remove older UPGRADING entry, bug #38409 is already fixed in 5.6

Thanks to ryat for reportinig

UPGRADING

@@ -352,7 +352,7 @@ Relevant RFCs:
 Other language changes
 ----------------------
 
-* Removed support for static calls to non-static calls form an incompatible
+* Removed support for static calls to non-static methods from an incompatible
   $this context. In this case $this will not be defined, but the call will be
   allowed with a deprecation notice. An example:
 
@@ -556,6 +556,10 @@ Other
   . Added ability to move PHP code pages (PHP TEXT segment) into HUGE pages.
     It's possible to enable/disable this feature in php.ini through
     opcache.huge_code_pages=0/1. OS should be configured to provide huge pages.
+  . Added Windows only opcache.file_cache_fallback=1 ini option, which implies
+    the implemented fallback mechanism. When OPcache was not able to reattach
+    the shared memory segment to the desired address and opcache.file_cache
+    is on, opcache.file_cache_only=1 will be automatically enforced.
 
 - OpenSSL
   . Added "alpn_protocols" SSL context option allowing encrypted client/server
@@ -604,9 +608,6 @@ Other
 5. Changed Functions
 ========================================
 
-- parse_ini_file():
-- parse_ini_string():
-  . Added scanner mode INI_SCANNER_TYPED to yield typed .ini values.
 - unserialize():
   . Added second parameter for unserialize function 
     (RFC: https://wiki.php.net/rfc/secure_unserialize) allowing to specify

Zend/tests/bug70430.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #70430: Stack buffer overflow in zend_language_parser()
+--FILE--
+<?php
+
+$"*** Testing function() :  ***\n";
+
+?>
+--EXPECTF--
+Parse error: syntax error, unexpected '"*** Testing function() :  ***' (T_CONSTANT_ENCAPSED_STRING), expecting variable (T_VARIABLE) or '{' or '$' in %s on line %d

Zend/tests/bug70689.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #70689 (Exception handler does not work as expected)
+--FILE--
+<?php
+
+function foo($foo) {
+	echo "Executing foo\n";
+}
+
+set_error_handler(function($errno, $errstr) {
+	throw new Exception($errstr);
+});
+
+try {
+	foo();
+} catch (Exception $e) {
+	echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Missing argument 1 for foo(), called in %sbug70689.php on line %d and defined

Zend/tests/bug70748.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #70748 (Segfault in ini_lex () at Zend/zend_ini_scanner.l)
+--FILE--
+<?php
+$ini = '[${ 	';
+
+$ini_file = __DIR__ . "/bug70748.ini";
+
+file_put_contents($ini_file, $ini);
+
+var_dump(parse_ini_file($ini_file));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . "bug70748.ini");
+?>
+--EXPECTF--
+Warning: syntax error, unexpected $end, expecting '}' in %sbug70748.ini on line %d
+ in %sbug70748.php on line %d
+bool(false)

Zend/tests/bug70782.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #70782: null ptr deref and segfault (zend_get_class_fetch_type)
+--FILE--
+<?php
+
+(-0)::$prop;
+
+?>
+--EXPECTF--
+Fatal error: Illegal class name in %s on line %d

Zend/tests/bug70785.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #70785 (Infinite loop due to exception during identical comparison)
+--FILE--
+<?php
+
+set_error_handler(function($no, $msg) {
+	throw new Exception($msg);
+});
+
+try {
+	if ($a === null) { // ZEND_VM_SMART_BRANCH  
+		undefined_function('Null');
+	}
+} catch (Exception $e) {
+}
+
+try  {
+	$c === 3; // ZEND_VM_NEXT_OPCODE
+	undefined_function();
+} catch (Exception $e) {
+}
+?>
+okey
+--EXPECT--
+okey

Zend/tests/bug70805.phpt

@@ -0,0 +1,46 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["array"]);
+			unset($GLOBALS["a"]); // this will be called in gc_colloct_roots and put $a into gc roots buf
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+$c = new A;
+$array = array($c); //This is used to leave a room for $GLOBALS["a"]
+unset($c);
+
+while ($i++ < 9997) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t); // This is used to trigger C::__destruct while doing gc_colloct_roots
+
+$e = $a;
+unset($a); // This one can not be putted into roots buf because it's full, thus gc_colloct_roots will be called, 
+           // but C::__destructor which is called in gc_colloct_roots will put $a into buf
+		   // which will make $a be putted into gc roots buf twice
+var_dump(gc_collect_cycles());
+?>
+--EXPECT--
+int(0)

Zend/tests/bug70805_1.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite) (Crash)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["array"]);
+			unset($GLOBALS["a"]);
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+$c = new A;
+$array = array($c); 
+unset($c);
+
+while ($i++ < 9997) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t);
+unset($a);
+
+var_dump(gc_collect_cycles());
+?>
+--EXPECT--
+int(2)

Zend/tests/bug70805_2.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #70805 (Segmentation faults whilst running Drupal 8 test suite) (Memleak)
+--FILE--
+<?php
+class A {
+}
+
+class B {
+}
+
+class C {
+	public function __destruct() {
+		if (isset($GLOBALS["a"])) {
+			unset($GLOBALS["a"]);
+		}
+	}
+}
+
+$a = new A;
+$a->b = new B;
+$a->b->a = $a;
+
+$i = 0;
+
+while ($i++ < 9998) {
+	$t = [];
+	$t[] = &$t;
+	unset($t);
+}
+$t = [new C];
+$t[] = &$t;
+unset($t);
+
+unset($a);
+var_dump(gc_collect_cycles());
+--EXPECT--
+int(2)

Zend/tests/bug70873.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #70873 (Regression on private static properties access)
+--FILE--
+<?php
+
+class A {
+	private static $x = 1;
+}
+
+class B extends A {
+	function bar() {
+		var_dump(self::$x);
+	}
+};
+
+class C extends A {
+	function bar() {
+		var_dump(A::$x);
+	}
+};
+
+
+$a = new B;
+$a->bar();
+
+$b = new C;
+$b->bar();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot access  property B::$x in %sbug70873.php:%d
+Stack trace:
+#0 %sbug70873.php(%d): B->bar()
+#1 {main}
+  thrown in %sbug70873.php on line %d

Zend/tests/bug70895.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #70895 null ptr deref and segfault with crafted calable
+--FILE--
+<?php
+
+array_map("%n", 0);
+array_map("%n %i", 0);
+array_map("%n %i aoeu %f aoeu %p", 0);
+?>
+--EXPECTREGEX--
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i aoeu %f aoeu %p' not found or invalid function name in .+bug70895.php on line \d+

Zend/tests/bug70898.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #70895 null ptr deref and segfault with crafted calable
+--FILE--
+<?php 
+	function m($f,$a){
+		return array_map($f,0);
+	}
+
+	echo implode(m("",m("",m("",m("",m("0000000000000000000000000000000000",("")))))));
+?>
+--EXPECTF--
+Warning: array_map() expects parameter 1 to be a valid callback, function '0000000000000000000000000000000000' not found or invalid function name in %sbug70898.php on line %d
+
+Warning: array_map() expects parameter 1 to be a valid callback, function '' not found or invalid function name in %sbug70898.php on line %d
+
+Warning: array_map() expects parameter 1 to be a valid callback, function '' not found or invalid function name in %sbug70898.php on line %d
+
+Warning: array_map() expects parameter 1 to be a valid callback, function '' not found or invalid function name in %sbug70898.php on line %d
+
+Warning: array_map() expects parameter 1 to be a valid callback, function '' not found or invalid function name in %sbug70898.php on line %d
+
+Warning: implode(): Argument must be an array in %sbug70898.php on line %d

Zend/tests/bug70912.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #70912 (Null ptr dereference when class property is initialised to a dereferenced value)
+--FILE--
+<?php
+class A {
+	public $a=[][];
+}
+?>
+--EXPECTF--
+Fatal error: Cannot use [] for reading in %sbug70912.php on line %d

Zend/tests/bug70914.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #70914 zend_throw_or_error() format string vulnerability 
+--SKIPIF--
+<?php
+if (!extension_loaded("pdo_sqlite")) {
+	die("skip pdo_sqlite required");
+}
+?>
+--FILE--
+<?php
+
+$db = new PDO('sqlite::memory:');
+$st = $db->query('SELECT 1');
+$re = $st->fetchObject('%Z');
+?>
+--EXPECTREGEX--
+Fatal error: Class '%Z' not found in .+bug70914.php on line \d+

