Set versions and date

* PHP-5.6:
  [ci skip] Update NEWS

.appveyor.yml

@@ -0,0 +1,56 @@
+
+version: "{branch}.build.{build}"
+
+image: Visual Studio 2015
+
+branches:
+        except:
+                - PHP-5.6
+                - PHP-7.0
+
+skip_commits:
+        files:
+                - NEWS
+                - UPGRADING*
+                - README.*
+
+clone_depth: 64
+
+cache:
+        - c:\build-cache
+
+environment:
+        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
+        PHP_BUILD_OBJ_DIR: c:\obj
+        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.13
+        # ext and env setup for tests
+        #MYSQL_TEST_PASSWD: Password12!
+        #MYSQL_TEST_USER: root
+        #PDO_MYSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=root password=Password12!"
+        #PDO_MYSQL_TEST_USER: root
+        #PDO_MYSQL_TEST_PASS: Password12!
+        #PGSQL_TEST_CONNSTR: "host=127.0.0.1 dbname=test port=5432 user=postgres password=Password12!"
+        #PDO_PGSQL_TEST_DSN: "pgsql:host=127.0.0.1 port=5432 dbname=test user=postgres password=Password12!"
+        #build permutations
+        matrix:
+                - THREAD_SAFE: 0
+                  OPCACHE: 0
+                - THREAD_SAFE: 1
+                  OPCACHE: 1
+
+services:
+        # the setup scripts have to be touched, once some other db version is used
+        - mysql
+        - postgresql96
+
+platform:
+        - x64
+          #        - x86
+
+build_script:
+        - appveyor\build.bat
+
+test_script:
+        - appveyor\test.bat
+

.editorconfig

@@ -1,16 +1,35 @@
-; http://editorconfig.org/
+# http://editorconfig.org/
 
 root = true
 
-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
+[*.{c,h,awk,w32,bat,mk,frag}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-insert_final_newline     = true
 tab_width                = 4
 trim_trailing_whitespace = true
+insert_final_newline     = true
 
-[*.yml]
+[*.{php,phpt}]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.{yml,m4,sh}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 2
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.md]
+charset                  = utf-8
+end_of_line              = lf
+indent_style             = space
+trim_trailing_whitespace = false
+insert_final_newline     = true

.gdbinit

@@ -29,22 +29,33 @@ document ____executor_globals
 end
 
 define print_cvs
-	____executor_globals
-	set $p = $eg.current_execute_data.CVs
-	set $c = $eg.current_execute_data.op_array.last_var
-	set $v = $eg.current_execute_data.op_array.vars
-	set $i = 0
-
-	printf "Compiled variables count: %d\n", $c
-	while $i < $c
-		printf "%d = %s\n", $i, $v[$i].name
-		if $p[$i] != 0
-			printzv *$p[$i]
-		else
-			printf "*uninitialized*\n"
-		end
-		set $i = $i + 1
+	if $argc == 0
+		____executor_globals
+		set $cv_ex_ptr = $eg.current_execute_data
+	else
+		set $cv_ex_ptr = (zend_execute_data *)$arg0
 	end
+	set $cv_count = $cv_ex_ptr.func.op_array.last_var
+	set $cv = $cv_ex_ptr.func.op_array.vars
+	set $cv_idx = 0
+	set $callFrameSize = (sizeof(zend_execute_data) + sizeof(zval) - 1) / sizeof(zval)
+
+	printf "Compiled variables count: %d\n\n", $cv_count
+	while $cv_idx < $cv_count
+		printf "[%d] '%s'\n", $cv_idx, $cv[$cv_idx].val
+		set $zvalue = ((zval *) $cv_ex_ptr) + $callFrameSize + $cv_idx
+		printzv $zvalue
+		set $cv_idx = $cv_idx + 1
+	end
+end
+
+document print_cvs
+	Prints the compiled variables and their values.
+	If a zend_execute_data pointer is set this will print the compiled
+	variables of that scope. If no parameter is used it will use
+	current_execute_data for scope.
+
+	usage: print_cvs [zend_execute_data *]
 end
 
 define dump_bt
@@ -196,12 +207,17 @@ define ____printzv_contents
 		____executor_globals
 		set $handle = $zvalue->value.obj.handle
 		set $handlers = $zvalue->value.obj.handlers
-        set $zobj = $zvalue->value.obj
-        set $cname = $zobj->ce->name->val
+		set $zobj = $zvalue->value.obj
+		set $cname = $zobj->ce->name->val
 		printf "(%s) #%d", $cname, $handle
 		if ! $arg1
 			if $handlers->get_properties == &zend_std_get_properties
-				set $ht = $zobj->properties
+				if $zobj->properties
+					set $ht = $zobj->properties
+				else
+					set $ht = &$zobj->ce->properties_info
+				end
+				printf "\nProperties "
 				if $ht
 					set $ind = $ind + 1
 					____print_ht $ht 1
@@ -212,7 +228,7 @@ define ____printzv_contents
 						set $i = $i - 1
 					end
 				else
-					echo "no properties found"
+					echo "not found"
 				end
 			end
 		end
@@ -455,9 +471,9 @@ define print_inh
 end
 
 define print_pi
-	set $pi = $arg0
+	set $pi = (zend_property_info *)$arg0
 	printf "[%p] {\n", $pi
-	printf "    h     = %lu\n", $pi->h
+	printf "    ce = [%p] %s\n", $pi->ce, $pi->ce->name->val
 	printf "    flags = %d (", $pi->flags
 	if $pi->flags & 0x100
 		printf "ZEND_ACC_PUBLIC"
@@ -476,16 +492,27 @@ define print_pi
 	end
 	printf ")\n"
 	printf "    name  = "
-	____print_str $pi->name $pi->name_length
-	printf "\n}\n"
+	print_zstr $pi->name
+	printf "}\n"
+end
+
+document print_pi
+	Takes a pointer to an object's property and prints the property information
+	usage: print_pi <ptr>
 end
 
 define ____print_str
 	set $tmp = 0
 	set $str = $arg0
+	if $argc > 2
+		set $maxlen = $arg2
+	else
+		set $maxlen = 256
+	end
+
 	printf "\""
-	while $tmp < $arg1 && $tmp < 256
-		if $str[$tmp] > 32 && $str[$tmp] < 127
+	while $tmp < $arg1 && $tmp < $maxlen
+		if $str[$tmp] > 31 && $str[$tmp] < 127
 			printf "%c", $str[$tmp]
 		else
 			printf "\\%o", $str[$tmp]
@@ -554,6 +581,23 @@ document printzops
 	dump operands of the current opline
 end
 
+define print_zstr
+	set $zstr = (zend_string *)$arg0
+	if $argc == 2
+		set $maxlen = $arg1
+	else
+		set $maxlen = $zstr->len
+	end
+	printf "string(%d) ", $zstr->len
+	____print_str $zstr->val $zstr->len $maxlen
+	printf "\n"
+end
+
+document print_zstr
+	print the length and contents of a zend string
+	usage: print_zstr <ptr> [max length]
+end
+
 define zbacktrace
 	____executor_globals
 	dump_bt $eg.current_execute_data
@@ -566,79 +610,6 @@ document zbacktrace
 	> (gdb) dump_bt $eg.current_execute_data
 end
 
-define zmemcheck
-	set $p = alloc_globals.head
-	set $stat = "?"
-	set $total_size = 0
-	if $arg0 != 0
-		set $not_found = 1
-	else
-		set $not_found = 0
-	end
-	printf " block      size      status file:line\n"
-	printf "-------------------------------------------------------------------------------\n"
-	while $p
-		set $aptr = $p + sizeof(struct _zend_mem_header) + sizeof(align_test)
-		if $arg0 == 0 || (void *)$aptr == (void *)$arg0
-			if $p->magic == 0x7312f8dc 
-				set $stat = "OK"
-			end
-			if $p->magic == 0x99954317
-				set $stat = "FREED"
-			end
-			if $p->magic == 0xfb8277dc
-				set $stat = "CACHED"
-			end
-			set $filename = strrchr($p->filename->val, '/')
-			if !$filename
-				set $filename = $p->filename->val
-			else
-				set $filename = $filename + 1
-			end
-			printf " %p ", $aptr
-			if $p->size == sizeof(struct _zval_struct) && ((struct _zval_struct *)$aptr)->type >= 0 && ((struct _zval_struct *)$aptr)->type < 10
-				printf "ZVAL?(%-2d) ", $p->size
-			else
-				printf "%-9d ", $p->size
-			end
-			set $total_size = $total_size + $p->size
-			printf "%-06s %s:%d", $stat, $filename, $p->lineno
-			if $p->orig_filename
-				set $orig_filename = strrchr($p->orig_filename, '/')
-				if !$orig_filename
-					set $orig_filename = $p->orig_filename
-				else
-					set $orig_filename = $orig_filename + 1
-				end
-				printf " <= %s:%d\n", $orig_filename, $p->orig_lineno
-			else
-				printf "\n"
-			end
-			if $arg0 != 0
-				set $p = 0
-				set $not_found = 0
-			else
-				set $p = $p->pNext
-			end
-		else
-			set $p = $p->pNext
-		end
-	end
-	if $not_found
-		printf "no such block that begins at %p.\n", $aptr
-	end
-	if $arg0 == 0
-		printf "-------------------------------------------------------------------------------\n"
-		printf "     total: %d bytes\n", $total_size
-	end
-end
-
-document zmemcheck
-	show status of a memory block.
-	usage: zmemcheck [ptr].
-	if ptr is 0, all blocks will be listed.
-end
-
 define lookup_root
 	set $found = 0
 	if gc_globals->roots

.gitattributes

@@ -15,11 +15,8 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
-ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
-sapi/nsapi/nsapi.c              ident
-sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 ext/exif/exif.c                 ident
@@ -32,7 +29,6 @@ UPGRADING.INTERNALS             merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
 /ext/dom/tests/domelement.phpt	-crlf
-/ext/ereg/tests/eregi_basic_002.phpt	-crlf
 /ext/iconv/tests/iconv004.phpt	-crlf
 /ext/iconv/tests/iconv_basic.phpt	-crlf
 /ext/iconv/tests/iconv_strpos.phpt	-crlf

.gitignore

@@ -262,9 +262,7 @@ pear/phpize
 pear/run-tests
 pear/php-config
 pear/scripts
-sapi/apache/libphp7.module
 sapi/apache2handler/libphp7.module
-sapi/apache_hooks/libphp7.module
 sapi/cgi/php-cgi
 sapi/cgi/php-cgi.1
 sapi/cli/php.1

.travis.yml

@@ -1,3 +1,4 @@
+dist: trusty
 language: c
 sudo: false
 addons:

EXTENSIONS

@@ -47,7 +47,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -286,7 +286,7 @@ MAINTENANCE:         Odd fixes
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           gd
-PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>
+PRIMARY MAINTAINER:  Pierre-Alain Joye <pajoye@php.net>, Christoph M. Becker <cmb@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------

LICENSE

@@ -1,6 +1,6 @@
 -------------------------------------------------------------------- 
                   The PHP License, version 3.01
-Copyright (c) 1999 - 2016 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2017 The PHP Group. All rights reserved.
 -------------------------------------------------------------------- 
 
 Redistribution and use in source and binary forms, with or without

Makefile.global

@@ -5,7 +5,7 @@ INSTALL_DATA = $(INSTALL) -m 644
 DEFS = -DPHP_ATOM_INC -I$(top_builddir)/include -I$(top_builddir)/main -I$(top_srcdir)
 COMMON_FLAGS = $(DEFS) $(INCLUDES) $(EXTRA_INCLUDES) $(CPPFLAGS) $(PHP_FRAMEWORKPATH)
 
