 193), (416, 299)
-(400, 300), (400, 183), (380, 183), (380, 300)
-(362, 307), (316, 195), (291, 205), (337, 318)
-(330, 329), (246, 244), (224, 265), (308, 350)
-(308, 360), (202, 316), (190, 344), (296, 388)
-(300, 400), (187, 400), (187, 425), (300, 425)
-(306, 437), (195, 483), (206, 510), (318, 464)
-(328, 469), (240, 557), (260, 578), (349, 491)
-(359, 491), (312, 607), (334, 616), (382, 501)
-(400, 500), (400, 618), (419, 618), (419, 500)
-(436, 493), (483, 607), (507, 597), (461, 482)
-(468, 471), (555, 558), (577, 538), (490, 450)
-(490, 440), (600, 485), (611, 457), (502, 412)
@@ -17,10 +17,10 @@ imagefilledrectangle($im, 0,0, 99,99, $transparent);
 $color = imagecolorallocatealpha($im, 0, 255, 0, 100);
 imagefilledarc($im, 49, 49, 99,99, 0 , 360, $color, IMG_ARC_PIE);

-ob_start();
-imagegd($im);
-echo md5(ob_get_clean());
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/bug43828.png', $im);
+
 imagedestroy($im);
 ?>
 --EXPECT--
-2400a58cd7570b5472c25264715321cd
+The images are equal.
@@ -4,12 +4,8 @@ Bug #48732 (TTF Bounding box wrong for letters below baseline)
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagefttext')) die('skip imagefttext() not available');
-	if (substr(PHP_OS, 0, 3) != 'WIN') {
-	    die('skip.. only for Windows');
-	}
+	if (substr(PHP_OS, 0, 3) == 'WIN') die('skip UTF-8 font file names not yet supported on Windows');
 ?>
--XFAIL--
-seems freetype issue, to investigate
 --FILE--
 <?php
 $cwd = dirname(__FILE__);
@@ -24,4 +20,4 @@ echo 'Left Bottom: (' . $bbox[0]  . ', ' . $bbox[1] . ')';
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48732私はガラスを食べられます.png'); ?>
 --EXPECTF--
-Left Bottom: (0, 47)
+Left Bottom: (0, 46)
@@ -19,4 +19,4 @@ echo 'Left Bottom: (' . $bbox[0]  . ', ' . $bbox[1] . ')';
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48732.png'); ?>
 --EXPECTF--
-Left Bottom: (0, 47)
+Left Bottom: (0, 46)
@@ -1,12 +1,10 @@
 --TEST--
-Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
+Bug #48801 (Problem with imagettfbbox)
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
+	if (substr(PHP_OS, 0, 3) == 'WIN') die('skip UTF-8 font file names not yet supported on Windows');
 ?>
 --FILE--
 <?php
@@ -18,8 +16,8 @@ echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
 echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
 echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
--EXPECTF--
-(-1, 15)
-(15%d, 15)
-(15%d, -48)
-(-1, -48)
+--EXPECTREGEX--
+\(4, 15\)
+\(16[0-1], 15\)
+\(16[0-1], -4[7-8]\)
+\(4, -4[7-8]\)
@@ -1,12 +1,9 @@
 --TEST--
-Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
+Bug #48801 (Problem with imagettfbbox)
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
@@ -18,8 +15,8 @@ echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
 echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
 echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
--EXPECTF--
-(-1, 15)
-(15%d, 15)
-(15%d, -48)
-(-1, -48)
+--EXPECTREGEX--
+\(4, 15\)
+\(16[0-1], 15\)
+\(16[0-1], -4[7-8]\)
+\(4, -4[7-8]\)
@@ -1,25 +0,0 @@
--TEST--
-Bug #48801 (Problem with imagettfbbox) freetype >= 2.4.10
--SKIPIF--
-<?php
-	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
-?>
--FILE--
-<?php
-$cwd = dirname(__FILE__);
-$font = "$cwd/Tuffy.ttf";
-$bbox = imageftbbox(50, 0, $font, "image");
-echo '(' . $bbox[0] . ', ' . $bbox[1] . ")\n";
-echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
-echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
-echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
-?>
--EXPECTF--
-(-1, 15)
-(15%d, 15)
-(15%d, -48)
-(-1, -48)
@@ -0,0 +1,38 @@
+--TEST--
+Bug #50194 (imagettftext broken on transparent background w/o alphablending)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!function_exists('imagettftext')) die('skip imagettftext() not available');
+//die('skip freetype issues');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(240, 55);
+$background = imagecolorallocatealpha($im, 60, 60, 60, 0); // no tranparency
+$black = imagecolorallocate($im, 0, 0, 0);
+imagealphablending($im, false); 
+imagefilledrectangle($im, 0, 0, 239, 54, $background);
+$text = 'Testing ... ';
+$font = __DIR__ . DIRECTORY_SEPARATOR . 'Tuffy.ttf';
+imagettftext($im, 40, 0, 10, 40, $black, $font, $text);
+imagesavealpha($im, true);
+
+ob_start();
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug50194.png', $im);
+$output = ob_get_clean();
+assert(preg_match('/The images are equal|The images differ in (\d+) pixels/', $output, $matches));
+if (isset($matches[1]) && $matches[1] > 2000) {
+    echo "The images differ in {$matches[1]} pixels.\n";
+} else {
+    echo "The images are similar.\n";
+}
+
+imagedestroy($im);
+?>
+===DONE===
+--EXPECT--
+The images are similar.
+===DONE===
@@ -3,6 +3,9 @@ Bug #53156 (imagerectangle problem with point ordering)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.3', '<')) {