Zend/tests/bug70944.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #70944 (try{ } finally{} can create infinite chains of exceptions)
+--FILE--
+<?php
+$e = new Exception("Bar");
+try {
+	  throw new Exception("Foo", 0, $e);
+} finally {
+	  throw $e;
+}
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: Bar in %sbug70944.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug70944.php on line %d

Zend/tests/closure_061.phpt

@@ -64,6 +64,15 @@ $tests = [
         [new DLL, null],
         [new DLL, ClsUnrelated::class],
     ]],
+
+    [function() {}, [
+        [null,         null],
+        [new Cls,      null],
+        [new Cls,      'Cls'],
+        [null,         'Cls'],
+        [null,         'stdClass'],
+        [new stdClass, null],
+    ]],
 ];
 
 set_error_handler(function($errno, $errstr) {
@@ -79,6 +88,9 @@ foreach ($tests as list($fn, $bindings)) {
         $c = (new ReflectionFunction($fn))->getClosure();
         $fnStr = $fn;
     }
+    if ($fn instanceof Closure) {
+        $fnStr = "(function() {})";
+    }
 
     echo "$fnStr()\n" . str_repeat('-', strlen($fnStr) + 2), "\n\n";
 
@@ -206,3 +218,24 @@ Cannot rebind scope of closure created by ReflectionFunctionAbstract::getClosure
 
 bindTo(new SplDoublyLinkedList, ClsUnrelated::class):
 Cannot rebind scope of closure created by ReflectionFunctionAbstract::getClosure()
+
+(function() {})()
+-----------------
+
+bindTo(null, null):
+Success!
+
+bindTo(new Cls, null):
+Success!
+
+bindTo(new Cls, Cls::class):
+Success!
+
+bindTo(null, Cls::class):
+Success!
+
+bindTo(null, stdClass::class):
+Cannot bind closure to scope of internal class stdClass
+
+bindTo(new stdClass, null):
+Success!

Zend/tests/try/try_finally_019.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Combination of foreach, finally and goto (call order)
+--FILE--
+<?php
+class A {
+	public $n = 0;
+	function __construct($n) {
+		$this->n = $n;
+	}
+	function __destruct() {
+		echo "destruct" . $this->n . "\n";
+	}
+}
+
+foreach ([new A(1)] as $a) {
+    $a = null;
+    try {
+        foreach ([new A(2)] as $a) {
+            $a = null;
+            try {
+                foreach ([new A(3)] as $a) {
+                    $a = null;
+                    goto out;
+                }
+            } finally {
+                echo "finally1\n";
+            }
+out: ;
+        }
+    } finally {
+        echo "finally2\n";
+    }
+}
+?>
+--EXPECT--
+destruct3
+finally1
+destruct2
+finally2
+destruct1

Zend/tests/try/try_finally_020.phpt

@@ -0,0 +1,42 @@
+--TEST--
+Combination of foreach, finally and exception (call order)
+--FILE--
+<?php
+class A {
+	public $n = 0;
+	function __construct($n) {
+		$this->n = $n;
+	}
+	function __destruct() {
+		echo "destruct" . $this->n . "\n";
+	}
+}
+
+foreach ([new A(1)] as $a) {
+    $a = null;
+    try {
+        foreach ([new A(2)] as $a) {
+            $a = null;
+            try {
+                foreach ([new A(3)] as $a) {
+                    $a = null;
+                    throw new Exception();
+                }
+            } finally {
+                echo "finally1\n";
+            }
+        }
+    } catch (Exception $e) {
+        echo "catch\n";
+    } finally {
+        echo "finally2\n";
+    }
+}
+?>
+--EXPECT--
+destruct3
+finally1
+destruct2
+catch
+finally2
+destruct1

Zend/tests/varSyntax/static_prop_on_expr_class.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Accessing a static property on a statically evaluable class expression
+--FILE--
+<?php
+
+class A {
+    public static $b = 42;
+}
+var_dump(('A' . (string) '')::$b);
+
+?>
+--EXPECT--
+int(42)

Zend/tests/varSyntax/static_prop_on_expr_class_with_backslash.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Static property on constexpr class with leading backslash
+--FILE--
+<?php
+
+class A {
+    public static $b = 42;
+}
+var_dump(('\A' . (string) '')::$b);
+
+?>
+--EXPECT--
+int(42)

Zend/tests/varSyntax/static_prop_on_int_expr_class.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Static property access on constexpr class evaluating to integer
+--FILE--
+<?php
+((int)1)::$b;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class name must be a valid object or a string in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/zend.c

@@ -1316,7 +1316,7 @@ ZEND_API ZEND_COLD void zend_throw_error(zend_class_entry *exception_ce, const c
 	if (EG(current_execute_data) && !CG(in_compilation)) {
 		zend_throw_exception(exception_ce, message, 0);
 	} else {
-		zend_error(E_ERROR, message);
+		zend_error(E_ERROR, "%s", message);
 	}
 
 	efree(message);
@@ -1346,7 +1346,7 @@ ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, cons
 	if (throw_exception) {
 		zend_throw_exception(zend_ce_type_error, message, 0);
 	} else {
-		zend_error(E_WARNING, message);
+		zend_error(E_WARNING, "%s", message);
 	}
 	efree(message);
 

Zend/zend.h

@@ -22,7 +22,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.0.0-dev"
+#define ZEND_VERSION "3.0.0"
 
 #define ZEND_ENGINE_3
 

Zend/zend_API.c

@@ -1219,8 +1219,20 @@ ZEND_API void object_properties_load(zend_object *object, HashTable *properties)
    	zend_property_info *property_info;
 
    	ZEND_HASH_FOREACH_KEY_VAL(properties, h, key, prop) {
-		if(key) {
-			property_info = zend_get_property_info(object->ce, key, 1);
+		if (key) {
+			if (ZSTR_VAL(key)[0] == '\0') {
+				const char *class_name, *prop_name;
+				size_t prop_name_len;
+				if (zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_name_len) == SUCCESS) {
+					zend_string *pname = zend_string_init(prop_name, prop_name_len, 0);
+					property_info = zend_get_property_info(object->ce, pname, 1);
+					zend_string_release(pname);
+				} else {
+					property_info = ZEND_WRONG_PROPERTY_INFO;
+				}
+			} else {
+				property_info = zend_get_property_info(object->ce, key, 1);
+			}
 			if (property_info != ZEND_WRONG_PROPERTY_INFO &&
 				property_info &&
 				(property_info->flags & ZEND_ACC_STATIC) == 0) {

Zend/zend_alloc.c

@@ -1462,7 +1462,15 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 #if ZEND_DEBUG
 			size = real_size;
 #endif
+#ifdef ZEND_WIN32
+			/* On Windows we don't have ability to extend huge blocks in-place.
+			 * We allocate them with 2MB size granularity, to avoid many 
+			 * reallocations when they are extended by small pieces
+			 */
+			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+#else
 			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+#endif
 			if (new_size == old_size) {
 #if ZEND_DEBUG
 				zend_mm_change_huge_block_size(heap, ptr, new_size, real_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -1507,7 +1515,9 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 					heap->real_size += new_size - old_size;
 #endif
 #if ZEND_MM_STAT
+					heap->real_peak = MAX(heap->real_peak, heap->real_size);
 					heap->size += new_size - old_size;
+					heap->peak = MAX(heap->peak, heap->size);
 #endif
 #if ZEND_DEBUG
 					zend_mm_change_huge_block_size(heap, ptr, new_size, real_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -1618,9 +1628,19 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 	}
 
 	/* Naive reallocation */
+#if ZEND_MM_STAT
+	do {
+		size_t orig_peak = heap->peak;
+		size_t orig_real_peak = heap->real_peak;
+#endif
 	ret = zend_mm_alloc_heap(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	memcpy(ret, ptr, MIN(old_size, copy_size));
 	zend_mm_free_heap(heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+#if ZEND_MM_STAT
+		heap->peak = MAX(orig_peak, heap->size);
+		heap->real_peak = MAX(orig_real_peak, heap->real_size);
+	} while (0);
+#endif
 	return ret;
 }
 