-all: $(all_targets) 
+all: $(all_targets)
 	@echo
 	@echo "Build complete."
 	@echo "Don't forget to run 'make test'."
@@ -53,7 +53,7 @@ install-headers:
 			paths="$$paths $(INSTALL_ROOT)$(phpincludedir)/$$i"; \
 		done; \
 		$(mkinstalldirs) $$paths && \
-		echo "Installing header files:           $(INSTALL_ROOT)$(phpincludedir)/" && \
+		echo "Installing header files:          $(INSTALL_ROOT)$(phpincludedir)/" && \
 		for i in `echo $(INSTALL_HEADERS)`; do \
 			if test "$(PHP_PECL_EXTENSION)"; then \
 				src=`echo $$i | $(SED) -e "s#ext/$(PHP_PECL_EXTENSION)/##g"`; \
@@ -112,13 +112,13 @@ test: all
 clean:
 	find . -name \*.gcno -o -name \*.gcda | xargs rm -f
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	find . -name .libs -a -type d|xargs rm -rf
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 
 distclean: clean
-	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h sapi/apache/libphp$(PHP_MAJOR_VERSION).module sapi/apache_hooks/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
 	rm -f php7.spec main/build-defs.h scripts/phpize
 	rm -f ext/date/lib/timelib_config.h ext/mbstring/oniguruma/config.h ext/mbstring/libmbfl/config.h ext/oci8/oci8_dtrace_gen.h ext/oci8/oci8_dtrace_gen.h.bak
 	rm -f scripts/man1/phpize.1 scripts/php-config scripts/man1/php-config.1 sapi/cli/php.1 sapi/cgi/php-cgi.1 ext/phar/phar.1 ext/phar/phar.phar.1
@@ -135,7 +135,7 @@ prof-gen:
 
 prof-clean:
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 

NEWS

@@ -1,16 +1,794 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016 PHP 7.0.14
+01 Mar 2018 PHP 7.0.28
+
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
+
+04 Jan 2018 PHP 7.0.27
+
+- CLI Server:
+  . Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router
+    script). (SammyK)
 