+    die("skip test requires GD 2.3 or newer");
+}
 ?>
 --FILE--
 <?php
@@ -0,0 +1,107 @@
+--TEST--
+Bug #53504 imagettfbbox/imageftbbox gives incorrect values for bounding box
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
+?>
+--FILE--
+<?php
+$cwd = dirname(__FILE__);
+$font = "$cwd/Tuffy.ttf";
+
+$g = imagecreate(800, 800);
+$bgnd  = imagecolorallocate($g, 255, 255, 255);
+$black = imagecolorallocate($g, 0, 0, 0);
+$red = imagecolorallocate($g, 255, 0, 0);
+$blue = imagecolorallocate($g, 0, 0, 255);
+
+$tests = [
+    // Kerning examples (unfortunately not available in "Tuffy" test font):
+    ['fontSize' => 50, 'angle' => 0, 'x' => 20, 'y' => 70, 'text' => 'AV Teg', 'exp' => [2,15, 208,15, 208,-48, 2,-48]],
+    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 350, 'text' => 'AV Teg', 'exp' => [15,-1, 15,-208, -48,-208, -48,-2]],
+    ['fontSize' => 50, 'angle' => 40, 'x' => 130, 'y' => 280, 'text' => 'AV Teg', 'exp' => [11,11, 169,-122, 129,-171, -30,-39]],
+
+    // Shift-Test:
+    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 110, 'text' => 'H-Shift', 'exp' => [8,2, 386,2, 386,-97, 8,-97]],
+
+    // Small/single chars:
+    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 220, 'text' => '-', 'exp' => [7,-37, 51,-37, 51,-46, 7,-46]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 430, 'y' => 220, 'text' => ',', 'exp' => [7,15, 21,15, 21,-13, 7,-13]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 510, 'y' => 220, 'text' => '.', 'exp' => [7,1, 21,1, 21,-13, 7,-13]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 590, 'y' => 220, 'text' => '|', 'exp' => [8,0, 17,0, 17,-95, 8,-95]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 670, 'y' => 220, 'text' => 'g', 'exp' => [5,29, 60,29, 60,-72, 5,-72]],
+
+    // Multi-Line + rotation:
+    ['fontSize' => 30, 'angle' => 0, 'x' => 20, 'y' => 400, 'text' => "Multi\nLine\nTest", 'exp' => [2,107, 80,107, 80,-29, 2,-29]],
+    ['fontSize' => 30, 'angle' => 40, 'x' => 150, 'y' => 420, 'text' => "Multi\nLine\nTest", 'exp' => [70,81, 131,31, 43,-74, -18,-24]],
+    ['fontSize' => 30, 'angle' => 90, 'x' => 250, 'y' => 340, 'text' => "Multi\nLine\nTest", 'exp' => [107,-1, 107,-80, -29,-80, -29,-2]],
+
+    // Some edge case glyphs:
+    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [0,-4, 0,-165, -47,-165, -47,-4]],
+    ['fontSize' => 50, 'angle' => 90, 'x' => 150, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-19,-2, -18,-167, -29,-167, -29,-2]],
+    ['fontSize' => 50, 'angle' => 50, 'x' => 210, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [3,-3, 107,-127, 70,-157, -34,-33]],
+    ['fontSize' => 50, 'angle' => 50, 'x' => 300, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-13,-13, 93,-141, 85,-147, -21,-20]],
+    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 650, 'text' => "iiiiiiiiiiii", 'exp' => [4,0, 165,0, 165,-47, 4,-47]],
+    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [2,-19, 167,-19, 167,-29, 2,-29]],
+
+    // "Big" test:
+    ['fontSize' => 200, 'angle' => 0, 'x' => 400, 'y' => 500, 'text' => "Big", 'exp' => [16,59, 329,59, 329,-190, 16,-190]],
+];
+
+foreach ($tests as $testnum => $test) {
+    $bbox = imageftbbox($test['fontSize'], $test['angle'], $font, $test['text']);
+	printf('%2d: ', $testnum);
+	for ($i = 0; $i < 8; $i++) {
+		$exp = $test['exp'][$i];
+		if ($bbox[$i] >= $exp - 2 && $bbox[$i] <= $exp + 2) {
+			echo '.';
+		} else {
+			echo "(expected $exp, got $bbox[$i])";
+		}
+	}
+	echo "\n";
+
+    $bboxDrawn = imagefttext($g, $test['fontSize'], $test['angle'],
+        $test['x'], $test['y'], $black, $font, $test['text']);
+
+    // check if both bboxes match when adding x/y offset:
+    for ($i = 0; $i < count($bbox); $i += 2) {
+        if ($bbox[$i] + $test['x'] !== $bboxDrawn[$i]) echo "imageftbbox and imagefttext differ!\n";
+        if ($bbox[$i + 1] + $test['y'] !== $bboxDrawn[$i + 1]) echo "imageftbbox and imagefttext differ!\n";
+    }
+
+    // draw bounding box:
+    imagepolygon($g, $bboxDrawn, 4, $red);
+
+    // draw baseline:
+    $width = sqrt(pow($bboxDrawn[2] - $bboxDrawn[0], 2) + pow($bboxDrawn[3] - $bboxDrawn[1], 2));
+    imageline($g, $test['x'], $test['y'],
+        $test['x'] + $width * cos(deg2rad($test['angle'])),
+        $test['y'] - $width * sin(deg2rad($test['angle'])), $blue);
+}
+
+imagepng($g, "$cwd/bug53504.png");
+?>
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug53504.png'); ?>
+--EXPECT--
+ 0: ........
+ 1: ........
+ 2: ........
+ 3: ........
+ 4: ........
+ 5: ........
+ 6: ........
+ 7: ........
+ 8: ........
+ 9: ........
+10: ........
+11: ........
+12: ........
+13: ........
+14: ........
+15: ........
+16: ........
+17: ........
+18: ........
@@ -25,11 +25,10 @@ imagecopy($dest, $png_palette, 0, 0, 0, 0, 50, 50);
 imagecopy($dest, $png_24, 50, 0, 0, 0, 50, 50);
 imagecopy($dest, $png_full, 100, 0, 0, 0, 50, 50);