@@ -1710,7 +1730,15 @@ static void zend_mm_change_huge_block_size(zend_mm_heap *heap, void *ptr, size_t
 
 static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
+#ifdef ZEND_WIN32
+	/* On Windows we don't have ability to extend huge blocks in-place.
+	 * We allocate them with 2MB size granularity, to avoid many 
+	 * reallocations when they are extended by small pieces
+	 */
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+#else
 	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+#endif
 	void *ptr;
 
 #if ZEND_MM_LIMIT

Zend/zend_builtin_functions.c

@@ -2481,7 +2481,7 @@ ZEND_FUNCTION(debug_print_backtrace)
 
 ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int options, int limit) /* {{{ */
 {
-	zend_execute_data *call, *ptr, *skip;
+	zend_execute_data *ptr, *skip, *call = NULL;
 	zend_object *object;
 	int lineno, frameno = 0;
 	zend_function *func;
@@ -2490,8 +2490,12 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 	zend_string *include_filename = NULL;
 	zval stack_frame;
 
-	call = NULL;
-	ptr = EG(current_execute_data);
+	array_init(return_value);
+
+	if (!(ptr = EG(current_execute_data))) {
+		return;
+	}
+
 	if (!ptr->func || !ZEND_USER_CODE(ptr->func->common.type)) {
 		call = ptr;
 		ptr = ptr->prev_execute_data;
@@ -2509,13 +2513,11 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 				ptr = ptr->prev_execute_data;
 			}
 		}
+		if (!call) {
+			call = ptr;
+			ptr = ptr->prev_execute_data;
+		}
 	}
-	if (!call) {
-		call = ptr;
-		ptr = ptr->prev_execute_data;
-	}
-
-	array_init(return_value);
 
 	while (ptr && (limit == 0 || frameno < limit)) {
 		frameno++;

Zend/zend_compile.c

@@ -2126,8 +2126,15 @@ static zend_op *zend_compile_class_ref(znode *result, zend_ast *name_ast, int th
 	zend_compile_expr(&name_node, name_ast);
 
 	if (name_node.op_type == IS_CONST) {
-		zend_string *name = Z_STR(name_node.u.constant);
-		uint32_t fetch_type = zend_get_class_fetch_type(name);
+		zend_string *name;
+		uint32_t fetch_type;
+
+		if (Z_TYPE(name_node.u.constant) != IS_STRING) {
+			zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
+		}
+
+		name = Z_STR(name_node.u.constant);
+		fetch_type = zend_get_class_fetch_type(name);
 
 		opline = zend_emit_op(result, ZEND_FETCH_CLASS, NULL, NULL);
 		opline->extended_value = fetch_type | (throw_exception ? ZEND_FETCH_CLASS_EXCEPTION : 0);
@@ -7374,12 +7381,15 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 		case ZEND_AST_DIM:
 		{
 			/* constant expression should be always read context ... */
-
 			zval *container, *dim;
 
+			if (ast->child[1] == NULL) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
+			}
+
 			zend_eval_const_expr(&ast->child[0]);
 			zend_eval_const_expr(&ast->child[1]);
-			if (!ast->child[0] || !ast->child[1] || ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
+			if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
 				return;
 			}
 

Zend/zend_exceptions.c

@@ -70,7 +70,8 @@ ZEND_API zend_class_entry *zend_get_exception_base(zval *object)
 
 void zend_exception_set_previous(zend_object *exception, zend_object *add_previous)
 {
-    zval tmp, *previous, zv, *pzv, rv;
+    zval *previous, *pzv;
+	zval tmp, zv, rv;
 	zend_class_entry *base_ce;
 
 	if (exception == add_previous || !add_previous || !exception) {
@@ -81,6 +82,13 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
 		return;
 	}
+	pzv = zend_read_property(i_get_exception_base(&tmp), &tmp, "previous", sizeof("previous")-1, 1, &rv);
+	while (Z_TYPE_P(pzv) == IS_OBJECT) { 
+		if (Z_OBJ_P(pzv) == exception) {
+			return;
+		}
+		pzv = zend_read_property(i_get_exception_base(pzv), pzv, "previous", sizeof("previous")-1, 1, &rv);
+	}
 	ZVAL_OBJ(&zv, exception);
 	pzv = &zv;
 	do {

Zend/zend_execute.c

@@ -893,7 +893,7 @@ static zend_always_inline int zend_verify_missing_arg_type(zend_function *zf, ui
 	return 1;
 }
 
-static ZEND_COLD int zend_verify_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot)
+static ZEND_COLD void zend_verify_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot)
 {
 	if (EXPECTED(!(EX(func)->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS)) ||
 	    UNEXPECTED(zend_verify_missing_arg_type(EX(func), arg_num, cache_slot))) {
@@ -907,9 +907,7 @@ static ZEND_COLD int zend_verify_missing_arg(zend_execute_data *execute_data, ui
 		} else {
 			zend_error(E_WARNING, "Missing argument %u for %s%s%s()", arg_num, class_name, space, func_name);
 		}
-		return 1;
 	}
-	return 0;
 }
 
 static ZEND_COLD void zend_verify_return_error(const zend_function *zf, const char *need_msg, const char *need_kind, const char *returned_msg, const char *returned_kind)
@@ -2420,7 +2418,7 @@ static zend_always_inline zend_generator *zend_get_running_generator(zend_execut
 }
 /* }}} */
 
-static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
+static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
 {
 	int i;
 	if (UNEXPECTED(EX(call))) {
@@ -2545,6 +2543,12 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data
 			call = EX(call);
 		} while (call);
 	}
+}
+/* }}} */
+
+static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
+{
+	int i;
 
 	for (i = 0; i < EX(func)->op_array.last_brk_cont; i++) {
 		const zend_brk_cont_element *brk_cont = &EX(func)->op_array.brk_cont_array[i];
@@ -2594,7 +2598,8 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data
 /* }}} */
 
 void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);
+	cleanup_live_vars(execute_data, op_num, catch_op_num);
 }
 
 #ifdef HAVE_GCC_GLOBAL_REGS
@@ -2736,9 +2741,9 @@ ZEND_API int ZEND_FASTCALL zend_check_arg_type(zend_function *zf, uint32_t arg_n
 	return zend_verify_arg_type(zf, arg_num, arg, default_value, cache_slot);
 }
 
-ZEND_API int ZEND_FASTCALL zend_check_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot)
+ZEND_API void ZEND_FASTCALL zend_check_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot)
 {
-	return zend_verify_missing_arg(execute_data, arg_num, cache_slot);
+	zend_verify_missing_arg(execute_data, arg_num, cache_slot);
 }
 
 /*

Zend/zend_execute.h

@@ -52,7 +52,7 @@ ZEND_API int zend_eval_stringl_ex(char *str, size_t str_len, zval *retval_ptr, c
 
 ZEND_API void ZEND_FASTCALL zend_check_internal_arg_type(zend_function *zf, uint32_t arg_num, zval *arg);
 ZEND_API int  ZEND_FASTCALL zend_check_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot);
-ZEND_API int  ZEND_FASTCALL zend_check_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot);
+ZEND_API void ZEND_FASTCALL zend_check_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot);
 
 static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval *value, zend_uchar value_type)
 {

Zend/zend_execute_API.c

@@ -220,7 +220,7 @@ static void zend_throw_or_error(int fetch_type, zend_class_entry *exception_ce,
 	if (fetch_type & ZEND_FETCH_CLASS_EXCEPTION) {
 		zend_throw_error(exception_ce, message);
 	} else {
-		zend_error(E_ERROR, message);
+		zend_error(E_ERROR, "%s", message);
 	}
 
 	efree(message);

Zend/zend_gc.c

@@ -242,6 +242,13 @@ ZEND_API void ZEND_FASTCALL gc_possible_root(zend_refcounted *ref)
 		GC_REFCOUNT(ref)++;
 		gc_collect_cycles();
 		GC_REFCOUNT(ref)--;
+		if (UNEXPECTED(GC_REFCOUNT(ref)) == 0) {
+			zval_dtor_func_for_ptr(ref);
+			return;
+		}
+		if (UNEXPECTED(GC_INFO(ref))) {
+			return;
+		}
 		newRoot = GC_G(unused);
 		if (!newRoot) {
 #if ZEND_GC_DEBUG

Zend/zend_hash.c

@@ -283,6 +283,40 @@ ZEND_API void ZEND_FASTCALL zend_hash_extend(HashTable *ht, uint32_t nSize, zend
 	}
 }
 