 - Core:
+  . Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand).
+    (Anatol)
+  . Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26). (Laruence)
+
+- FPM:
+  . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between
+    requests). (Remi)
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Opcache:
+  . Fixed bug #75579 (Interned strings buffer overflow may cause crash).
+    (Dmitry)
+
+- PCRE:
+  . Fixed bug #74183 (preg_last_error not returning error code after error).
+    (Andrew Nester)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+- Standard:
+  . Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP
+    segment fault). (Nikita)
+  . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 
+    that getrandom() is missing). (sarciszewski)
+
+- Zip:
+  . Fixed bug #75540 (Segfault with libzip 1.3.1). (Remi)
+
+23 Nov 2017 PHP 7.0.26
+
+- Core:
+  . Fixed bug #75420 (Crash when modifing property name in __isset for
+    BP_VAR_IS). (Laruence)
+  . Fixed bug #75368 (mmap/munmap trashing on unlucky allocations). (Nikita,
+    Dmitry)
+
+- CLI:
+  . Fixed bug #75287 (Builtin webserver crash after chdir in a shutdown
+    function). (Laruence)
+
+- Enchant:
+  . Fixed bug #53070 (enchant_broker_get_path crashes if no path is set). (jelle
+    van der Waa, cmb)
+  . Fixed bug #75365 (Enchant still reports version 1.1.0). (cmb)
+
+- Exif:
+  . Fixed bug #75301 (Exif extension has built in revision version). (Peter
+    Kokot)
+
+- GD:
+  . Fixed bug #65148 (imagerotate may alter image dimensions). (cmb)
+  . Fixed bug #75437 (Wrong reflection on imagewebp). (Fabien Villepinte)
+
+- intl:
+  . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead 
+    of destination). (andrewnester)
+
+- interbase:
+  . Fixed bug #75453 (Incorrect reflection for ibase_[p]connect). (villfa)
+
+- Mysqli:
+  . Fixed bug #75434 (Wrong reflection for mysqli_fetch_all function). (Fabien
+    Villepinte)
+
+- OCI8:
+  . Fixed valgrind issue. (Tianfang Yang)
+
+- Opcache:
+  . Fixed bug #75373 (Warning Internal error: wrong size calculation). (Laruence, Dmitry)
+
+- OpenSSL:
+  . Fixed bug #75363 (openssl_x509_parse leaks memory). (Bob, Jakub Zelenka)
+  . Fixed bug #75307 (Wrong reflection for openssl_open function). (villfa)
+
+- PGSQL:
+  . Fixed bug #75419 (Default link incorrectly cleared/linked by pg_close()). (Sara)
+
+- SOAP:
+  . Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders). (villfa)
+
+- Zlib:
+  . Fixed bug #75299 (Wrong reflection on inflate_init and inflate_add). (Fabien
+    Villepinte)
+
+26 Oct 2017 PHP 7.0.25
+
+- Core:
+  . Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
+    (Laruence)
+  . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea)
+  . Fixed bug #75252 (Incorrect token formatting on two parse errors in one
+    request). (Nikita)
+  . Fixed bug #75220 (Segfault when calling is_callable on parent). 
+    (andrewnester)
+  . Fixed bug #75290 (debug info of Closures of internal functions contain
+    garbage argument names). (Andrea)
+
+- Apache2Handler:
+  . Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in
+    apache2handler). (mcarbonneaux)
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- Intl:
+  . Fixed bug #75318 (The parameter of UConverter::getAliases() is not
+    optional). (cmb)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- OCI8:
+  . Fixed incorrect reference counting. (Dmitry, Tianfang Yang)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+- litespeed:
+  . Fixed bug #75248 (Binary directory doesn't get created when building 
+    only litespeed SAPI). (petk)
+  . Fixed bug #75251 (Missing program prefix and suffix). (petk)
+
+- SPL:
+  . Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).
+    (J. Jeising, cmb)
+
+28 Sep 2017 PHP 7.0.24
+
+- Core:
+  . Fixed bug #75042 (run-tests.php issues with EXTENSION block). (John Boehr)
+
+- BCMath:
+  . Fixed bug #44995 (bcpowmod() fails if scale != 0). (cmb)
+  . Fixed bug #46781 (BC math handles minus zero incorrectly). (cmb)
+  . Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1). (okano1220, cmb)
+  . Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus). (cmb)
+
+- CLI server:
+  . Fixed bug #70470 (Built-in server truncates headers spanning over TCP
+    packets). (bouk)
+
+- CURL:
+  . Fixed bug #75093 (OpenSSL support not detected). (Remi)
+
+- GD:
+  . Fixed bug #75124 (gdImageGrayScale() may produce colors). (cmb)
+  . Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?). (cmb)
+
+- Gettext:
+  . Fixed bug #73730 (textdomain(null) throws in strict mode). (cmb)
+
+- Intl:
+  . Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent
+    class). (tpunt)
+  . Fixed bug #75193 (segfault in collator_convert_object_to_string). (Remi)
+
+- PDO_OCI:
+  . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized
+    before PHP-FPM sets it up). (Ingmar Runge)
+
+- SPL:
+  . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #75097 (gethostname fails if your host name is 64 chars long). (Andrea)
+
+31 Aug 2017 PHP 7.0.23
+
+- Core:
+  . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence)
+  . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob)
+  . Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). (Andrea)
+  . Fixed bug #75349 (NAN comparison). (Sara)
+
+- cURL:
+  . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
+    (cebe)
+
+- Date:
+  . Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone). (Derick)
+
+- Intl:
+  . Fixed bug #74993 (Wrong reflection on some locale_* functions). (Sara)
+
+- Mbstring:
+  . Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
+    (cmb)
+  . Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
+    (Nikita)
+  . Fixed bug #75001 (Wrong reflection on mb_eregi_replace). (Fabien
+    Villepinte)
+
+- MySQLi:
+  . Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with
+    an abstract class). (Anatol)
+
+- OCI8:
+  . Expose oci_unregister_taf_callback() (Tianfang Yang)
+
+- phar:
+  . Fixed bug #74991 (include_path has a 4096 char limit in some cases).
+    (bwbroersma)
+
+- Reflection:
+  . Fixed bug #74949 (null pointer dereference in _function_string). (Laruence)
+
+- Session:
+  . Fixed bug #74833 (SID constant created with wrong module number). (Anatol)
+
+- SimpleXML:
+  . Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
+    (Laruence)
+
+- SPL:
+  . Fixed bug #75049 (spl_autoload_unregister can't handle
+    spl_autoload_functions results). (Laruence)
+  . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
+  . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
+
+- Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
+  . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
+    size). (Nikita)
+  . Fixed bug #75054 (A Denial of Service Vulnerability was found when
+    performing deserialization). (Nikita)
+
+- WDDX:
+  . Fixed bug #73793 (WDDX uses wrong decimal seperator). (cmb)
+
+- XMLRPC:
+  . Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared
+    properties). (blar)
+
+03 Aug 2017 PHP 7.0.22
+
+- Core:
+  . Fixed bug #74832 (Loading PHP extension with already registered function 
+    name leads to a crash). (jpauli)
+  . Fixed bug #74780 (parse_url() borken when query string contains colon). 
+    (jhdxr)
+  . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
+  . Fixed bug #73900 (Use After Free in unserialize() SplFixedArray). (nikic)
+  . Fixed bug #74913 (fixed incorrect poll.h include). (petk)
+  . Fixed bug #74906 (fixed incorrect errno.h include). (petk)
+
+- Date:
+  . Fixed bug #74852 (property_exists returns true on unknown DateInterval 
+    property). (jhdxr)
+
+- OCI8:
+  . Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
+
+- Opcache:
+  . Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within
+    finally). (Bob)
+
+- PDO:
+  . Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query). (Adam
+    Baratz)
+
+- SPL:
+  . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
+
+- SQLite3:
+  . Fixed bug #74883 (SQLite3::__construct() produces "out of memory" exception
+    with invalid flags). (Anatol)
+
+- Wddx:
+  . Fixed bug #73173 (huge memleak when wddx_unserialize).
+    (tloi at fortinet dot com)
+
+- zlib:
+  . Fixed bug #73944 (dictionary option of inflate_init() does not work).
+    (wapmorgan)
+
+06 Jul 2017 PHP 7.0.21
+
+- Core:
+  . Fixed bug #74738 (Multiple [PATH=] and [HOST=] sections not properly
+    parsed). (Manuel Mausz)
+  . Fixed bug #74658 (Undefined constants in array properties result in broken
+    properties). (Laruence)
+  . Fixed misparsing of abstract unix domain socket names. (Sara)
+  . Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in
+    zval_get_type). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)
+
+- DOM:
+  . Fixed bug #69373 (References to deleted XPath query results). (ttoohey)
+
+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+  . Fixed bug #74705 (Wrong reflection on Collator::getSortKey and
+    collator_get_sort_key). (Tyson Andre, Remi)
+  . Fixed bug #73634 (grapheme_strpos illegal memory access). (Stas)
+
+- Mbstring:
+  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
+    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
+
+- OCI8:
+  . Add TAF callback (PR #2459). (KoenigsKind)
+
+- Opcache:
+  . Fixed bug #74663 (Segfault with opcache.memory_protect and
+    validate_timestamp). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
+- PDO_OCI:
+  . Support Instant Client 12.2 in --with-pdo-oci configure option.
+    (Tianfang Yang)
+
+- Reflection:
+  . Fixed bug #74673 (Segfault when cast Reflection object to string with
+    undefined constant). (Laruence)
+
+- SPL:
+  . Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #74708 (Invalid Reflection signatures for random_bytes and
+    random_int). (Tyson Andre, Remi)
+  . Fixed bug #73648 (Heap buffer overflow in substr). (Stas)
+
+- FTP:
+  . Fixed bug #74598 (ftp:// wrapper ignores context arg). (Sara)
+
+- PHAR:
+  . Fixed bug #74386 (Phar::__construct reflection incorrect). (villfa)
+
+- SOAP
+  . Fixed bug #74679 (Incorrect conversion array with WSDL_CACHE_MEMORY).
+    (Dmitry)
+
+- Streams:
+  . Fixed bug #74556 (stream_socket_get_name() returns '\0'). (Sara)
+
+8 Jun 2017 PHP 7.0.20
+
+- Core:
+  . Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
+    (Laruence)
+  . Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
+    (Laruence)
+
+- intl:
+  . Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys). (villfa)
+
+- MySQLi:
+  . Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database
+    argument w/strict_types). (Anatol)
+
+- Opcache:
+  . Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled). (Laruence)
+
+- phar:
+  . Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT
+    and DELETE method). (Christian Weiske)
+
+- Standard:
+  . Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
+    (Damian Wadley, Anatol)
+
+- xmlreader:
+  . Fixed bug #74457 (Wrong reflection on XMLReader::expand). (villfa)
+
+11 May 2017 PHP 7.0.19
+
+- Core:
+  . Fixed bug #74188 (Null coalescing operator fails for undeclared static
+    class properties). (tpunt)
+  . Fixed bug #74408 (Endless loop bypassing execution time limit). (Laruence)
+  . Fixed bug #74410 (stream_select() is broken on Windows Nanoserver).
+    (Matt Ficken)
+  . Fixed bug #74337 (php-cgi.exe crash on facebook callback).
+    (Anton Serbulov)
+  . Patch for bug #74216 was reverted. (Anatol)
+
+- Date:
+  . Fixed bug #74404 (Wrong reflection on DateTimeZone::getTransitions).
+    (krakjoe)
+  . Fixed bug #74080 (add constant for RFC7231 format datetime). (duncan3dc)
+
+- DOM:
+  . Fixed bug #74416 (Wrong reflection on DOMNode::cloneNode).
+    (Remi, Fabien Villepinte)
+
+- Fileinfo:
+  . Fixed bug #74379 (syntax error compile error in libmagic/apprentice.c).
+    (Laruence)
+
+- GD:
+  . Fixed bug #74343 (compile fails on solaris 11 with system gd2 library).
+    (krakjoe)
+
+- intl:
+  . Fixed bug #74433 (wrong reflection for Normalizer methods). (villfa)
+  . Fixed bug #74439 (wrong reflection for Locale methods). (villfa)
+
+- MySQLi:
+  . Fixed bug #74432 (mysqli_connect adding ":3306" to $host if $port parameter
+    not given). (Anatol)
+
+- MySQLnd:
+  . Added support for MySQL 8.0 types. (Johannes)
+  . Fixed bug #74376 (Invalid free of persistent results on error/connection
+    loss). (Yussuf Khalil)
+
+- OpenSSL:
+  . Fixed bug #73833 (null character not allowed in openssl_pkey_get_private).
+    (Jakub Zelenka)
+  . Fixed bug #73711 (Segfault in openssl_pkey_new when generating DSA or DH
+    key). (Jakub Zelenka)
+  . Fixed bug #74341 (openssl_x509_parse fails to parse ASN.1 UTCTime without
+    seconds). (Moritz Fain)
+  . Added OpenSSL 1.1.0 support. (Jakub Zelenka)
+
+- phar:
+  . Fixed bug #74383 (phar method parameters reflection correction). 
+    (mhagstrand)
+
+- Standard:
+  . Fixed bug #74409 (Reflection information for ini_get_all() is incomplete).
+    (Sebastian Bergmann)
+  . Fixed bug #72071 (setcookie allows max-age to be negative). (Craig Duncan)
+
+- Streams:
+  . Fixed bug #74429 (Remote socket URI with unique persistence identifier
+    broken). (Sara)
+
+- SQLite3:
+  . Fixed bug #74413 (incorrect reflection for SQLite3::enableExceptions).
+    (krakjoe)
+
+13 Apr 2017 PHP 7.0.18
+
+- Core:
+  . Fixed bug #73370 (falsely exits with "Out of Memory" when using
+    USE_ZEND_ALLOC=0). (Nikita)
+  . Fixed bug #73960 (Leak with instance method calling static method with
+    referenced return). (Nikita)
+  . Fixed bug #74265 (Build problems after 7.0.17 release: undefined reference
+    to `isfinite'). (Nikita)
+  . Fixed bug #74302 (yield fromLABEL is over-greedy). (Sara)
+
+- Apache:
+  . Reverted patch for bug #61471, fixes bug #74318. (Anatol)
+
+- Date:
+  . Fixed bug #72096 (Swatch time value incorrect for dates before 1970). (mcq8)
+
+- DOM:
+  . Fixed bug #74004 (LIBXML_NOWARNING flag ingnored on loadHTML*).
+    (somedaysummer)
+
+- iconv:
+  . Fixed bug #74230 (iconv fails to fail on surrogates). (Anatol)
+
+- OCI8:
+  . Fixed uninitialized data causing random crash. (Dmitry)
+
+- OpenSSL:
+  . Fixed bug #72333 (fwrite() on non-blocking SSL sockets doesn't work).
+    (Jakub Zelenka)
+
+- PDO MySQL:
+  . Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO
+    interface). (Thomas Orozco)
+
+- Streams:
+  . Fixed bug #74216 (Correctly fail on invalid IP address ports). (Sara)
+
+- Zlib:
+  . Fixed bug #74240 (deflate_add can allocate too much memory). (Matt Bonneau)
+
+16 Mar 2017 PHP 7.0.17
+
+- Core:
+  . Fixed bug #73989 (PHP 7.1 Segfaults within Symfony test suite).
+    (Dmitry, Laruence)
+  . Fixed bug #74084 (Out of bound read - zend_mm_alloc_small). (Laruence)
+  . Fixed bug #73807 (Performance problem with processing large post request).
+    (Nikita)
+  . Fixed bug #73998 (array_key_exists fails on arrays created by
+    get_object_vars). (mhagstrand)
+  . Fixed bug #73954 (NAN check fails on Alpine Linux with musl). (Andrea)
+  . Fixed bug #74039 (is_infinite(-INF) returns false). (Christian Schmidt)
+  . Fixed bug #73677 (Generating phar.phar core dump with gcc ASAN enabled
+    build). (ondrej)
+
+- Apache:
+  . Fixed bug #61471 (Incomplete POST does not timeout but is passed to PHP).
+    (Zheng Shao)
+
+- Date:
+  . Fixed bug #72719 (Relative datetime format ignores weekday on sundays
+    only). (Derick)
+  . Fixed bug #73294 (DateTime wrong when date string is negative). (Derick)
+  . Fixed bug #73489 (wrong timestamp when call setTimeZone multi times with
+    UTC offset). (xiami, Derick)
+  . Fixed bug #73858 (first/last day of' flag is not being reset). (Derick)
+  . Fixed bug #73942 ($date->modify('Friday this week') doesn't return a Friday
+    if $date is a Sunday). (Derick)
+  . Fixed bug #74057 (wrong day when using "this week" in strtotime). (Derick)
+
+- FPM:
+  . Fixed bug #69860 (php-fpm process accounting is broken with keepalive).
+    (Denis Yeldandi)
+
+- Hash:
+  . Fixed bug #73127 (gost-crypto hash incorrect if input data contains long
+    0xFF sequence). (Grundik)
+
+- GD:
+  . Fixed bug #74031 (ReflectionFunction for imagepng is missing last two
+    parameters). (finwe)
+
+- Mysqlnd:
+  . Fixed bug #74021 (fetch_array broken data. Data more then MEDIUMBLOB).
+    (Andrew Nester, Nikita)
+
+- Opcache:
+  . Fixed bug #74152 (if statement says true to a null variable). (Laruence)
+  . Fixed bug #74019 (Segfault with list). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #74022 (PHP Fast CGI crashes when reading from a pfx file).
+    (Anatol)
+
+- PDO_OCI:
+  . Fixed bug #54379 (PDO_OCI: UTF-8 output gets truncated). (gureedo / Oracle)
+
+- Standard:
+  . Fixed bug #74148 (ReflectionFunction incorrectly reports the number of
+    arguments). (Laruence)
+  . Fixed bug #74005 (mail.add_x_header causes RFC-breaking lone line feed).
+    (Anatol)
+  . Fixed bug #73118 (is_callable callable name reports misleading value for
+    anonymous classes). (Adam Saponara)
+  . Fixed bug #74105 (PHP on Linux should use /dev/urandom when getrandom is
+    not available). (Benjamin Robin)
+
+- Streams:
+  . Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
+    (Laruence)
+  . Fixed bug #74090 (stream_get_contents maxlength>-1 returns empty string).
+    (Anatol)
+
+
+16 Feb 2017 PHP 7.0.16
+
+- Core:
+  . Fixed bug #73916 (zend_print_flat_zval_r doesn't consider reference).
+    (Laruence)
+  . Fixed bug #73876 (Crash when exporting **= in expansion of assign op).
+    (Sara)
+  . Fixed bug #73969 (segfault in debug_print_backtrace). (andrewnester)
+  . Fixed bug #73973 (assertion error in debug_zval_dump). (andrewnester)
+
+- DOM:
+  . Fixed bug #54382 (getAttributeNodeNS doesn't get xmlns* attributes).
+    (aboks)
+
+- DTrace:
+  . Fixed bug #73965 (DTrace reported as enabled when disabled). (Remi)
+
+- FPM:
+  . Fixed bug #67583 (double fastcgi_end_request on max_children limit).
+    (Dmitry Saprykin)
+  . Fixed bug #69865 (php-fpm does not close stderr when using syslog). 
+    (m6w6)
+
+- GD:
+  . Fixed bug #73968 (Premature failing of XBM reading). (cmb)
+
+- GMP:
+  . Fixed bug #69993 (test for gmp.h needs to test machine includes).
+    (Jordan Gigov) 
+
+- Intl:
+  . Fix bug #73956 (Link use CC instead of CXX). (Remi)
+
+- LDAP:
+  . Fixed bug #73933 (error/segfault with ldap_mod_replace and opcache).
+    (Laruence)
+
+- MySQLi:
+  . Fixed bug #73949 (leak in mysqli_fetch_object). (krakjoe)
+
+- Mysqlnd:
+  . Fixed bug #69899 (segfault on close() after free_result() with mysqlnd).
+    (Richard Fussenegger)
+
+- Opcache:
+  . Fixed bug #73983 (crash on finish work with phar in cli + opcache).
+    (Anatol)
+
+- OpenSSL:
+  . Fixed bug #71519 (add serial hex to return value array). (xrobau)
+
+- PDO_Firebird:
+  . Implemented FR #72583 (All data are fetched as strings). (Dorin Marcoci)
+
+- PDO_PgSQL:
+  . Fixed bug #73959 (lastInsertId fails to throw an exception for wrong 
+    sequence name). (andrewnester)
+
+- Phar:
+  . Fixed bug #70417 (PharData::compress() doesn't close temp file). (cmb)
+
+- posix:
+  . Fixed bug #71219 (configure script incorrectly checks for ttyname_r). (atoth)
+
+- Session:
+  . Fixed bug #69582 (session not readable by root in CLI). (EvgeniySpinov)
+
+- SPL:
+  . Fixed bug #73896 (spl_autoload() crashes when calls magic _call()). (Dmitry)
+
+- Standard:
+  . Fixed bug #69442 (closing of fd incorrect when PTS enabled). (jaytaph)
+  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
+    "Transfer-Encoding: chunked"). (Rowan Collins)
+  . Fixed bug #72974 (imap is undefined service on AIX). (matthieu.sarter)
+  . Fixed bug #72979 (money_format stores wrong length AIX). (matthieu.sarter)
+
+- ZIP:
+  . Fixed bug #70103 (ZipArchive::addGlob ignores remove_all_path option). (cmb,
+    Mitch Hagstrand)
+
+19 Jan 2017 PHP 7.0.15
+
+- Core:
+  . Fixed bug #73792 (invalid foreach loop hangs script). (Dmitry)
+  . Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created
+    with list()). (Laruence)
+  . Fixed bug #73585 (Logging of "Internal Zend error - Missing class
+    information" missing class name). (Laruence)
+  . Fixed bug #73753 (unserialized array pointer not advancing). (David Walker)
+  . Fixed bug #73825 (Heap out of bounds read on unserialize in
+    finish_nested_data()). (Stas)
+  . Fixed bug #73831 (NULL Pointer Dereference while unserialize php object).
+    (Stas)
+  . Fixed bug #73832 (Use of uninitialized memory in unserialize()). (Stas)
+  . Fixed bug #73092 (Unserialize use-after-free when resizing object's
+    properties hash table). (Nikita)
+  . Fixed bug #69425 (Use After Free in unserialize()). (Nikita)
+  . Fixed bug #72731 (Type Confusion in Object Deserialization). (Nikita)
+
+- COM:
+  . Fixed bug #73679 (DOTNET read access violation using invalid codepage).
+    (Anatol)
+
+- DOM:
+  . Fixed bug #67474 (getElementsByTagNameNS filter on default ns). (aboks)
+
+- EXIF:
+  . Bug bug #73737 (FPE when parsing a tag format). (Stas)
+
+- GD:
+  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
+  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
+
+- GMP:
+  . Fixed bug #70513 (GMP Deserialization Type Confusion Vulnerability).
+    (Nikita)
+
+- Mysqli:
+  . Fixed bug #73462 (Persistent connections don't set $connect_errno).
+    (darkain)
+
+- Mysqlnd:
+  . Fixed issue with decoding BIT columns when having more than one rows in the
+    result set. 7.0+ problem. (Andrey)
+  . Fixed bug #73800 (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE). 
+	(vanviegen)
+
+- PCRE:
+  . Fixed bug #73612 (preg_*() may leak memory). (cmb)
+
+- PDO_Firebird:
+  . Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning
+    statement). (Dorin Marcoci)
+
+- Phar:
+  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
+  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
+  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
+
+- Phpdbg:
+  . Fixed bug #73615 (phpdbg without option never load .phpdbginit at startup).
+    (Bob)
+  . Fixed issue getting executable lines from custom wrappers. (Bob)
+  . Fixed bug #73704 (phpdbg shows the wrong line in files with shebang). (Bob)
+
+- Reflection:
+  . Fixed bug #46103 (ReflectionObject memory leak). (Nikita)
+
+- Streams:
+  . Fixed bug #73586 (php_user_filter::$stream is not set to the stream the
+    filter is working on). (Dmitry)
+
+- SQLite3:
+  . Reverted fix for bug #73530	(Unsetting result set may reset other result
+    set). (cmb)
+
+- Standard:
+  . Fixed bug #73594 (dns_get_record does not populate $additional out
+    parameter). (Bruce Weirdan)
+  . Fixed bug #70213 (Unserialize context shared on double class lookup).
+    (Taoguang Chen)
+  . Fixed bug #73154 (serialize object with __sleep function crash). (Nikita)
+  . Fixed bug #70490 (get_browser function is very slow). (Nikita)
+  . Fixed bug #73265 (Loading browscap.ini at startup causes high memory usage).
+    (Nikita)
+  . Fixed bug #31875 (get_defined_functions additional param to exclude
+	disabled functions). (willianveiga)
+
+- Zlib:
+  . Fixed bug #73373 (deflate_add does not verify that output was not truncated).
+    (Matt Bonneau)
+
+08 Dec 2016 PHP 7.0.14
+
+- Core:
+  . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre)
   . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli
     / PDO). (Dmitry)
 