-ob_start();
-imagegd($dest);
-echo md5(ob_get_clean()), PHP_EOL;
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/bug66005.png', $dest);
 ?>
 ==DONE==
 --EXPECT--
-9b36049de01006b367efd433f1689043
+The images are equal.
 ==DONE==
@@ -3,6 +3,9 @@ Bug #66590 (imagewebp() doesn't pad to even length)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
+    die("skip test requires GD 2.2.0 or higher");
+}
 if (!function_exists('imagewebp')) die('skip WebP support not available');
 ?>
 --FILE--
@@ -0,0 +1,32 @@
+--TEST--
+Bug #67325 (imagetruecolortopalette: white is duplicated in palette)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<=')) {
+    die("skip test requires newer than GD 2.2.3");
+}
+ if (!(imagetypes() & IMG_JPG)) die('skip JPEG support not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug67325.jpeg';
+
+$im = imagecreatefromjpeg($filename);
+imagetruecolortopalette($im, 0, 256);
+
+$white = 0;
+for ($i = 0; $i < 256; $i++) {
+    $components = imagecolorsforindex($im, $i);
+    if ($components['red'] === 255 && $components['green'] === 255 && $components['blue'] === 255) {
+        $white++;
+    }
+}
+var_dump($white);
+
+imagedestroy($im);
+?>
+===DONE===
+--EXPECT--
+int(0)
+===DONE===
@@ -23,10 +23,19 @@ imagecolorallocate($image, 0, 0, 255); // first palette color = background
 $red = imagecolorallocate($image, 255, 0, 0);
 imagefill($image, 0, 0, $red);
 $cropped = imagecrop($image, ['x' => 0, 'y' => 0, 'width' => 250, 'height' => 250]);
-var_dump(imagecolorat($cropped, 249, 249) === $red);
+var_dump(imagecolorsforindex($cropped, imagecolorat($cropped, 249, 249)));
 imagedestroy($image);
 imagedestroy($cropped);
 ?>
 --EXPECT--
 bool(true)
-bool(true)
+array(4) {
+  ["red"]=>
+  int(255)
+  ["green"]=>
+  int(0)
+  ["blue"]=>
+  int(0)
+  ["alpha"]=>
+  int(0)
+}
@@ -3,6 +3,9 @@ Bug #70102 (imagecreatefromwebm() shifts colors)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
+    die("skip test requires GD 2.2.0 or higher");
+}
 if (!function_exists('imagewebp') || !function_exists('imagecreatefromwebp'))
    die('skip WebP support not available');
 ?>
@@ -10,10 +10,9 @@ if (!(imagetypes() & IMG_PNG)) die('skip requires PNG support');
 $im = imagecreatetruecolor(100, 100);
 imagesetthickness($im, 5);
 imagearc($im, 50, 50, 90, 90, 0, 360, 0xffffff);
-ob_start();
-imagegd($im);
-$imagestring = ob_get_clean();
-echo md5($imagestring);
+
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/bug72604.png', $im);
 ?>
 --EXPECT--
-4f5080080a774efe4fc8d55cd4a5849c
+The images are equal.
@@ -19,11 +19,10 @@ imagesavealpha($dst, true);