+static uint32_t zend_array_recalc_elements(HashTable *ht)
+{
+       zval *val;
+       uint32_t num = ht->nNumOfElements;
+
+	   ZEND_HASH_FOREACH_VAL(ht, val) {
+		   if (Z_TYPE_P(val) == IS_UNDEF) continue;
+		   if (Z_TYPE_P(val) == IS_INDIRECT) {
+			   if (UNEXPECTED(Z_TYPE_P(Z_INDIRECT_P(val)) == IS_UNDEF)) {
+				   num--;
+			   }
+		   }
+       } ZEND_HASH_FOREACH_END();
+       return num;
+}
+/* }}} */
+
+ZEND_API uint32_t zend_array_count(HashTable *ht)
+{
+	uint32_t num;
+	if (UNEXPECTED(ht->u.v.flags & HASH_FLAG_HAS_EMPTY_IND)) {
+		num = zend_array_recalc_elements(ht);
+		if (UNEXPECTED(ht->nNumOfElements == num)) {
+			ht->u.v.flags &= ~HASH_FLAG_HAS_EMPTY_IND;
+		}
+	} else if (UNEXPECTED(ht == &EG(symbol_table))) {
+		num = zend_array_recalc_elements(ht);
+	} else {
+		num = zend_hash_num_elements(ht);
+	}
+	return num;
+}
+/* }}} */
+
 ZEND_API void ZEND_FASTCALL zend_hash_set_apply_protection(HashTable *ht, zend_bool bApplyProtection)
 {
 	if (bApplyProtection) {
@@ -1049,9 +1083,14 @@ ZEND_API int ZEND_FASTCALL zend_hash_del_ind(HashTable *ht, zend_string *key)
 					return FAILURE;
 				} else {
 					if (ht->pDestructor) {
-						ht->pDestructor(data);
+						zval tmp;
+						ZVAL_COPY_VALUE(&tmp, data);
+						ZVAL_UNDEF(data);
+						ht->pDestructor(&tmp);
+					} else {
+						ZVAL_UNDEF(data);
 					}
-					ZVAL_UNDEF(data);
+					ht->u.v.flags |= HASH_FLAG_HAS_EMPTY_IND;
 				}
 			} else {
 				_zend_hash_del_el_ex(ht, idx, p, prev);
@@ -1095,6 +1134,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_str_del_ind(HashTable *ht, const char *str,
 						ht->pDestructor(data);
 					}
 					ZVAL_UNDEF(data);
+					ht->u.v.flags |= HASH_FLAG_HAS_EMPTY_IND;
 				}
 			} else {
 				_zend_hash_del_el_ex(ht, idx, p, prev);
@@ -1454,8 +1494,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply(HashTable *ht, apply_func_t apply_fu
 	HT_ASSERT(GC_REFCOUNT(ht) == 1);
 
 	HASH_PROTECT_RECURSION(ht);
-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		result = apply_func(&p->val);
 
@@ -1480,8 +1520,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply_with_argument(HashTable *ht, apply_f
 	HT_ASSERT(GC_REFCOUNT(ht) == 1);
 
 	HASH_PROTECT_RECURSION(ht);
-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		result = apply_func(&p->val, argument);
 
@@ -1509,8 +1549,8 @@ ZEND_API void ZEND_FASTCALL zend_hash_apply_with_arguments(HashTable *ht, apply_
 
 	HASH_PROTECT_RECURSION(ht);
 
-	p = ht->arData;
-	for (idx = 0; idx < ht->nNumUsed; idx++, p++) {
+	for (idx = 0; idx < ht->nNumUsed; idx++) {
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 		va_start(args, num_args);
 		hash_key.h = p->h;
@@ -1543,10 +1583,9 @@ ZEND_API void ZEND_FASTCALL zend_hash_reverse_apply(HashTable *ht, apply_func_t
 
 	HASH_PROTECT_RECURSION(ht);
 	idx = ht->nNumUsed;
-	p = ht->arData + idx;
 	while (idx > 0) {
 		idx--;
-		p--;
+		p = ht->arData + idx;
 		if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
 
 		result = apply_func(&p->val);

Zend/zend_hash.h

@@ -216,6 +216,7 @@ ZEND_API zval* ZEND_FASTCALL zend_hash_minmax(const HashTable *ht, compare_func_
 
 ZEND_API int ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
 
+ZEND_API uint32_t zend_array_count(HashTable *ht);
 ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source);
 ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht);
 ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht);

Zend/zend_ini_parser.y

@@ -106,16 +106,19 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 
 	if (Z_TYPE_P(op1) != IS_STRING) {
 		zend_string *str = zval_get_string(op1);
-		ZVAL_PSTRINGL(op1, str->val, str->len);
+		/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */
+		ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
 		zend_string_release(str);
 	}
-
 	op1_len = (int)Z_STRLEN_P(op1);
+	
+	if (Z_TYPE_P(op2) != IS_STRING) {
+		convert_to_string(op2);
+	}
 	length = op1_len + (int)Z_STRLEN_P(op2);
 
 	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, 1));
-	memcpy(Z_STRVAL_P(result)+op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2));
-	Z_STRVAL_P(result)[length] = 0;
+	memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
 }
 /* }}} */
 

Zend/zend_ini_scanner.c

@@ -114,7 +114,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 
 /* Eat leading whitespace */
 #define EAT_LEADING_WHITESPACE()                     \
-	while (yytext[0]) {                              \
+	while (yyleng) {                                 \
 		if (yytext[0] == ' ' || yytext[0] == '\t') { \
 			SCNG(yy_text)++;                         \
 			yyleng--;                                \
@@ -125,7 +125,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 
 /* Eat trailing whitespace + extra char */
 #define EAT_TRAILING_WHITESPACE_EX(ch)              \
-	while (yyleng > 0 && (                          \
+	while (yyleng && (                              \
 		(ch != 'X' && yytext[yyleng - 1] ==  ch) || \
 		yytext[yyleng - 1] == '\n' ||               \
 		yytext[yyleng - 1] == '\r' ||               \

Zend/zend_ini_scanner.l

@@ -112,7 +112,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 
 /* Eat leading whitespace */
 #define EAT_LEADING_WHITESPACE()                     \
-	while (yytext[0]) {                              \
+	while (yyleng) {                                 \
 		if (yytext[0] == ' ' || yytext[0] == '\t') { \
 			SCNG(yy_text)++;                         \
 			yyleng--;                                \
@@ -123,7 +123,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 
 /* Eat trailing whitespace + extra char */
 #define EAT_TRAILING_WHITESPACE_EX(ch)              \
-	while (yyleng > 0 && (                          \
+	while (yyleng && (                              \
 		(ch != 'X' && yytext[yyleng - 1] ==  ch) || \
 		yytext[yyleng - 1] == '\n' ||               \
 		yytext[yyleng - 1] == '\r' ||               \

Zend/zend_language_parser.y

@@ -1278,50 +1278,66 @@ isset_variable:
    would have been.  */
 static YYSIZE_T zend_yytnamerr(char *yyres, const char *yystr)
 {
-	if (!yyres) {
-		return yystrlen(yystr);
+	/* CG(parse_error) states:
+	 * 0 => yyres = NULL, yystr is the unexpected token
+	 * 1 => yyres = NULL, yystr is one of the expected tokens
+	 * 2 => yyres != NULL, yystr is the unexpected token
+	 * 3 => yyres != NULL, yystr is one of the expected tokens
+	 */
+	if (yyres && CG(parse_error) < 2) {
+		CG(parse_error) = 2;
 	}
-	{
-		if (CG(parse_error) == 0) {
-			char buffer[120];
-			const unsigned char *end, *str, *tok1 = NULL, *tok2 = NULL;
-			unsigned int len = 0, toklen = 0, yystr_len;
 
-			CG(parse_error) = 1;
+	if (CG(parse_error) % 2 == 0) {
+		/* The unexpected token */
+		char buffer[120];
+		const unsigned char *end, *str, *tok1 = NULL, *tok2 = NULL;
+		unsigned int len = 0, toklen = 0, yystr_len;
 
-			if (LANG_SCNG(yy_text)[0] == 0 &&
-				LANG_SCNG(yy_leng) == 1 &&
-				memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {
+		CG(parse_error)++;
+
+		if (LANG_SCNG(yy_text)[0] == 0 &&
+			LANG_SCNG(yy_leng) == 1 &&
+			memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {
+			if (yyres) {
 				yystpcpy(yyres, "end of file");
-				return sizeof("end of file")-1;
 			}
+			return sizeof("end of file")-1;
+		}
 