+- Calendar:
+  . Fix integer overflows (Joshua Rogers)
+
+- Date:
+  . Fixed bug #69587 (DateInterval properties and isset). (jhdxr)
+
+- DTrace:
+  . Disabled PHP call tracing by default (it makes significant overhead).
+    This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
+    (Dmitry)
+
+- JSON:
+  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+  . Install headers on windows. (Darek Slusarczyk)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
 - ODBC:
   . Fixed bug #73448 (odbc_errormsg returns trash, always 513 bytes).
     (Anatol)
 
+- Opcache:
+  . Fixed bug #69090 (check cached files permissions). (dmitry)
+  . Fixed bug #73546 (Logging for opcache has an empty file name). (mhagstrand)
+
 - PCRE:
+  . Fixed bug #73483 (Segmentation fault on pcre_replace_callback). (Laruence)
   . Fixed bug #73392 (A use-after-free in zend allocator management). 
     (Laruence)
 
@@ -18,9 +796,35 @@ PHP                                                                        NEWS
   . Fixed bug #73087, #61183, #71494 (Memory corruption in bindParam).
     (Dorin Marcoci)
 
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- Phar:
+  . Fixed bug #73580 (Phar::isValidPharFilename illegal memory access). (Stas)
+
+- Soap:
+  . Fixed bug #73538 (SoapClient::__setSoapHeaders doesn't overwrite SOAP
+    headers). (duncan3dc)
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
 - SPL:
   . Fixed bug #73423 (Reproducible crash with GDB backtrace). (Laruence)
 
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+  . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+    (rowan dot collins at gmail dot com)
+  . Fixed bug #73645 (version_compare illegal write access). (Stas)
+
+- Wddx:
+  . Fixed bug #73631 (Invalid read when wddx decodes empty boolean element).
+  (Stas)
+
+- XML:
+  . Fixed bug #72135 (malformed XML causes fault) (edgarsandi)
+
 10 Nov 2016 PHP 7.0.13
 
 - Core:
@@ -44,6 +848,14 @@ PHP                                                                        NEWS
     imagesetinterpolation()). (cmb)
   . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
   . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
+    overflow). (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
+    (Anatol)
 
 - OCI8
   . Fixed bug #71148 (Bind reference overwritten on PHP 7). (Oracle Corp.)
@@ -74,6 +886,11 @@ PHP                                                                        NEWS
   . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
   . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
     (adsr)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
 
 13 Oct 2016 PHP 7.0.12
 
@@ -2019,4 +2836,3 @@ PHP                                                                        NEWS
   . Update bundled libzip to 1.0.1. (Remi, Anatol)
   . Fixed bug #67161 (ZipArchive::getStream() returns NULL for certain file).
     (Christoph M. Becker)
-

README.RELEASE_PROCESS

@@ -93,24 +93,27 @@ Commit the changes to the main branch.
 12. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure
 and build three tarballs (gz, bz2 and xz).
 
-13. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
+13. run ``scripts/dev/gen_verify_stub <version> [identity]``, this will sign the tarballs
+and output verification information to be included in announcement email
+
+14. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
 directory "downloads/". Copy them into there, so that the system can generate
 MD5 sums. If you do not have this directory, talk to Derick or Dan.
 
-14. Now the RC can be found on http://downloads.php.net/yourname,
+15. Now the RC can be found on http://downloads.php.net/yourname,
 f.e. http://downloads.php.net/derick/
 
-15. Once the release has been tagged, contact the PHP Windows development team
+16. Once the release has been tagged, contact the PHP Windows development team
 (internals-win@lists.php.net) so that Windows binaries can be created. Once
 those are made, they should be placed into the same directory as the source snapshots.
 
 Getting the non stable release (alpha/beta/RC) announced
 --------------------------------------------------------
 
-1. Send an email (see example here: http://news.php.net/php.internals/19486)
-**To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` lists
-pointing out "the location of the release" and "the possible release date of
-either the next RC, or the final release".
+1. Send an email **To** ``internals@lists.php.net`` and ``php-general@lists.php.net`` 
+lists pointing out "the location of the release" and "the possible release date of
+either the next RC, or the final release". Include in this information the verification
+information output by ``gen_verify_stub``.
 
 2. Send an email (see example here http://news.php.net/php.pear.qa/5201) **To**
 ``php-qa@lists.php.net`` and ``primary-qa-tester@lists.php.net``.
@@ -190,8 +193,8 @@ Check if the pear files are updated (phar).
 This is to fetch the last commit id from php-distributions.git and commit this
 last commit id to web/php.git, then, mirrors will now sync
 
-12. Once the release has been tagged, contact the PHP Windows development team
-(internals-win@lists.php.net) so that Windows binaries can be created.
+12. Once the release has been tagged, contact release managers, windows builders, and package maintainers
+so that they can build releases. Do not send this announcement to any public lists.
 
 Getting the stable release announced
 ------------------------------------

README.md

@@ -5,6 +5,7 @@ This is the github mirror of the official PHP repository located at
 http://git.php.net.
 
 [![Build Status](https://secure.travis-ci.org/php/php-src.svg?branch=master)](http://travis-ci.org/php/php-src)
+[![Build status](https://ci.appveyor.com/api/projects/status/meyur6fviaxgdwdy?svg=true)](https://ci.appveyor.com/project/php/php-src)
 
 Pull Requests
 =============

TSRM/tsrm_nw.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 7                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 7                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

TSRM/tsrm_win32.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 7                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -671,7 +671,6 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
-	int err;
 
 	if (!shm->segment) {
 		return (void*)-1;
@@ -679,8 +678,8 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 
 	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
 
-	err = GetLastError();
-	if (err) {
+	if (NULL == shm->addr) {
+		int err = GetLastError();
 		/* Catch more errors */
 		if (ERROR_NOT_ENOUGH_MEMORY == err) {
 			_set_errno(ENOMEM);

TSRM/tsrm_win32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 7                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2016 The PHP Group                                |
+   | Copyright (c) 1997-2017 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |

UPGRADING

@@ -484,6 +484,7 @@ Other
     is defined in the interface.
   . session.lazy_write(default=On) INI setting enables only write session data when
     session data is updated.
+  . session_regenerate_id() saves current $_SESSION before creating new session ID.
 
 - Opcache
   . Removed opcache.load_comments configuration directive. Now doc comments
@@ -651,6 +652,11 @@ Other
   Since 7.0.9, getenv() has optional second parameter, making it only
   consider local environment and not SAPI environment if true.
 
+- fopen()
+  Since 7.0.16, mode 'e' was added, which sets the close-on-exec flag
+  on the opened file descriptor. This mode is only available in PHP compiled on
+  POSIX.1-2008 conform systems.
+
 ========================================
 6. New Functions
 ========================================
@@ -721,6 +727,13 @@ out, that the corresponding SDK isn't available anymore.
   Mhash is not an extension anymore, use function_exists("mhash") to check whether
   it is avaliable.
 
+- PDO_Firebird
+  As of PHP 7.0.16, the fetched data for integer fields is aware of the Firebird
+  datatypes. Previously all integers was fetched as strings, starting with the
+  aforementioned PHP version integer fields are translated to the PHP integer
+  datatype. The 64-bit integers are still fetched as strings in 32-bit PHP
+  builds.
+
 - GD
   The bundled libgd requires libwebp instead of libvpx for the WebP functionality.
 
@@ -787,6 +800,7 @@ out, that the corresponding SDK isn't available anymore.
   . Removed asp_tags ini directive. Trying to enable it will result in a fatal
     error.
   . Removed always_populate_raw_post_data ini directive.
+  . realpath_cache_size set to 4096k by default
 
 ========================================
 12. Windows Support

Zend/Zend.m4

@@ -100,7 +100,7 @@ AC_FUNC_ALLOCA
 AC_CHECK_FUNCS(memcpy strdup getpid kill strtod strtol finite fpclass sigsetjmp)
 AC_ZEND_BROKEN_SPRINTF
 
-AC_CHECK_FUNCS(finite isfinite isinf isnan)
+AC_CHECK_DECLS([isfinite, isnan, isinf], [], [], [[#include <math.h>]])
 
 ZEND_FP_EXCEPT
 

Zend/configure.in

@@ -64,33 +64,33 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 /* To enable the is_nan, is_infinite and is_finite PHP functions */
 #ifdef NETWARE
-	#define HAVE_ISNAN 1
-	#define HAVE_ISINF 1
-	#define HAVE_ISFINITE 1
+	#define HAVE_DECL_ISNAN 1
+	#define HAVE_DECL_ISINF 1
+	#define HAVE_DECL_ISFINITE 1
 #endif
 
 #ifndef zend_isnan
-#ifdef HAVE_ISNAN
+#if HAVE_DECL_ISNAN
 #define zend_isnan(a) isnan(a)
 #elif defined(HAVE_FPCLASS)
 #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
 #else
-#define zend_isnan(a) 0
+#define zend_isnan(a) ((a) != (a))
 #endif
 #endif
 
-#ifdef HAVE_ISINF
+#if HAVE_DECL_ISINF
 #define zend_isinf(a) isinf(a)
 #elif defined(INFINITY)
 /* Might not work, but is required by ISO C99 */
-#define zend_isinf(a) (((a)==INFINITY)?1:0)
+#define zend_isinf(a) (((a)==INFINITY || (a)==-INFINITY)?1:0)
 #elif defined(HAVE_FPCLASS)
 #define zend_isinf(a) ((fpclass(a) == FP_PINF) || (fpclass(a) == FP_NINF))
 #else
 #define zend_isinf(a) 0
 #endif
 
-#if defined(HAVE_ISFINITE) || defined(isfinite)
+#if HAVE_DECL_ISFINITE
 #define zend_finite(a) isfinite(a)
 #elif defined(HAVE_FINITE)
 #define zend_finite(a) finite(a)

Zend/tests/017.phpt

@@ -26,7 +26,6 @@ var_dump(count(get_defined_constants()));
 function test () {
 }
 
-var_dump(get_defined_functions(true));
 var_dump(gettype(get_defined_functions()));
 var_dump(count(get_defined_functions()));
 
@@ -65,9 +64,6 @@ NULL
 string(5) "array"
 string(5) "array"
 int(%d)
-
-Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
-NULL
 string(5) "array"
 int(%d)
 

Zend/tests/assign_to_obj_002.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Assign to $this leaks when $this not defined
+--FILE--
+<?php
+
+try {
+	$this->a = new stdClass;
+} catch (Error $e) { echo $e->getMessage(), "\n"; }
+
+?>
+--EXPECT--
+Using $this when not in object context