 imagecopy($dst, $src, 0,0, 0,0, 50,50);

-ob_start();
-imagegd($dst);
-echo md5(ob_get_clean()), PHP_EOL;
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/bug72913.png', $dst);
 ?>
 ==DONE==
 --EXPECT--
-f03c27f20710e21debd7090c660f1a1e
+The images are equal.
 ==DONE==
@@ -0,0 +1,28 @@
+--TEST--
+Bug #73155 (imagegd2() writes wrong chunk sizes on boundaries)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(64, 64);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 64, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size/nformat/nx_count/ny_count', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+printf("x chunk count: %d\n", $header['x_count']);
+printf("y chunk count: %d\n", $header['y_count']);
+printf("file size: %d\n", strlen($buffer));
+?>
+===DONE===
+--EXPECT--
+chunk size: 64
+x chunk count: 1
+y chunk count: 1
+file size: 5145
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73157 (imagegd2() ignores 3rd param if 4 are given)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(8, 8);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 256, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+?>
+===DONE===
+--EXPECT--
+chunk size: 256
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+
+ob_start();
+imagegd2($im, null, 128, 0);
+$buffer = ob_get_clean();
+
+$header = unpack('@12/nformat', $buffer);
+printf("format: %d\n", $header['format']);
+?>
+===DONE===
+--EXPECT--
+format: 4
+===DONE===
@@ -0,0 +1,18 @@
+--TEST--
+Bug #73161 (imagecreatefromgd2() may leak memory)
+--DESCRIPTION--
+We're testing for a memory leak that might not even show up with valgrind.
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73161.gd2');
+var_dump($im);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -59,3 +59,90 @@ function get_libxpm_version()
 	return $version;
 }