-			str = LANG_SCNG(yy_text);
-			end = memchr(str, '\n', LANG_SCNG(yy_leng));
-			yystr_len = (unsigned int)yystrlen(yystr);
+		str = LANG_SCNG(yy_text);
+		end = memchr(str, '\n', LANG_SCNG(yy_leng));
+		yystr_len = (unsigned int)yystrlen(yystr);
 
-			if ((tok1 = memchr(yystr, '(', yystr_len)) != NULL
-				&& (tok2 = zend_memrchr(yystr, ')', yystr_len)) != NULL) {
-				toklen = (tok2 - tok1) + 1;
-			} else {
-				tok1 = tok2 = NULL;
-				toklen = 0;
-			}
+		if ((tok1 = memchr(yystr, '(', yystr_len)) != NULL
+			&& (tok2 = zend_memrchr(yystr, ')', yystr_len)) != NULL) {
+			toklen = (tok2 - tok1) + 1;
+		} else {
+			tok1 = tok2 = NULL;
+			toklen = 0;
+		}
 
-			if (end == NULL) {
-				len = LANG_SCNG(yy_leng) > 30 ? 30 : LANG_SCNG(yy_leng);
-			} else {
-				len = (end - str) > 30 ? 30 : (end - str);
-			}
+		if (end == NULL) {
+			len = LANG_SCNG(yy_leng) > 30 ? 30 : LANG_SCNG(yy_leng);
+		} else {
+			len = (end - str) > 30 ? 30 : (end - str);
+		}
+		if (yyres) {
 			if (toklen) {
 				snprintf(buffer, sizeof(buffer), "'%.*s' %.*s", len, str, toklen, tok1);
 			} else {
 				snprintf(buffer, sizeof(buffer), "'%.*s'", len, str);
 			}
 			yystpcpy(yyres, buffer);
-			return len + (toklen ? toklen + 1 : 0) + 2;
 		}
+		return len + (toklen ? toklen + 1 : 0) + 2;
 	}
+
+	/* One of the expected tokens */
+	if (!yyres) {
+		return yystrlen(yystr) - (*yystr == '"' ? 2 : 0);
+	}
+
 	if (*yystr == '"') {
 		YYSIZE_T yyn = 0;
 		const char *yyp = yystr;

Zend/zend_object_handlers.c

@@ -275,10 +275,10 @@ static zend_always_inline int zend_verify_property_access(zend_property_info *pr
 		return 1;
 	} else if (property_info->flags & ZEND_ACC_PRIVATE) {
 		return (ce == EG(scope) || property_info->ce == EG(scope));
-	} else {
-		ZEND_ASSERT(property_info->flags & ZEND_ACC_PROTECTED);
+	} else if (property_info->flags & ZEND_ACC_PROTECTED) {
 		return zend_check_protected(property_info->ce, EG(scope));
 	}
+	return 0;
 }
 /* }}} */
 

Zend/zend_operators.c

@@ -2277,7 +2277,7 @@ try_again:
 				zval *val;
 
 				val = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);
-				Z_ADDREF_P(val);
+				Z_TRY_ADDREF_P(val);
 				increment_function(val);
 				Z_OBJ_HANDLER_P(op1, set)(op1, val);
 				zval_ptr_dtor(val);
@@ -2345,7 +2345,7 @@ try_again:
 				zval *val;
 
 				val = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);
-				Z_ADDREF_P(val);
+				Z_TRY_ADDREF_P(val);
 				decrement_function(val);
 				Z_OBJ_HANDLER_P(op1, set)(op1, val);
 				zval_ptr_dtor(val);

Zend/zend_operators.h

@@ -757,7 +757,7 @@ static zend_always_inline int fast_is_not_identical_function(zval *op1, zval *op
 		int ret;                                                                                           \
 		zval rv;                                                                                           \
 		zval *objval = Z_OBJ_HANDLER_P(op1, get)(op1, &rv);                                      \
-		Z_ADDREF_P(objval);                                                                                \
+		Z_TRY_ADDREF_P(objval);                                                                                \
 		ret = binary_op(objval, objval, op2);                                                    \
 		Z_OBJ_HANDLER_P(op1, set)(op1, objval);                                                  \
 		zval_ptr_dtor(objval);                                                                             \

Zend/zend_vm_def.h

@@ -328,12 +328,9 @@ ZEND_VM_HANDLER(15, ZEND_IS_IDENTICAL, CONST|TMP|VAR|CV, CONST|TMP|VAR|CV)
 	result = fast_is_identical_function(op1, op2);
 	FREE_OP1();
 	FREE_OP2();
-	ZEND_VM_SMART_BRANCH(result, (OP1_TYPE|OP2_TYPE) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((OP1_TYPE|OP2_TYPE) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 ZEND_VM_HANDLER(16, ZEND_IS_NOT_IDENTICAL, CONST|TMP|VAR|CV, CONST|TMP|VAR|CV)
@@ -349,12 +346,9 @@ ZEND_VM_HANDLER(16, ZEND_IS_NOT_IDENTICAL, CONST|TMP|VAR|CV, CONST|TMP|VAR|CV)
 	result = fast_is_not_identical_function(op1, op2);
 	FREE_OP1();
 	FREE_OP2();
-	ZEND_VM_SMART_BRANCH(result, (OP1_TYPE|OP2_TYPE) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((OP1_TYPE|OP2_TYPE) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 ZEND_VM_HANDLER(17, ZEND_IS_EQUAL, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
@@ -4714,9 +4708,8 @@ ZEND_VM_HANDLER(63, ZEND_RECV, ANY, ANY)
 
 	if (UNEXPECTED(arg_num > EX_NUM_ARGS())) {
 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_missing_arg(execute_data, arg_num, CACHE_ADDR(opline->op2.num)))) {
-			HANDLE_EXCEPTION();
-		}
+		zend_verify_missing_arg(execute_data, arg_num, CACHE_ADDR(opline->op2.num));
+		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
 		zval *param = _get_zval_ptr_cv_undef_BP_VAR_W(execute_data, opline->result.var);
 
@@ -5520,8 +5513,14 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMPVAR|CV, UNUSED|CONST|VAR)
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -7125,11 +7124,12 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		}
 	}
 
-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);
 
 	if (finally_op_num && (!catch_op_num || catch_op_num >= finally_op_num)) {
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
 
+		cleanup_live_vars(execute_data, op_num, finally_op_num);
 		if (in_finally && Z_OBJ_P(fast_call)) {
 			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
 		}
@@ -7139,6 +7139,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[finally_op_num]);
 		ZEND_VM_CONTINUE();
 	} else {
+		cleanup_live_vars(execute_data, op_num, catch_op_num);
 		if (in_finally) {
 			/* we are going out of current finally scope */
 			zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
@@ -7177,14 +7178,10 @@ ZEND_VM_HANDLER(150, ZEND_USER_OPCODE, ANY, ANY)
 
 	SAVE_OPLINE();
 	ret = zend_user_opcode_handlers[opline->opcode](execute_data);
-
-	if (EG(exception)) {
-		HANDLE_EXCEPTION();
-	}
+	opline = EX(opline);
 
 	switch (ret) {
 		case ZEND_USER_OPCODE_CONTINUE:
-			LOAD_OPLINE();
 			ZEND_VM_CONTINUE();
 		case ZEND_USER_OPCODE_RETURN:
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
@@ -7197,13 +7194,10 @@ ZEND_VM_HANDLER(150, ZEND_USER_OPCODE, ANY, ANY)
 		case ZEND_USER_OPCODE_ENTER:
 			ZEND_VM_ENTER();
 		case ZEND_USER_OPCODE_LEAVE:
-			LOAD_OPLINE();
 			ZEND_VM_LEAVE();
 		case ZEND_USER_OPCODE_DISPATCH:
-			ZEND_ASSERT(EX(opline) == opline);
 			ZEND_VM_DISPATCH(opline->opcode, opline);
 		default:
-			ZEND_ASSERT(EX(opline) == opline);
 			ZEND_VM_DISPATCH((zend_uchar)(ret & 0xff), opline);
 	}
 }
@@ -7565,20 +7559,25 @@ ZEND_VM_HANDLER(163, ZEND_FAST_RET, ANY, ANY)
 		USE_OPLINE
 