Zend/tests/ast/zend-pow-assign.phpt

@@ -0,0 +1,11 @@
+--TEST--
+ZEND_POW_ASSIGN
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+
+assert_options(ASSERT_WARNING);
+assert(false && ($a **= 2));
+--EXPECTF--
+Warning: assert(): assert(false && ($a **= 2)) failed in %s%ezend-pow-assign.php on line %d

Zend/tests/bug70547.phpt

@@ -53,27 +53,43 @@ string(3) "1st"
 string(3) "2nd"
 NULL
 string(3) "4th"
-array(3) {
+array(4) {
   [0]=>
   string(3) "1st"
   [1]=>
   &string(3) "2nd"
+  [2]=>
+  NULL
   [3]=>
   string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
   [1]=>
   string(3) "2nd"
+  [2]=>
+  NULL
   [3]=>
   string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
   [1]=>
   &string(3) "2nd"
+  [2]=>
+  NULL
   [3]=>
   string(3) "4th"
 }
-array(1) {
+array(4) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
   [3]=>
   string(3) "4th"
 }

Zend/tests/bug72101.phpt

@@ -79,7 +79,7 @@ Stack trace:
 #0 %sbug72101.php(8): {closure}(2, 'Parameter 1 to ...', '%s', 8, Array)
 #1 %sbug72101.php(27): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #2 %sbug72101.php(19): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#3 %sbug72101.php(51): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(52): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #4 %sbug72101.php(72): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
 #5 {main}
   thrown in %sbug72101.php on line 61

Zend/tests/bug73663.phpt

@@ -0,0 +1,73 @@
+--TEST--
+Bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+	$ref = range(1, 10);
+	return;
+}
+
+$func = function (&$ref) {
+	return change($ref);
+};
+
+$array = [1];
+var_dump(list($val) = $array); // NG: Invalid opcode
+
+change(list($val) = $array);
+var_dump($array);
+
+$array = [1];
+
+$func(list($val) = $array);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}

Zend/tests/bug73753.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #73753 Non packed arrays and duplication
+--FILE--
+<?php
+function iterate($current, $a, $result = null) {
+    if (!$current) {
+        return $result;
+    }
+
+    return iterate(getNext($a), $a, $current);
+}
+
+function getNext(&$a) {
+    return next($a);
+}
+
+function getCurrent($a) {
+    return current($a);
+}
+
+function traverse($a) {
+    return iterate(getCurrent($a), $a);
+}
+
+$arr = array(1 => 'foo', 'b' => 'bar', 'baz');
+var_dump(traverse($arr));
+?>
+--EXPECTF--
+string(3) "baz"

Zend/tests/bug73792.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #73792 (invalid foreach loop hangs script)
+--FILE--
+<?php
+$a = 'aaa';
+
+foreach ($a['bbb'] as &$value) {
+	echo 'loop';
+}
+
+unset($value);
+echo 'done';
+?>
+--EXPECTF--
+Warning: Illegal string offset 'bbb' in %sbug73792.php on line 4
+
+Fatal error: Uncaught Error: Cannot iterate on string offsets by reference in %sbug73792.php:4
+Stack trace:
+#0 {main}
+  thrown in %sbug73792.php on line 4

Zend/tests/bug73900.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #73900: Use After Free in unserialize() SplFixedArray
+--FILE--
+<?php
+
+$a = new stdClass;
+$b = new SplFixedArray(1);
+$b[0] = $a;
+$c = &$b[0];
+var_dump($c);
+
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}

Zend/tests/bug73916.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #73916 (zend_print_flat_zval_r doesn't consider reference)
+--FILE--
+<?php
+$a = array('a');
+class b{};
+$b = new b;
+$test[] =& $a;
+$test[] =& $b;
+test($test);
+function test() {
+	debug_print_backtrace();
+}
+?>
+--EXPECTF--
+#0  test(Array ([0] => Array ([0] => a),[1] => b Object ())) called at [%sbug73916.php:%d]

Zend/tests/bug73954.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #73954 (NAN check fails on Alpine Linux with musl)
+--FILE--
+<?php
+
+var_dump(NAN);
+var_dump(is_nan(NAN));
+
+function takes_int(int $int) {
+}
+
+takes_int(log(tan(3.14)));
+
+?>
+--EXPECTF--
+float(NAN)
+bool(true)
+
+Fatal error: Uncaught TypeError: Argument 1 passed to takes_int() must be of the type integer, float given, called in %s on line 9 and defined in %s:6
+Stack trace:
+#0 %s(9): takes_int(NAN)
+#1 {main}
+  thrown in %s on line 6

Zend/tests/bug73960.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #73960: Leak with instance method calling static method with referenced return
+--FILE--
+<?php
+
+$value = 'one';
+$array = array($value);
+$array = $ref =& $array;
+var_dump($array);
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(3) "one"
+}

Zend/tests/bug73989.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #73989 (PHP 7.1 Segfaults within Symfony test suite)
+--FILE--
+<?php
+class Cycle
+{
+    private $thing;
+
+    public function __construct()
+    {
+		$obj = $this;
+        $this->thing = function() use($obj) {};
+    }
+
+    public function __destruct()
+    {
+		($this->thing)();
+    }
+
+}
+
+for ($i = 0; $i < 10000; ++$i) {
+    $obj = new Cycle();
+}
+echo "OK\n";
+?>
+--EXPECT--
+OK

Zend/tests/bug73998.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #73998 (array_key_exists fails on arrays created by get_object_vars)
+--DESCRIPTION--
+Properties of objects with numeric names should be accessible
+--FILE--
+<?php
+$a = new stdClass;
+$a->{1234} = "Numeric";
+$a->a1234 = "String";
+
+$properties = get_object_vars($a);
+var_dump(array_key_exists(1234, $properties));
+echo "Value: {$properties[1234]}\n";
+
+?>
+--EXPECT--
+bool(true)
+Value: Numeric
+

Zend/tests/bug74084.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #74084 (Out of bound read - zend_mm_alloc_small)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$$A += $$B->a = &$$C; 
+unset($$A);
+$$A -= $$B->a = &$$C; 
+unset($$A);
+$$A *= $$B->a = &$$C; 
+unset($$A);
+$$A /= $$B->a = &$$C; 
+unset($$A);
+$$A **= $$B->a = &$$C; 
+var_dump($$A);
+?>
+--EXPECT--
+int(1)

Zend/tests/bug74188.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Fixes bug 74188 (undeclared static variables emit a warning with ?? operator)
+--FILE--
+<?php
+abstract class Test
+{
+	public static function get()
+	{
+		static::$a ?? true;
+	}
+}
+Test::get();
+?>
+--EXPECT--

Zend/tests/bug74408.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Bug #74408 (Endless loop bypassing execution time limit)
+--INI--
+error_reporting = E_ALL | E_DEPRECATED | E_STRICT
+--FILE--
+<?php
+
+ //php.ini: error_reporting = E_ALL | E_DEPRECATED | E_STRICT
+
+ class ErrorHandling {
+
+  public  function error_handler($errno, $errstr, $errfile, $errline) {
+	  $bla = new NonExistingClass2();
+  }
+
+  public function exception_handler(Error $e) { 
+	  echo "Caught, exception: " . $e->getMessage();
+  }
+ }
+
+ set_error_handler('ErrorHandling::error_handler');
+ set_exception_handler('ErrorHandling::exception_handler');
+
+ $blubb = new NonExistingClass();
+?>
+--EXPECTF--
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
+
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
+
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in Unknown on line 0
+
+Fatal error: Uncaught Error: Class 'NonExistingClass2' not found in %sbug74408.php:%d
+Stack trace:
+#0 [internal function]: ErrorHandling::error_handler(8192, 'Non-static meth...', '%s', %d, Array)
+#1 %sbug74408.php(%d): set_exception_handler('ErrorHandling::...')
+#2 {main}
+  thrown in %sbug74408.php on line %d

Zend/tests/bug74546.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())
+--FILE--
+<?php 
+"000000"[0]::d;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class '0' not found in %sbug74546.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74546.php on line %d

Zend/tests/bug74603.ini

@@ -0,0 +1 @@
+0=0&~2000000000

Zend/tests/bug74603.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}

Zend/tests/bug74657.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #74657 (Undefined constants in array properties result in broken properties)
+--FILE--
+<?php
+
+interface I {
+}
+
+class C {
+	const FOO = I::FOO;
+
+	public $options = [self::FOO => "bar"];
+}
+
+try {
+	var_dump((new C)->options);
+} catch (Throwable $e) {}
+
+var_dump((new C)->options);
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined class constant 'I::FOO' in %sbug74657.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74657.php on line %d
+

Zend/tests/bug74840.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #74840: Opcache overwrites argument of GENERATOR_RETURN within finally
+--FILE--
+<?php
+
+$g = (function($a) {
+	try {
+		return $a + 1;
+	} finally {
+		$b = $a + 2;
+		var_dump($b);
+	}
+	yield; // Generator
+})(1);
+$g->next();
+var_dump($g->getReturn());
+
+?>
+--EXPECT--
+int(3)
+int(2)

Zend/tests/bug74947.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #74947 (Segfault in scanner on INF number)
+--FILE--
+<?php 
+
+echo 200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+echo -200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+?>
+--EXPECTF--
+INF-INF

Zend/tests/bug75241.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)

Zend/tests/bug75252.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #75252: Incorrect token formatting on two parse errors in one request
+--FILE--
+<?php
+
+$code = <<<'CODE'
+function test_missing_semicolon() : string {
+     $x = []
+     FOO
+}
+CODE;
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+?>
+--EXPECT--
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"

Zend/tests/bug75290.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #75290 (debug info of Closures of internal functions contain garbage argument names)
+--FILE--
+<?php
+
+var_dump((new ReflectionFunction('sin'))->getClosure());
+
+var_dump(function ($someThing) {});
+
+?>
+--EXPECT--
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$number"]=>
+    string(10) "<required>"
+  }
+}
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$someThing"]=>
+    string(10) "<required>"
+  }
+}
+

Zend/tests/bug75420.1.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.1 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.10.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.10 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)

Zend/tests/bug75420.11.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.11 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.12.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.12 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
+int(24)

Zend/tests/bug75420.13.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.13 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.14.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.14 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.15.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.15 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["name"] = 24; var_dump($x); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj[$name] = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)

Zend/tests/bug75420.16.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.16 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["obj"] = 24; var_dump($this); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj[$name] = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)

Zend/tests/bug75420.2.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.2 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
+

Zend/tests/bug75420.3.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.3 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.4.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.4 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj->$name));
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)

Zend/tests/bug75420.5.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.5 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(42)
+int(24)

Zend/tests/bug75420.6.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.6 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+bool(false)
+int(24)

Zend/tests/bug75420.7.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.7 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["name"] = 24; var_dump($x); }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj->$name = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)

Zend/tests/bug75420.8.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.8 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["obj"] = 24; var_dump($this); }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj->$name = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)

Zend/tests/bug75420.9.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.9 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420 (Crash when modifing property name in __isset for BP_VAR_IS)
+--FILE--
+<?php
+
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)

Zend/tests/bug75573.phpt

@@ -0,0 +1,64 @@
+--TEST--
+Bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
+--FILE--
+<?php
+
+class A
+{
+	var $_stdObject;
+	function initialize($properties = FALSE) {
+		$this->_stdObject = $properties ? (object) $properties : new stdClass();
+		parent::initialize();
+	}
+	function &__get($property)
+	{
+		if (isset($this->_stdObject->{$property})) {
+			$retval =& $this->_stdObject->{$property};
+			return $retval;
+		} else {
+			return NULL;
+		}
+	}
+	function &__set($property, $value)
+	{
+		return $this->_stdObject->{$property} = $value;
+	}
+	function __isset($property_name)
+	{
+		return isset($this->_stdObject->{$property_name});
+	}
+}
+
+class B extends A
+{
+	function initialize($properties = array())
+	{
+		parent::initialize($properties);
+	}
+	function &__get($property)
+	{
+		if (isset($this->settings) && isset($this->settings[$property])) {
+			$retval =& $this->settings[$property];
+			return $retval;
+		} else {
+			return parent::__get($property);
+		}
+	}
+}
+
+$b = new B();
+$b->settings = [ "foo" => "bar", "name" => "abc" ];
+var_dump($b->name);
+var_dump($b->settings);
+?>
+--EXPECTF--
+Warning: Creating default object from empty value in %sbug75573.php on line %d
+
+Notice: Only variable references should be returned by reference in %sbug75573.php on line %d
+string(3) "abc"
+array(2) {
+  ["foo"]=>
+  string(3) "bar"
+  ["name"]=>
+  string(3) "abc"
+}