+/**
+ * Tests that an in-memory image equals a PNG file.
+ *
+ * It checks for equal image sizes, and whether any pixels are different.
+ * The textual result is printed, so the EXPECT section should contain the line
+ * "The images are equal."
+ *
+ * If the PNG file does not exists, or the images are not equal, a diagnostic
+ * message is printed, and the actual file is stored right beside the temporary
+ * .php test file with the extension .out.png, to be able to manually inspect
+ * the result.
+ *
+ * @param string $filename
+ * @param resource $actual
+ * @return void
+ */
+function test_image_equals_file($filename, $actual)
+{
+	if (!file_exists($filename)) {
+		echo "The expected image does not exist.\n";
+		save_actual_image($actual);
+		return;
+	}
+	$actual = test_to_truecolor($actual);
+	$expected = imagecreatefrompng($filename);
+	$expected = test_to_truecolor($expected);
+	$exp_x = imagesx($expected);
+	$exp_y = imagesy($expected);
+	$act_x = imagesx($actual);
+	$act_y = imagesy($actual);
+	if ($exp_x != $act_x || $exp_y != $act_y) {
+		echo "The image size differs: expected {$exp_x}x{$exp_y}, got {$act_x}x{$act_y}.\n";
+		save_actual_image($actual);
+		return;
+	}
+	$pixels_changed = 0;
+	for ($y = 0; $y < $exp_y; $y++) {
+		for ($x = 0; $x < $exp_x; $x ++) {
+			$exp_c = imagecolorat($expected, $x, $y);
+			$act_c = imagecolorat($actual, $x, $y);
+			if ($exp_c != $act_c) {
+				$pixels_changed++;
+			}
+		}
+	}
+	if (!$pixels_changed) {
+		echo "The images are equal.\n";
+	} else {
+		echo "The images differ in {$pixels_changed} pixels.\n";
+		save_actual_image($actual);
+	}
+}
+
+/**
+ * Returns the truecolor version of an image.
+ *
+ * @param resource $image
+ * @return resource
+ */
+function test_to_truecolor($image)
+{
+	if (imageistruecolor($image)) {
+		return $image;
+	} else {
+		$width = imagesx($image);
+		$height = imagesy($image);
+		$result = imagecreatetruecolor($width, $height);
+		imagecopy($result, $image, 0,0, 0,0, $width, $height);
+		return $result;
+	}
+}
+
+/**
+ * Saves an actual image to disk.
+ *
+ * The image is saved right beside the temporary .php test file with the
+ * extension .out.png.
+ *
+ * @param resource $image
+ * @return void
+ */
+function save_actual_image($image)
+{
+	$pathinfo = pathinfo($_SERVER['SCRIPT_FILENAME']);
+	$filename = "{$pathinfo['dirname']}/{$pathinfo['filename']}.out.png";
+	imagepng($image, $filename);
+}
@@ -17,12 +17,8 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 //create an arc with white color    
 imagearc($image, 50, 50, 30, 30, 0, 180, $white);

-ob_start();
-imagegd($image);
-$img = ob_get_contents();
-ob_end_clean();
-
-echo md5(base64_encode($img));
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/imagearc_basic.png', $image);
 ?>
 --EXPECT--
-13149c3fd54a92a0d43cd5083a19b1d7
+The images are equal.
@@ -17,13 +17,9 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 //create an arc with white color    
 imagearc($image, 50, 50, 30, 30, 0, 180);

-ob_start();
-imagegd($image);
-$img = ob_get_contents();
-ob_end_clean();
-
-echo md5(base64_encode($img));
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/imagearc_error1.png', $image);
 ?>
 --EXPECTF--
 Warning: imagearc() expects exactly 8 parameters, 7 given in %s on line %d
-c5b7013900f5466aebfc42499a7ec8ec
+The images are equal.
@@ -17,12 +17,8 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 //create an arc with white color    
 imagearc($image, 50, 50, 30, 30, 0, -90, $white);

-ob_start();
-imagegd($image);
-$img = ob_get_contents();
-ob_end_clean();
-
-echo md5(base64_encode($img));
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/imagearc_variation1.png', $image);
 ?>
 --EXPECT--
-fe662ebe7488057c43e38c5de43b1727
+The images are equal.
@@ -17,12 +17,8 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 //create an arc with white color    
 imagearc($image, 50, 50, 30, 30, -90, 0, $white);

-ob_start();
-imagegd($image);
-$img = ob_get_contents();
-ob_end_clean();
-
-echo md5(base64_encode($img));
+include_once __DIR__ . '/func.inc';
+test_image_equals_file(__DIR__ . '/imagearc_variation2.png', $image);
 ?>
 --EXPECT--
-8bd78aa775b5f29e7227eaeebaa84889
+The images are equal.