 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
+			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 			ZEND_VM_CONTINUE();
 		} else {
 			EG(exception) = Z_OBJ_P(fast_call);
 			Z_OBJ_P(fast_call) = NULL;
 			if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 				ZEND_VM_CONTINUE();
-			} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
-				zend_generator *generator = zend_get_running_generator(execute_data);
-				zend_generator_close(generator, 1);
-				ZEND_VM_RETURN();
 			} else {
-				ZEND_VM_DISPATCH_TO_HELPER(zend_leave_helper);
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, 0);
+				if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
+					zend_generator *generator = zend_get_running_generator(execute_data);
+					zend_generator_close(generator, 1);
+					ZEND_VM_RETURN();
+				} else {
+					ZEND_VM_DISPATCH_TO_HELPER(zend_leave_helper);
+				}
 			}
 		}
 	}

Zend/zend_vm_execute.h

@@ -1204,9 +1204,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_
 
 	if (UNEXPECTED(arg_num > EX_NUM_ARGS())) {
 		SAVE_OPLINE();
-		if (UNEXPECTED(!zend_verify_missing_arg(execute_data, arg_num, CACHE_ADDR(opline->op2.num)))) {
-			HANDLE_EXCEPTION();
-		}
+		zend_verify_missing_arg(execute_data, arg_num, CACHE_ADDR(opline->op2.num));
+		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
 		zval *param = _get_zval_ptr_cv_undef_BP_VAR_W(execute_data, opline->result.var);
 
@@ -1515,11 +1514,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		}
 	}
 
-	i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
+	cleanup_unfinished_calls(execute_data, op_num);
 
 	if (finally_op_num && (!catch_op_num || catch_op_num >= finally_op_num)) {
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
 
+		cleanup_live_vars(execute_data, op_num, finally_op_num);
 		if (in_finally && Z_OBJ_P(fast_call)) {
 			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
 		}
@@ -1529,6 +1529,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[finally_op_num]);
 		ZEND_VM_CONTINUE();
 	} else {
+		cleanup_live_vars(execute_data, op_num, catch_op_num);
 		if (in_finally) {
 			/* we are going out of current finally scope */
 			zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
@@ -1567,14 +1568,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_
 
 	SAVE_OPLINE();
 	ret = zend_user_opcode_handlers[opline->opcode](execute_data);
-
-	if (EG(exception)) {
-		HANDLE_EXCEPTION();
-	}
+	opline = EX(opline);
 
 	switch (ret) {
 		case ZEND_USER_OPCODE_CONTINUE:
-			LOAD_OPLINE();
 			ZEND_VM_CONTINUE();
 		case ZEND_USER_OPCODE_RETURN:
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
@@ -1587,13 +1584,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_
 		case ZEND_USER_OPCODE_ENTER:
 			ZEND_VM_ENTER();
 		case ZEND_USER_OPCODE_LEAVE:
-			LOAD_OPLINE();
 			ZEND_VM_LEAVE();
 		case ZEND_USER_OPCODE_DISPATCH:
-			ZEND_ASSERT(EX(opline) == opline);
 			ZEND_VM_DISPATCH(opline->opcode, opline);
 		default:
-			ZEND_ASSERT(EX(opline) == opline);
 			ZEND_VM_DISPATCH((zend_uchar)(ret & 0xff), opline);
 	}
 }
@@ -1647,20 +1641,25 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPC
 		USE_OPLINE
 
 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
+			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 			ZEND_VM_CONTINUE();
 		} else {
 			EG(exception) = Z_OBJ_P(fast_call);
 			Z_OBJ_P(fast_call) = NULL;
 			if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
 				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
 				ZEND_VM_CONTINUE();
-			} else if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
-				zend_generator *generator = zend_get_running_generator(execute_data);
-				zend_generator_close(generator, 1);
-				ZEND_VM_RETURN();
 			} else {
-				ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, 0);
+				if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_GENERATOR) != 0)) {
+					zend_generator *generator = zend_get_running_generator(execute_data);
+					zend_generator_close(generator, 1);
+					ZEND_VM_RETURN();
+				} else {
+					ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+				}
 			}
 		}
 	}
@@ -4596,12 +4595,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CONST_CONST_
 	result = fast_is_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -4617,12 +4613,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CO
 	result = fast_is_not_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -6119,8 +6112,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_CONST_HAN
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -6646,12 +6645,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HA
 	result = fast_is_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -6667,12 +6663,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TM
 	result = fast_is_not_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -6829,12 +6822,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HA
 	result = fast_is_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -6850,12 +6840,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VA
 	result = fast_is_not_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type ZEND_OPCODE_HANDLER_ARGS_DC)
@@ -7060,8 +7047,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDL
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -7920,8 +7913,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HA
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -8540,12 +8539,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CONST_CV_HAN
 	result = fast_is_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -8561,12 +8557,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV
 	result = fast_is_not_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CONST|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CONST|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -12573,12 +12566,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HA
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -12594,12 +12584,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONS
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13128,12 +13115,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HAND
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13149,12 +13133,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13311,12 +13292,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HAND
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13332,12 +13310,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13864,12 +13839,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDL
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -13885,12 +13857,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_H
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_TMP_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_TMP_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -16414,12 +16383,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HA
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -16435,12 +16401,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONS
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(binary_op_type binary_op ZEND_OPCODE_HANDLER_ARGS_DC)
@@ -18156,12 +18119,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HAND
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -18177,12 +18137,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -18368,12 +18325,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HAND
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -18389,12 +18343,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -19622,12 +19573,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDL
 	result = fast_is_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -19643,12 +19591,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_H
 	result = fast_is_not_identical_function(op1, op2);
 	zval_ptr_dtor_nogc(free_op1);
 
-	ZEND_VM_SMART_BRANCH(result, (IS_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_VAR|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(binary_op_type binary_op ZEND_OPCODE_HANDLER_ARGS_DC)
@@ -30100,12 +30045,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CV_CONST_HAN
 	result = fast_is_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -30121,12 +30063,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST
 	result = fast_is_not_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_CONST) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_CONST) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -32214,8 +32153,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLE
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -32981,12 +32926,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDL
 	result = fast_is_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -33002,12 +32944,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_H
 	result = fast_is_not_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_TMP_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -33192,12 +33131,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDL
 	result = fast_is_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -33213,12 +33149,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_H
 	result = fast_is_not_identical_function(op1, op2);
 
 	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_VAR) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type ZEND_OPCODE_HANDLER_ARGS_DC)
@@ -33510,8 +33443,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -34740,8 +34679,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDL
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -35338,12 +35283,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLE
 	result = fast_is_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -35359,12 +35301,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HA
 	result = fast_is_not_identical_function(op1, op2);
 
 
-	ZEND_VM_SMART_BRANCH(result, (IS_CV|IS_CV) & (IS_VAR|IS_TMP_VAR));
+	ZEND_VM_SMART_BRANCH(result, 1);
 	ZVAL_BOOL(EX_VAR(opline->result.var), result);
-	if ((IS_CV|IS_CV) & (IS_VAR|IS_TMP_VAR)) {
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
-	}
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -41951,8 +41890,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_CONST_HA
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -42536,8 +42481,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_VAR_HAND
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);
@@ -42938,8 +42889,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_UNUSED_H
 				ZVAL_UNDEF(var);
 				zval_dtor_func_for_ptr(garbage);
 			} else {
-				GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
-				ZVAL_UNDEF(var);
+				zval *z = var;
+				ZVAL_DEREF(z);
+				if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+					ZVAL_UNDEF(var);
+					gc_possible_root(Z_COUNTED_P(z));
+				} else {
+					ZVAL_UNDEF(var);
+				}
 			}
 		} else {
 			ZVAL_UNDEF(var);

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/gd/gd_compat.c

@@ -1,4 +1,8 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#else
 #include "php_config.h"
+#endif
 
 #ifdef HAVE_GD_PNG
 /* needs to be first */

ext/mbstring/mb_gpc.c

@@ -377,8 +377,10 @@ SAPI_POST_HANDLER_FUNC(php_mb_post_handler)
 
 	php_stream_rewind(SG(request_info).request_body);
 	post_data_str = php_stream_copy_to_mem(SG(request_info).request_body, PHP_STREAM_COPY_ALL, 0);
-	detected = _php_mb_encoding_handler_ex(&info, arg, ZSTR_VAL(post_data_str));
-	zend_string_release(post_data_str);
+	detected = _php_mb_encoding_handler_ex(&info, arg, post_data_str ? ZSTR_VAL(post_data_str) : NULL);
+	if (post_data_str) {
+		zend_string_release(post_data_str);
+	}
 