Zend/tests/compound_assign_failure.phpt

@@ -0,0 +1,184 @@
+--TEST--
+Behavior of failing compound assignment
+--INI--
+opcache.optimization_level=0
+--FILE--
+<?php
+
+try {
+	$a = 1;
+	$a %= 0;
+} catch (Error $e) { var_dump($a); }
+
+try {
+	$a = 1;
+	$a >>= -1;
+} catch (Error $e) { var_dump($a); }
+
+try {
+	$a = 1;
+	$a <<= -1;
+} catch (Error $e) { var_dump($a); }
+
+set_error_handler(function($type, $msg) { throw new Exception($msg); });
+
+try {
+	$a = [];
+	$a .= "foo";
+} catch (Throwable $e) { var_dump($a); }
+
+try {
+	$a = "foo";
+	$a .= [];
+} catch (Throwable $e) { var_dump($a); }
+
+$x = new stdClass;
+try { $x += 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x += new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x -= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x -= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x *= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x *= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x /= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x /= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x %= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x %= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x **= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x **= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x ^= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x ^= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x &= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x &= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x |= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x |= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x <<= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x <<= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = new stdClass;
+try { $x >>= 1; }
+catch (Exception $e) {}
+var_dump($x);
+
+$x = 1;
+try { $x >>= new stdClass; }
+catch (Exception $e) {}
+var_dump($x);
+?>
+--EXPECTF--
+int(1)
+int(1)
+int(1)
+array(0) {
+}
+string(3) "foo"
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)
+object(stdClass)#%d (0) {
+}
+int(1)

Zend/tests/concat_003.phpt

@@ -2,51 +2,37 @@
 Concatenating many small strings should not slowdown allocations
 --SKIPIF--
 <?php if (PHP_DEBUG) { die ("skip debug version is slow"); } ?>
---INI--
-memory_limit=256m
 --FILE--
 <?php
 
-/* To note is that memory usage can vary depending on whether opcache is on. The actual
-  measuring that matters is timing here. */
-
 $time = microtime(TRUE);
 
 /* This might vary on Linux/Windows, so the worst case and also count in slow machines. */
-$t0_max = 0.1;
-$t1_max = 0.4;
-
-$datas = [];
-for ($i = 0; $i < 220000; $i++)
-{
-    $datas[] = [
-        '000.000.000.000',
-        '000.255.255.255',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-        '保留地址',
-    ];
-}
-
-$t0 = microtime(TRUE) - $time;
-var_dump($t0 < $t0_max);
+$t_max = 1.0;
 
+$datas = array_fill(0, 220000, [
+    '000.000.000.000',
+    '000.255.255.255',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+    '保留地址',
+]);
 
+$time = microtime(TRUE);
 $texts = '';
 foreach ($datas AS $data)
 {
     $texts .= implode("\t", $data) . "\r\n";
 }
 
-$t1 = microtime(TRUE) - $time;
-var_dump($t1 < $t1_max);
+$t = microtime(TRUE) - $time;
+var_dump($t < $t_max);
 
 ?>
 +++DONE+++
 --EXPECT--
 bool(true)
-bool(true)
 +++DONE+++

Zend/tests/declare_006.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Use of non-literals in declare ticks values crashes compiler
+--FILE--
+<?php
+declare(ticks = UNKNOWN_CONST) {
+  echo 'Done';
+}
+--EXPECTF--
+
+Fatal error: declare(ticks) value must be a literal in %sdeclare_006.php on line 2

Zend/tests/generators/bug74954.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Bug #74954 (crash after update of generator yielding from finished generator)
+--FILE--
+<?php
+
+function from() {
+        yield 1;
+        throw new Exception();
+}
+
+function gen($gen) {
+        try {
+                var_dump(yield from $gen);
+        } catch (Exception $e) { print "Caught exception!\n$e\n"; }
+}
+
+$gen = from();
+$gens[] = gen($gen);
+$gens[] = gen($gen);
+
+foreach ($gens as $g) {
+        $g->current();
+}
+
+do {
+        foreach ($gens as $i => $g) {
+                $g->next();
+        }
+} while($gens[0]->valid());
+
+?>
+--EXPECTF--
+Caught exception!
+Exception in %s:%d
+Stack trace:
+#0 %s(%d): from()
+#1 [internal function]: gen(Object(Generator))
+#2 %s(%d): Generator->next()
+#3 {main}
+Caught exception!
+ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
+Stack trace:
+#0 [internal function]: gen(Object(Generator))
+#1 %s(%d): Generator->next()
+#2 {main}

Zend/tests/generators/generator_trampoline.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Calling generator through magic __call()
+--FILE--
+<?php
+class A {
+    public function __call($name, $args) {
+        for ($i = 0; $i < 5; $i++) {
+            yield $i;
+        }
+    }
+}
+
+$a = new A();
+foreach ($a->gen() as $n) {
+    var_dump($n);
+}
+$a->gen();
+?>
+--EXPECT--
+int(0)
+int(1)
+int(2)
+int(3)
+int(4)

Zend/tests/generators/yield_from_greedy_parse.phpt

@@ -0,0 +1,24 @@
+--TEST--
+yield from parses too greedily
+--FILE--
+<?php
+
+function from1234($x) {
+  return $x;
+}
+
+function bar() {
+  yield 24;
+}
+
+function foo() {
+  yield from1234(42);
+  yield from(bar());
+}
+
+foreach (foo() as $value) {
+  var_dump($value);
+}
+--EXPECT--
+int(42)
+int(24)

Zend/tests/get_defined_functions_error.phpt

@@ -3,7 +3,7 @@ Test get_defined_functions() function : error conditions
 --FILE--
 <?php
 
-/* Prototype  : array get_defined_functions  ( void  )
+/* Prototype  : array get_defined_functions  ( $exclude_disabled = false )
  * Description: Gets an array of all defined functions.
  * Source code: Zend/zend_builtin_functions.c
 */
@@ -14,7 +14,8 @@ echo "*** Testing get_defined_functions() : error conditions ***\n";
 
 echo "\n-- Testing get_defined_functions() function with more than expected no. of arguments --\n";
 $extra_arg = 10;
-var_dump( get_defined_functions($extra_arg) );
+$extra_arg2 = 20;
+var_dump( get_defined_functions($extra_arg, $extra_arg2) );
 
 ?> 
 ===Done===
@@ -23,7 +24,7 @@ var_dump( get_defined_functions($extra_arg) );
 
 -- Testing get_defined_functions() function with more than expected no. of arguments --
 
-Warning: get_defined_functions() expects exactly 0 parameters, 1 given in %s on line %d
+Warning: get_defined_functions() expects at most 1 parameter, 2 given in %s on line %d
 NULL
  
 ===Done===

Zend/tests/self_and.phpt

@@ -6,6 +6,8 @@ ANDing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s &= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 &= 33;
 var_dump($s2);
 
+$s3 &= " ";
+var_dump($s3);
+
+$s4 &= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--	
 int(18)
 int(0)
 int(33)
+string(1) " "
+string(2) "  "
 Done

Zend/tests/self_or.phpt

@@ -6,6 +6,8 @@ ORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s |= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 |= 33;
 var_dump($s2);
 
+$s3 |= " ";
+var_dump($s3);
+
+$s4 |= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(127)
 int(11)
 int(45345)
+string(1) "f"
+string(2) "ff"
 Done

Zend/tests/self_xor.phpt

@@ -6,6 +6,8 @@ XORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s ^= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 ^= 33;
 var_dump($s2);
 
+$s3 ^= " ";
+var_dump($s3);
+
+$s4 ^= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(109)
 int(11)
 int(45312)
+string(1) "F"
+string(2) "FF"
 Done

Zend/zend.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -152,11 +152,12 @@ ZEND_TSRMLS_CACHE_DEFINE()
 #endif
 
 ZEND_API zend_utility_values zend_uv;
+ZEND_API zend_bool zend_dtrace_enabled;
 
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2016 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2017 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4
 
 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object) /* {{{ */
@@ -312,6 +313,9 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			ZEND_PUTS(")");
 			break;
 		}
+		case IS_REFERENCE:
+			zend_print_flat_zval_r(Z_REFVAL_P(expr));
+			break;
 		default:
 			zend_print_variable(expr);
 			break;
@@ -563,6 +567,7 @@ static void executor_globals_ctor(zend_executor_globals *executor_globals) /* {{
 #ifdef ZEND_WIN32
 	zend_get_windows_version_info(&executor_globals->windows_version_info);
 #endif
+	executor_globals->valid_symbol_table = 0;
 }
 /* }}} */
 
@@ -678,14 +683,25 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /
 
 #if HAVE_DTRACE
 /* build with dtrace support */
-	zend_compile_file = dtrace_compile_file;
-	zend_execute_ex = dtrace_execute_ex;
-	zend_execute_internal = dtrace_execute_internal;
+	{
+		char *tmp = getenv("USE_ZEND_DTRACE");
+
+		if (tmp && zend_atoi(tmp, 0)) {
+			zend_dtrace_enabled = 1;
+			zend_compile_file = dtrace_compile_file;
+			zend_execute_ex = dtrace_execute_ex;
+			zend_execute_internal = dtrace_execute_internal;
+		} else {
+			zend_compile_file = compile_file;
+			zend_execute_ex = execute_ex;
+			zend_execute_internal = NULL;
+		}
+	}
 #else
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
 	zend_execute_internal = NULL;
-#endif /* HAVE_SYS_SDT_H */
+#endif /* HAVE_DTRACE */
 	zend_compile_string = compile_string;
 	zend_throw_exception_hook = NULL;
 
@@ -880,6 +896,8 @@ void zend_set_utility_values(zend_utility_values *utility_values) /* {{{ */
 /* this should be compatible with the standard zenderror */
 ZEND_COLD void zenderror(const char *error) /* {{{ */
 {
+	CG(parse_error) = 0;
+
 	if (EG(exception)) {
 		/* An exception was thrown in the lexer, don't throw another in the parser. */
 		return;

Zend/zend.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -297,8 +297,9 @@ ZEND_COLD void zenderror(const char *error);
 #define ZEND_STANDARD_CLASS_DEF_PTR zend_standard_class_def
 extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
-extern ZEND_API zval zval_used_for_init;
 
+/* If DTrace is available and enabled */
+extern ZEND_API zend_bool zend_dtrace_enabled;
 END_EXTERN_C()
 
 #define ZEND_UV(name) (zend_uv.name)

Zend/zend_API.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -1087,8 +1087,6 @@ ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
 ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */
 {
 	if (!(class_type->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
-		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
-
 		if (class_type->parent) {
 			if (UNEXPECTED(zend_update_class_constants(class_type->parent) != SUCCESS)) {
 				return FAILURE;
@@ -1162,7 +1160,9 @@ ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */
 
 			*scope = old_scope;
 		}
+		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
 	}
+
 	return SUCCESS;
 }
 /* }}} */
@@ -2028,17 +2028,19 @@ ZEND_API zend_module_entry* zend_register_module_ex(zend_module_entry *module) /
 		zend_string_release(lcname);
 		return NULL;
 	}
-	zend_string_release(lcname);
 	module = module_ptr;
 	EG(current_module) = module;
 
 	if (module->functions && zend_register_functions(NULL, module->functions, NULL, module->type)==FAILURE) {
+		zend_hash_del(&module_registry, lcname);
+		zend_string_release(lcname);
 		EG(current_module) = NULL;
 		zend_error(E_CORE_WARNING,"%s: Unable to register functions, unable to load", module->name);
 		return NULL;
 	}
 