 	MBSTRG(http_input_identify) = detected;
 	if (detected) {

ext/mysqli/tests/bug70949.phpt

@@ -0,0 +1,62 @@
+--TEST--
+Bug #70949 (SQL Result Sets With NULL Can Cause Fatal Memory Errors)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+	die("skip mysqlnd only test");
+}
+?>
+--FILE--
+<?php
+require_once("connect.inc");
+$mysql = new my_mysqli($host, $user, $passwd, $db, $port, $socket);
+
+$mysql->query("DROP TABLE IF EXISTS bug70949");
+$mysql->query("CREATE TABLE bug70949(name varchar(255))");
+$mysql->query("INSERT INTO bug70949 VALUES ('dummy'),(NULL),('foo'),('bar')");
+
+$sql = "select * from bug70949";
+
+if ($stmt = $mysql->prepare($sql))
+{	
+	$stmt->attr_set(MYSQLI_STMT_ATTR_CURSOR_TYPE, MYSQLI_CURSOR_TYPE_READ_ONLY);
+
+	if ($stmt->bind_result($name)) {
+		{
+			if ($stmt->execute())
+			{
+				while ($stmt->fetch())
+				{	
+					var_dump($name);
+				}
+			}
+		}
+
+		$stmt->free_result();
+		$stmt->close();
+	}
+
+
+	$mysql->close();
+}
+
+?>
+--CLEAN--
+<?php
+require_once("connect.inc");
+if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+   printf("[c001] [%d] %s\n", mysqli_connect_errno(), mysqli_connect_error());
+
+if (!mysqli_query($link, "DROP TABLE IF EXISTS bug70949"))
+	printf("[c002] Cannot drop table, [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+
+mysqli_close($link);
+?>
+--EXPECT--
+string(5) "dummy"
+NULL
+string(3) "foo"
+string(3) "bar"

ext/mysqlnd/mysqlnd_ps.c

@@ -1115,6 +1115,8 @@ mysqlnd_fetch_stmt_row_cursor(MYSQLND_RES * result, void * param, unsigned int f
 						ZVAL_COPY_VALUE(result, data);
 						/* copied data, thus also the ownership. Thus null data */
 						ZVAL_NULL(data);
+					} else {
+						ZVAL_NULL(result);
 					}
 				}
 			}

ext/oci8/oci8.c

@@ -1452,7 +1452,7 @@ static void php_oci_pconnection_list_np_dtor(zend_resource *entry)
 		/* Remove the hash entry if present */
 		if (connection->hash_key) {
 			zvp = zend_hash_find(&EG(persistent_list), connection->hash_key);
-			le = zvp ? Z_RES_P(zvp) : NULL;		/* PHPNG TODO check for null zvp */
+			le = zvp ? Z_RES_P(zvp) : NULL;
 			if (le != NULL && le->type == le_pconnection && le->ptr == connection) {
 				zend_hash_del(&EG(persistent_list), connection->hash_key);
 			}
@@ -1927,13 +1927,11 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 	}
 
 	/* make it lowercase */
-	/* PHPNG TODO is this safe to do? What about interned strings? */
-	php_strtolower(hashed_details.s->val, hashed_details.s->len);
+	php_strtolower(ZSTR_VAL(hashed_details.s), ZSTR_LEN(hashed_details.s));
 
 	if (!exclusive && !new_password) {
 		zend_bool found = 0;
 
-		/* PHPNG TODO Check hashed_details is used correctly */
 		if (persistent && ((zvp = zend_hash_find(&EG(persistent_list), hashed_details.s))) != NULL) {
 			zend_resource *le = Z_RES_P(zvp);
 
@@ -1948,7 +1946,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 			if (le->type == le_index_ptr) {
 				zend_resource *ptr;
 
-				ptr = (zend_resource *) le->ptr; /* PHPNG TODO */
+				ptr = (zend_resource *) le->ptr;
 				if (ptr && (ptr->type == le_connection)) {
 					connection = (php_oci_connection *)ptr->ptr;
 				}
@@ -2005,17 +2003,19 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 
 							/* okay, the connection is open and the server is still alive */
 							connection->used_this_request = 1;
-							tmp_val = zend_hash_index_find(&EG(regular_list), connection->id->handle);
-							if ((tmp_val != NULL) && (Z_TYPE_P(tmp_val) == IS_RESOURCE)) {
-								tmp = Z_RES_VAL_P(tmp_val);
-							}
+							if (connection->id) {
+								tmp_val = zend_hash_index_find(&EG(regular_list), connection->id->handle);
+								if ((tmp_val != NULL) && (Z_TYPE_P(tmp_val) == IS_RESOURCE)) {
+									tmp = Z_RES_VAL_P(tmp_val);
+								}
 							
-							if ((tmp_val != NULL) && (tmp != NULL) &&
-								(tmp->hash_key->len == hashed_details.s->len) &&
-								(memcmp(tmp->hash_key->val, hashed_details.s->val, tmp->hash_key->len) == 0)) {
-								connection = tmp;
-								++GC_REFCOUNT(connection->id);
-								/* do nothing */
+								if ((tmp_val != NULL) && (tmp != NULL) &&
+									(ZSTR_LEN(tmp->hash_key) == ZSTR_LEN(hashed_details.s)) &&
+									(memcmp(ZSTR_VAL(tmp->hash_key), ZSTR_VAL(hashed_details.s),
+									 ZSTR_LEN(tmp->hash_key)) == 0)) {
+									connection = tmp;
+									++GC_REFCOUNT(connection->id);
+								}
 							} else {
 								PHP_OCI_REGISTER_RESOURCE(connection, le_pconnection);
 								/* Persistent connections: For old close semantics we artificially
@@ -2469,6 +2469,7 @@ int php_oci_connection_release(php_oci_connection *connection)
 		connection->svc = NULL;
 		connection->server = NULL;
 		connection->session = NULL;
+		connection->id = NULL;
 
 		connection->is_attached = connection->is_open = connection->rb_on_disconnect = connection->used_this_request = 0;
 		connection->is_stub = 1;
@@ -2866,7 +2867,7 @@ static php_oci_spool *php_oci_create_spool(char *username, int username_len, cha
 	}
 
 	/* Populate key if passed */
-	if (hash_key && hash_key->val) {
+	if (hash_key && (ZSTR_LEN(hash_key) > 0)) {
 		session_pool->spool_hash_key = zend_string_dup(hash_key, 1);
 		if (session_pool->spool_hash_key == NULL) {
 			iserror = 1;
@@ -3022,8 +3023,7 @@ static php_oci_spool *php_oci_get_spool(char *username, int username_len, char *
 	/* Session Pool Hash Key : oci8spool***username**edition**hashedpassword**dbname**charset */
 
 	smart_str_0(&spool_hashed_details);
-	/* PHPNG TODO is this safe to do? */
-	php_strtolower(spool_hashed_details.s->val, spool_hashed_details.s->len);
+	php_strtolower(ZSTR_VAL(spool_hashed_details.s), ZSTR_LEN(spool_hashed_details.s));
 	/* }}} */
 
 	spool_out_zv = zend_hash_find(&EG(persistent_list), spool_hashed_details.s);
@@ -3044,8 +3044,8 @@ static php_oci_spool *php_oci_get_spool(char *username, int username_len, char *
 		PHP_OCI_REGISTER_RESOURCE(session_pool, le_psessionpool);
 		zend_hash_update_mem(&EG(persistent_list), session_pool->spool_hash_key, (void *)&spool_le, sizeof(zend_resource));
 	} else if (spool_out_le->type == le_psessionpool &&
-		((php_oci_spool *)(spool_out_le->ptr))->spool_hash_key->len == spool_hashed_details.s->len &&
-		memcmp(((php_oci_spool *)(spool_out_le->ptr))->spool_hash_key->val, spool_hashed_details.s->val, spool_hashed_details.s->len) == 0) {
+		ZSTR_LEN(((php_oci_spool *)(spool_out_le->ptr))->spool_hash_key) == ZSTR_LEN(spool_hashed_details.s) &&
+		memcmp(ZSTR_VAL(((php_oci_spool *)(spool_out_le->ptr))->spool_hash_key), ZSTR_VAL(spool_hashed_details.s), ZSTR_LEN(spool_hashed_details.s)) == 0) {
 		/* retrieve the cached session pool */
 		session_pool = (php_oci_spool *)(spool_out_le->ptr);
 	}

ext/oci8/oci8_lob.c

@@ -109,7 +109,7 @@ php_oci_descriptor *php_oci_lob_create (php_oci_connection *connection, zend_lon
 			return NULL;
 		}
 