 	EG(current_module) = NULL;
+	zend_string_release(lcname);
 	return module;
 }
 /* }}} */
@@ -3065,7 +3067,8 @@ get_function_via_handler:
 					    (!fcc->function_handler->common.scope ||
 					     !instanceof_function(ce_org, fcc->function_handler->common.scope))) {
 						if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+								fcc->function_handler->common.function_name) {
 								zend_string_release(fcc->function_handler->common.function_name);
 							}
 							zend_free_trampoline(fcc->function_handler);
@@ -3235,7 +3238,8 @@ again:
 				((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+					fcc->function_handler->common.function_name) {
 					zend_string_release(fcc->function_handler->common.function_name);
 				}
 				zend_free_trampoline(fcc->function_handler);
@@ -3322,7 +3326,8 @@ again:
 						((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+							fcc->function_handler->common.function_name) {
 							zend_string_release(fcc->function_handler->common.function_name);
 						}
 						zend_free_trampoline(fcc->function_handler);

Zend/zend_API.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -709,7 +709,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 		int _num_args = EX_NUM_ARGS(); \
 		int _i; \
 		zval *_real_arg, *_arg = NULL; \
-		zend_expected_type _expected_type = IS_UNDEF; \
+		zend_expected_type _expected_type = Z_EXPECTED_LONG; \
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \

Zend/zend_alloc.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -267,6 +267,8 @@ struct _zend_mm_heap {
 	int                peak_chunks_count;		/* peak number of allocated chunks for current request */
 	int                cached_chunks_count;		/* number of cached chunks */
 	double             avg_chunks_count;		/* average number of chunks allocated per request */
+	int                last_chunks_delete_boundary; /* numer of chunks after last deletion */
+	int                last_chunks_delete_count;    /* number of deletion over the last boundary */
 #if ZEND_MM_CUSTOM
 	union {
 		struct {
@@ -1122,7 +1124,9 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 	chunk->next->prev = chunk->prev;
 	chunk->prev->next = chunk->next;
 	heap->chunks_count--;
-	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1) {
+	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1
+	 || (heap->chunks_count == heap->last_chunks_delete_boundary
+	  && heap->last_chunks_delete_count >= 4)) {
 		/* delay deletion */
 		heap->cached_chunks_count++;
 		chunk->next = heap->cached_chunks;
@@ -1131,6 +1135,14 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size -= ZEND_MM_CHUNK_SIZE;
 #endif
+		if (!heap->cached_chunks) {
+			if (heap->chunks_count != heap->last_chunks_delete_boundary) {
+				heap->last_chunks_delete_boundary = heap->chunks_count;
+				heap->last_chunks_delete_count = 0;
+			} else {
+				heap->last_chunks_delete_count++;
+			}
+		}
 		if (!heap->cached_chunks || chunk->num > heap->cached_chunks->num) {
 			zend_mm_chunk_free(heap, chunk, ZEND_MM_CHUNK_SIZE);
 		} else {
@@ -1864,6 +1876,8 @@ static zend_mm_heap *zend_mm_init(void)
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2279,6 +2293,8 @@ void zend_mm_shutdown(zend_mm_heap *heap, int full, int silent)
 		p->map[0] = ZEND_MM_LRUN(ZEND_MM_FIRST_PAGE);
 		heap->chunks_count = 1;
 		heap->peak_chunks_count = 1;
+		heap->last_chunks_delete_boundary = 0;
+		heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2343,7 +2359,7 @@ ZEND_API int is_zend_mm(void)
 #endif
 }
 
-#if !ZEND_DEBUG && (!defined(_WIN32) || defined(__clang__))
+#if !ZEND_DEBUG && defined(HAVE_BUILTIN_CONSTANT_P)
 #undef _emalloc
 
 #if ZEND_MM_CUSTOM
@@ -2811,6 +2827,8 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2862,7 +2880,7 @@ static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
 ZEND_API void * __zend_malloc(size_t len)
 {
 	void *tmp = malloc(len);
-	if (EXPECTED(tmp)) {
+	if (EXPECTED(tmp || !len)) {
 		return tmp;
 	}
 	zend_out_of_memory();
@@ -2878,7 +2896,7 @@ ZEND_API void * __zend_calloc(size_t nmemb, size_t len)
 ZEND_API void * __zend_realloc(void *p, size_t len)
 {
 	p = realloc(p, len);
-	if (EXPECTED(p)) {
+	if (EXPECTED(p || !len)) {
 		return p;
 	}
 	zend_out_of_memory();

Zend/zend_alloc.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_alloc_sizes.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_arena.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_ast.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -57,17 +57,21 @@ ZEND_API zend_ast *zend_ast_create_znode(znode *node) {
 	return (zend_ast *) ast;
 }
 
-ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr) {
+ZEND_API zend_ast *zend_ast_create_zval_with_lineno(zval *zv, zend_ast_attr attr, uint32_t lineno) {
 	zend_ast_zval *ast;
 
 	ast = zend_ast_alloc(sizeof(zend_ast_zval));
 	ast->kind = ZEND_AST_ZVAL;
 	ast->attr = attr;
 	ZVAL_COPY_VALUE(&ast->val, zv);
-	ast->val.u2.lineno = CG(zend_lineno);
+	ast->val.u2.lineno = lineno;
 	return (zend_ast *) ast;
 }
 
+ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr) {
+	return zend_ast_create_zval_with_lineno(zv, attr, CG(zend_lineno));
+}
+
 ZEND_API zend_ast *zend_ast_create_decl(
 	zend_ast_kind kind, uint32_t flags, uint32_t start_lineno, zend_string *doc_comment,
 	zend_string *name, zend_ast *child0, zend_ast *child1, zend_ast *child2, zend_ast *child3
@@ -155,7 +159,14 @@ ZEND_API zend_ast *zend_ast_create_list(uint32_t init_children, zend_ast_kind ki
 		uint32_t i;
 		va_start(va, kind);
 		for (i = 0; i < init_children; ++i) {
-			ast = zend_ast_list_add(ast, va_arg(va, zend_ast *));
+			zend_ast *child = va_arg(va, zend_ast *);
+			ast = zend_ast_list_add(ast, child);
+			if (child != NULL) {
+				uint32_t lineno = zend_ast_get_lineno(child);
+				if (lineno < ast->lineno) {
+					ast->lineno = lineno;
+				}
+			}
 		}
 		va_end(va);
 	}
@@ -1344,7 +1355,7 @@ simple_list:
 				case ZEND_ASSIGN_BW_OR:  BINARY_OP(" |= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_AND: BINARY_OP(" &= ",  90, 91, 90);
 				case ZEND_ASSIGN_BW_XOR: BINARY_OP(" ^= ",  90, 91, 90);
-				case ZEND_POW:           BINARY_OP(" **= ", 90, 91, 90);
+				case ZEND_ASSIGN_POW:    BINARY_OP(" **= ", 90, 91, 90);
 				EMPTY_SWITCH_DEFAULT_CASE();
 			}
 			break;

Zend/zend_ast.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -190,6 +190,7 @@ typedef struct _zend_ast_decl {
 typedef void (*zend_ast_process_t)(zend_ast *ast);
 extern ZEND_API zend_ast_process_t zend_ast_process;
 
+ZEND_API zend_ast *zend_ast_create_zval_with_lineno(zval *zv, zend_ast_attr attr, uint32_t lineno);
 ZEND_API zend_ast *zend_ast_create_zval_ex(zval *zv, zend_ast_attr attr);
 
 ZEND_API zend_ast *zend_ast_create_ex(zend_ast_kind kind, zend_ast_attr attr, ...);

Zend/zend_build.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_builtin_functions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -507,7 +507,7 @@ ZEND_FUNCTION(func_get_args)
 {
 	zval *p, *q;
 	uint32_t arg_count, first_extra_arg;
-	uint32_t i, n;
+	uint32_t i;
 	zend_execute_data *ex = EX(prev_execute_data);
 
 	if (ZEND_CALL_INFO(ex) & ZEND_CALL_CODE) {
@@ -523,7 +523,6 @@ ZEND_FUNCTION(func_get_args)
 		zend_hash_real_init(Z_ARRVAL_P(return_value), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
 			i = 0;
-			n = 0;
 			p = ZEND_CALL_ARG(ex, 1);
 			if (arg_count > first_extra_arg) {
 				while (i < first_extra_arg) {
@@ -533,7 +532,8 @@ ZEND_FUNCTION(func_get_args)
 						if (Z_OPT_REFCOUNTED_P(q)) { 
 							Z_ADDREF_P(q);
 						}
-						n++;
+					} else {
+						q = &EG(uninitialized_zval);
 					}
 					ZEND_HASH_FILL_ADD(q);
 					p++;
@@ -548,14 +548,15 @@ ZEND_FUNCTION(func_get_args)
 					if (Z_OPT_REFCOUNTED_P(q)) { 
 						Z_ADDREF_P(q);
 					}
-					n++;
+				} else {
+					q = &EG(uninitialized_zval);
 				}
 				ZEND_HASH_FILL_ADD(q);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(return_value)->nNumOfElements = n;
+		Z_ARRVAL_P(return_value)->nNumOfElements = arg_count;
 	}
 }
 /* }}} */
@@ -808,9 +809,6 @@ static void copy_constant_array(zval *dst, zval *src) /* {{{ */
 			}
 		} else if (Z_REFCOUNTED_P(val)) {
 			Z_ADDREF_P(val);
-			if (UNEXPECTED(Z_TYPE_INFO_P(val) == IS_RESOURCE_EX)) {
-				Z_TYPE_INFO_P(new_val) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
-			}
 		}
 	} ZEND_HASH_FOREACH_END();
 }
@@ -853,12 +851,7 @@ repeat:
 		case IS_FALSE:
 		case IS_TRUE:
 		case IS_NULL:
-			break;
 		case IS_RESOURCE:
-			ZVAL_COPY(&val_free, val);
-			/* TODO: better solution than this tricky disable dtor on resource? */
-			Z_TYPE_INFO(val_free) &= ~(IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT);
-			val = &val_free;
 			break;
 		case IS_ARRAY:
 			if (!Z_IMMUTABLE_P(val)) {
@@ -1154,6 +1147,8 @@ ZEND_FUNCTION(get_object_vars)
 	HashTable *properties;
 	zend_string *key;
 	zend_object *zobj;
+	zend_ulong index;
+	zend_bool fast_copy = 0;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
@@ -1172,7 +1167,17 @@ ZEND_FUNCTION(get_object_vars)
 	zobj = Z_OBJ_P(obj);
 
 	if (!zobj->ce->default_properties_count && properties == zobj->properties && !ZEND_HASH_GET_APPLY_COUNT(properties)) {
-		/* fast copy */
+		fast_copy = 1;
+		/* Check if the object has a numeric property, See Bug 73998 */
+		ZEND_HASH_FOREACH_STR_KEY(properties, key) {
+			if (key && ZEND_HANDLE_NUMERIC(key, index)) {
+				fast_copy = 0;
+				break;
+			}
+		} ZEND_HASH_FOREACH_END();
+	}
+
+	if (fast_copy) {
 		if (EXPECTED(zobj->handlers == &std_object_handlers)) {
 			if (EXPECTED(!(GC_FLAGS(properties) & IS_ARRAY_IMMUTABLE))) {
 				GC_REFCOUNT(properties)++;
@@ -1198,7 +1203,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_hash_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_symtable_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}
@@ -1868,13 +1873,22 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 	zend_function *func = Z_PTR_P(zv);
 	zval *internal_ar = va_arg(args, zval *),
 	     *user_ar     = va_arg(args, zval *);
+	zend_bool *exclude_disabled = va_arg(args, zend_bool *);
 
 	if (hash_key->key == NULL || ZSTR_VAL(hash_key->key)[0] == 0) {
 		return 0;
 	}
 
 	if (func->type == ZEND_INTERNAL_FUNCTION) {
-		add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+		char *disable_functions = INI_STR("disable_functions");
+
+		if ((*exclude_disabled == 1) && (disable_functions != NULL)) {
+			if (strstr(disable_functions, func->common.function_name->val) == NULL) {
+				add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+			}
+		} else {
+			add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
+		}
 	} else if (func->type == ZEND_USER_FUNCTION) {
 		add_next_index_str(user_ar, zend_string_copy(hash_key->key));
 	}
@@ -1888,8 +1902,9 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 ZEND_FUNCTION(get_defined_functions)
 {
 	zval internal, user;
+	zend_bool exclude_disabled = 0;
 
-	if (zend_parse_parameters_none() == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|b", &exclude_disabled) == FAILURE) {
 		return;
 	}
 
@@ -1897,7 +1912,7 @@ ZEND_FUNCTION(get_defined_functions)
 	array_init(&user);
 	array_init(return_value);
 
-	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 2, &internal, &user);
+	zend_hash_apply_with_arguments(EG(function_table), copy_function_name, 3, &internal, &user, &exclude_disabled);
 
 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "internal", sizeof("internal")-1, &internal);
 	zend_hash_str_add_new(Z_ARRVAL_P(return_value), "user", sizeof("user")-1, &user);
@@ -2205,7 +2220,6 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 	array_init_size(arg_array, num_args);
 	if (num_args) {
 		uint32_t i = 0;
-		uint32_t n = 0;
 		zval *p = ZEND_CALL_ARG(call, 1);
 
 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
@@ -2228,12 +2242,9 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(arg)) {
 								Z_ADDREF_P(arg);
 							}
-							n++;
 							ZEND_HASH_FILL_ADD(arg);
 						} else {
-							zval tmp;
-							ZVAL_UNDEF(&tmp);
-							ZEND_HASH_FILL_ADD(&tmp);
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
 						i++;
 					}
@@ -2243,9 +2254,10 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(p)) {
 								Z_ADDREF_P(p);
 							}
-							n++;
+							ZEND_HASH_FILL_ADD(p);
+						} else {
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
-						ZEND_HASH_FILL_ADD(p);
 						p++;
 						i++;
 					}
@@ -2258,14 +2270,15 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 					if (Z_OPT_REFCOUNTED_P(p)) {
 						Z_ADDREF_P(p);
 					}
-					n++;
+					ZEND_HASH_FILL_ADD(p);
+				} else {
+					ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 				}
-				ZEND_HASH_FILL_ADD(p);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(arg_array)->nNumOfElements = n;
+		Z_ARRVAL_P(arg_array)->nNumOfElements = num_args;
 	}
 }
 /* }}} */
@@ -2354,13 +2367,19 @@ ZEND_FUNCTION(debug_print_backtrace)
 		object = Z_OBJ(call->This);
 
 		if (call->func) {
+			zend_string *zend_function_name;
+
 			func = call->func;
-			function_name = (func->common.scope &&
-			                 func->common.scope->trait_aliases) ?
-				ZSTR_VAL(zend_resolve_method_name(
-					(object ? object->ce : func->common.scope), func)) :
-				(func->common.function_name ?
-					ZSTR_VAL(func->common.function_name) : NULL);
+            if (func->common.scope && func->common.scope->trait_aliases) {
+                zend_function_name = zend_resolve_method_name(object ? object->ce : func->common.scope, func);
+            } else {
+                zend_function_name = func->common.function_name;
+            }
+            if (zend_function_name != NULL) {
+                function_name = ZSTR_VAL(zend_function_name);
+            } else {
+                function_name = NULL;
+            }
 		} else {
 			func = NULL;
 			function_name = NULL;

Zend/zend_builtin_functions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_closures.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -414,6 +414,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	zval val;
 	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 	HashTable *debug_info;
+	zend_bool zstr_args = (closure->func.type == ZEND_USER_FUNCTION) || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO);
 
 	*is_temp = 1;
 
@@ -446,9 +447,15 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 			zend_string *name;
 			zval info;
 			if (arg_info->name) {
-				name = zend_strpprintf(0, "%s$%s",
-						arg_info->pass_by_reference ? "&" : "",
-						ZSTR_VAL(arg_info->name));
+				if (zstr_args) {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							ZSTR_VAL(arg_info->name));
+				} else {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							((zend_internal_arg_info*)arg_info)->name);
+				}
 			} else {
 				name = zend_strpprintf(0, "%s$param%d",
 						arg_info->pass_by_reference ? "&" : "",

Zend/zend_closures.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_compile.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -1002,10 +1002,8 @@ ZEND_API zend_class_entry *do_bind_class(const zend_op_array* op_array, const ze
 		op1 = RT_CONSTANT(op_array, opline->op1);
 		op2 = RT_CONSTANT(op_array, opline->op2);
 	}
-	if ((ce = zend_hash_find_ptr(class_table, Z_STR_P(op1))) == NULL) {
-		zend_error_noreturn(E_COMPILE_ERROR, "Internal Zend error - Missing class information for %s", Z_STRVAL_P(op1));
-		return NULL;
-	}
+	ce = zend_hash_find_ptr(class_table, Z_STR_P(op1));
+	ZEND_ASSERT(ce);
 	ce->refcount++;
 	if (zend_hash_add_ptr(class_table, Z_STR_P(op2), ce) == NULL) {
 		ce->refcount--;
@@ -1576,6 +1574,7 @@ int zendlex(zend_parser_stack_elem *elem) /* {{{ */
 {
 	zval zv;
 	int retval;
+	uint32_t start_lineno;
 
 	if (CG(increment_lineno)) {
 		CG(zend_lineno)++;
@@ -1584,6 +1583,7 @@ int zendlex(zend_parser_stack_elem *elem) /* {{{ */
 
 again:
 	ZVAL_UNDEF(&zv);
+	start_lineno = CG(zend_lineno);
 	retval = lex_scan(&zv);
 	if (EG(exception)) {
 		return T_ERROR;
@@ -1607,7 +1607,7 @@ again:
 			break;
 	}
 	if (Z_TYPE(zv) != IS_UNDEF) {
-		elem->ast = zend_ast_create_zval(&zv);
+		elem->ast = zend_ast_create_zval_with_lineno(&zv, 0, start_lineno);
 	}
 
 	return retval;
@@ -2783,12 +2783,21 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
 			}
 		} else {
 			zend_compile_expr(&arg_node, arg);
-			ZEND_ASSERT(arg_node.op_type != IS_CV);
 			if (arg_node.op_type == IS_VAR) {
 				opcode = ZEND_SEND_VAR_NO_REF;
 				if (fbc && ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
 					flags |= ZEND_ARG_SEND_BY_REF;
 				}
+			} else if (arg_node.op_type == IS_CV) {
+				if (fbc) {
+					if (ARG_SHOULD_BE_SENT_BY_REF(fbc, arg_num)) {
+						opcode = ZEND_SEND_REF;
+					} else {
+						opcode = ZEND_SEND_VAR;
+					}
+				} else {
+					opcode = ZEND_SEND_VAR_EX;
+				}
 			} else {
 				if (fbc) {
 					opcode = ZEND_SEND_VAL;
@@ -4359,8 +4368,12 @@ void zend_compile_declare(zend_ast *ast) /* {{{ */
 		zend_ast *declare_ast = declares->child[i];
 		zend_ast *name_ast = declare_ast->child[0];
 		zend_ast *value_ast = declare_ast->child[1];
-
 		zend_string *name = zend_ast_get_str(name_ast);
+
+		if (value_ast->kind != ZEND_AST_ZVAL) {
+			zend_error_noreturn(E_COMPILE_ERROR, "declare(%s) value must be a literal", ZSTR_VAL(name));
+		}
+
 		if (zend_string_equals_literal_ci(name, "ticks")) {
 			zval value_zv;
 			zend_const_expr_to_zval(&value_zv, value_ast);
@@ -5588,7 +5601,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			zend_string *ns_name = zend_string_alloc(ZSTR_LEN(current_ns) + 1 + ZSTR_LEN(new_name), 0);
 			zend_str_tolower_copy(ZSTR_VAL(ns_name), ZSTR_VAL(current_ns), ZSTR_LEN(current_ns));
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
-			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));
+			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name) + 1);
 
 			zend_check_use_conflict(type, old_name, new_name, ns_name);
 
@@ -6656,8 +6669,11 @@ void zend_compile_class_const(znode *result, zend_ast *ast) /* {{{ */
 		return;
 	}
 
-	zend_eval_const_expr(&class_ast);
-	zend_eval_const_expr(&const_ast);
+	zend_eval_const_expr(&ast->child[0]);
+	zend_eval_const_expr(&ast->child[1]);
+
+	class_ast = ast->child[0];
+	const_ast = ast->child[1];
 
 	if (class_ast->kind == ZEND_AST_ZVAL) {
 		resolved_name = zend_resolve_class_name_ast(class_ast);
@@ -7301,6 +7317,8 @@ void zend_compile_expr(znode *result, zend_ast *ast) /* {{{ */
 
 void zend_compile_var(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 {
+	CG(zend_lineno) = zend_ast_get_lineno(ast);
+
 	switch (ast->kind) {
 		case ZEND_AST_VAR:
 			zend_compile_simple_var(result, ast, type, 0);
@@ -7597,8 +7615,11 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				break;
 			}
 
-			zend_eval_const_expr(&class_ast);
-			zend_eval_const_expr(&name_ast);
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+
+			class_ast = ast->child[0];
+			name_ast = ast->child[1];
 
 			if (name_ast->kind == ZEND_AST_ZVAL && zend_string_equals_literal_ci(zend_ast_get_str(name_ast), "class")) {
 				zend_error_noreturn(E_COMPILE_ERROR,

Zend/zend_compile.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_config.nw.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_config.w32.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_constants.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_constants.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_default_classes.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_errors.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_exceptions.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -186,7 +186,9 @@ ZEND_API void zend_clear_exception(void) /* {{{ */
 	}
 	OBJ_RELEASE(EG(exception));
 	EG(exception) = NULL;
-	EG(current_execute_data)->opline = EG(opline_before_exception);
+	if (EG(current_execute_data)) {
+		EG(current_execute_data)->opline = EG(opline_before_exception);
+	}
 #if ZEND_DEBUG
 	EG(opline_before_exception) = NULL;
 #endif
@@ -554,8 +556,8 @@ static void _build_trace_args(zval *arg, smart_str *str) /* {{{ */
 			break;
 		case IS_DOUBLE: {
 			double dval = Z_DVAL_P(arg);
-			char *s_tmp = emalloc(MAX_LENGTH_OF_DOUBLE + EG(precision) + 1);
-			int l_tmp = zend_sprintf(s_tmp, "%.*G", (int) EG(precision), dval);  /* SAFE */
+			char *s_tmp;
+			size_t l_tmp = zend_spprintf(&s_tmp, MAX_LENGTH_OF_DOUBLE + EG(precision) + 1, "%.*G", (int) EG(precision), dval);  /* SAFE */
 			smart_str_appendl(str, s_tmp, l_tmp);
 			smart_str_appends(str, ", ");
 			efree(s_tmp);

Zend/zend_exceptions.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |

Zend/zend_execute.c

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -1412,11 +1412,11 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 	zval rv;
 
 	if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-		zval *z, obj;
+		zval *z, *zptr, obj;
 				
 		ZVAL_OBJ(&obj, Z_OBJ_P(object));
 		Z_ADDREF(obj);
-		z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
+		zptr = z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
 		if (UNEXPECTED(EG(exception))) {
 			OBJ_RELEASE(Z_OBJ(obj));
 			return;
@@ -1443,7 +1443,7 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 		}
 		Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
 		OBJ_RELEASE(Z_OBJ(obj));
-		zval_ptr_dtor(z);
+		zval_ptr_dtor(zptr);
 	} else {
 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
 		if (UNEXPECTED(result)) {
@@ -1758,16 +1758,9 @@ convert_to_array:
 				zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
 			} else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
 				if (!Z_ISREF_P(retval)) {
-					if (Z_REFCOUNTED_P(retval) &&
-					    Z_REFCOUNT_P(retval) > 1) {
-						if (Z_TYPE_P(retval) != IS_OBJECT) {
-							Z_DELREF_P(retval);
-							ZVAL_DUP(result, retval);
-							retval = result;
-						} else {
-							ZVAL_COPY_VALUE(result, retval);
-							retval = result;
-						}
+					if (result != retval) {
+						ZVAL_COPY(result, retval);
+						retval = result;
 					}
 					if (Z_TYPE_P(retval) != IS_OBJECT) {
 						zend_class_entry *ce = Z_OBJCE_P(container);

Zend/zend_execute.h

@@ -2,7 +2,7 @@
    +----------------------------------------------------------------------+
    | Zend Engine                                                          |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
+   | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
    | that is bundled with this package in the file LICENSE, and is        |
@@ -79,6 +79,10 @@ static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval
 				return variable_ptr;
 			}
 			if (ZEND_CONST_COND(value_type & (IS_VAR|IS_CV), 1) && variable_ptr == value) {
+				if (value_type == IS_VAR && ref) {
+					ZEND_ASSERT(GC_REFCOUNT(ref) > 1);
+					--GC_REFCOUNT(ref);
+				}
 				return variable_ptr;
 			}
 			garbage = Z_COUNTED_P(variable_ptr);