-		zend_hash_index_update_ptr(connection->descriptors, descriptor->index, &descriptor);
+		zend_hash_index_update_ptr(connection->descriptors, descriptor->index, descriptor);
 	}
 	return descriptor;
 
@@ -666,11 +666,11 @@ void php_oci_lob_free (php_oci_descriptor *descriptor)
 	}
 
 	if (descriptor->connection->descriptors) {
-		/* delete descriptor from the hash */
-		zend_hash_index_del(descriptor->connection->descriptors, descriptor->index);
 		if (zend_hash_num_elements(descriptor->connection->descriptors) == 0) {
 			descriptor->connection->descriptor_count = 0;
 		} else {
+            /* delete descriptor from the hash */
+            zend_hash_index_del(descriptor->connection->descriptors, descriptor->index);
 			if (descriptor->index + 1 == descriptor->connection->descriptor_count) {
 				/* If the descriptor being freed is the end-most one
 				 * allocated, then the descriptor_count is reduced so

ext/oci8/oci8_statement.c

@@ -1149,8 +1149,13 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 				return 1;
 			}
 			convert_to_long(var);
+#if defined(OCI_MAJOR_VERSION) && OCI_MAJOR_VERSION > 10
+			bind_data = (ub8 *)&Z_LVAL_P(var);
+			value_sz = sizeof(ub8);
+#else
 			bind_data = (ub4 *)&Z_LVAL_P(var);
 			value_sz = sizeof(ub4);
+#endif
 			mode = OCI_DEFAULT;
 			break;
 			

ext/oci8/tests/bug68298.phpt

@@ -0,0 +1,51 @@
+--TEST--
+Bug #68298 (OCI int overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only");
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+$stmtarray = array(
+	"DROP TABLE BUG68298", 
+	"CREATE TABLE BUG68298 (COL1 NUMBER(20))"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$s = oci_parse($c, "INSERT INTO BUG68298 VALUES (:INTVALUE)");
+$intvalue = 1152921504606846975;
+oci_bind_by_name($s, ":INTVALUE", $intvalue, -1, SQLT_INT);
+oci_execute($s);
+
+$s = oci_parse($c, "INSERT INTO BUG68298 VALUES (:INTVALUE)");
+$intvalue = -1152921504606846975;
+oci_bind_by_name($s, ":INTVALUE", $intvalue, -1, SQLT_INT);
+oci_execute($s);
+
+
+$s = oci_parse($c, "SELECT COL1 FROM BUG68298");
+oci_execute($s);
+oci_fetch_all($s, $r);
+var_dump($r);
+
+$stmtarray = array("DROP TABLE BUG68298");
+oci8_test_sql_execute($c, $stmtarray);
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(1) {
+  ["COL1"]=>
+  array(2) {
+    [0]=>
+    string(19) "1152921504606846975"
+    [1]=>
+    string(20) "-1152921504606846975"
+  }
+}
+===DONE===

ext/opcache/Optimizer/block_pass.c

@@ -643,13 +643,15 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			(opline->opcode != ZEND_FE_RESET_R || opline->opcode != ZEND_FE_RESET_RW) &&
 			opline->opcode != ZEND_FREE
 			) {
-			zend_op *src = VAR_SOURCE(opline->op1);
+			znode_op op1 = opline->op1;
+			zend_op *src = VAR_SOURCE(op1);
 			zval c = ZEND_OP1_LITERAL(src);
-			VAR_UNSET(opline->op1);
 			zval_copy_ctor(&c);
-			zend_optimizer_update_op1_const(op_array, opline, &c);
-			literal_dtor(&ZEND_OP1_LITERAL(src));
-			MAKE_NOP(src);
+			if (zend_optimizer_update_op1_const(op_array, opline, &c)) {
+				VAR_SOURCE(op1) = NULL;
+				literal_dtor(&ZEND_OP1_LITERAL(src));
+				MAKE_NOP(src);
+			}
 		}
 
 		/* T = QM_ASSIGN(C), F(T) => NOP, F(C) */
@@ -657,13 +659,15 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			VAR_SOURCE(opline->op2) &&
 			VAR_SOURCE(opline->op2)->opcode == ZEND_QM_ASSIGN &&
 			ZEND_OP1_TYPE(VAR_SOURCE(opline->op2)) == IS_CONST) {
-			zend_op *src = VAR_SOURCE(opline->op2);
+			znode_op op2 = opline->op2;
+			zend_op *src = VAR_SOURCE(op2);
 			zval c = ZEND_OP1_LITERAL(src);
-			VAR_UNSET(opline->op2);
 			zval_copy_ctor(&c);
-			zend_optimizer_update_op2_const(op_array, opline, &c);
-			literal_dtor(&ZEND_OP1_LITERAL(src));
-			MAKE_NOP(src);
+			if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
+				VAR_SOURCE(op2) = NULL;
+				literal_dtor(&ZEND_OP1_LITERAL(src));
+				MAKE_NOP(src);
+			}
 		}
 
 		/* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */

ext/opcache/Optimizer/zend_optimizer.c

@@ -110,6 +110,13 @@ int zend_optimizer_add_literal(zend_op_array *op_array, zval *zv)
 	return i;
 }
 
+static inline int zend_optimizer_add_literal_string(zend_op_array *op_array, zend_string *str) {
+	zval zv;
+	ZVAL_STR(&zv, str);
+	zend_string_hash_val(str);
+	return zend_optimizer_add_literal(op_array, &zv);
+}
+
 int zend_optimizer_is_disabled_func(const char *name, size_t len) {
 	zend_function *fbc = (zend_function *)zend_hash_str_find_ptr(EG(function_table), name, len);
 
@@ -117,181 +124,226 @@ int zend_optimizer_is_disabled_func(const char *name, size_t len) {
 			fbc->internal_function.handler == ZEND_FN(display_disabled_function));
 }
 
-void zend_optimizer_update_op1_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val)
-{
-	if (opline->opcode == ZEND_FREE) {
-		MAKE_NOP(opline);
+static inline void drop_leading_backslash(zval *val) {
+	if (Z_STRVAL_P(val)[0] == '\\') {
+		zend_string *str = zend_string_init(Z_STRVAL_P(val) + 1, Z_STRLEN_P(val) - 1, 0);
 		zval_dtor(val);
-	} else {
-		ZEND_OP1_TYPE(opline) = IS_CONST;
-		if (Z_TYPE_P(val) == IS_STRING) {
-			switch (opline->opcode) {
-				case ZEND_INIT_STATIC_METHOD_CALL:
-				case ZEND_CATCH:
-				case ZEND_FETCH_CONSTANT:
-				case ZEND_DEFINED:
-				case ZEND_NEW:
-					opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
-					Z_CACHE_SLOT(op_array->literals[opline->op1.constant]) = op_array->cache_size;
-					op_array->cache_size += sizeof(void*);
-					zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-					zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(op_array->literals[opline->op1.constant+1]));
-					break;
-				default:
-					opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-					zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
-					break;
-			}
-		} else {
-			if (opline->opcode == ZEND_CONCAT ||
-			    opline->opcode == ZEND_FAST_CONCAT) {
-				convert_to_string(val);
-			}
-			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
-		}
+		ZVAL_STR(val, str);
 	}
 }
 
-void zend_optimizer_update_op2_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val)
-{
-	ZEND_OP2_TYPE(opline) = IS_CONST;
-	if (opline->opcode == ZEND_INIT_FCALL) {
-		zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-		opline->op2.constant = zend_optimizer_add_literal(op_array, val);
-		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
-		Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-		op_array->cache_size += sizeof(void*);
-		return;
-	} else if (opline->opcode == ZEND_ROPE_INIT ||
-			opline->opcode == ZEND_ROPE_ADD ||
-			opline->opcode == ZEND_ROPE_END ||
-			opline->opcode == ZEND_CONCAT ||
-			opline->opcode == ZEND_FAST_CONCAT) {
-		convert_to_string(val);
-	}
-	opline->op2.constant = zend_optimizer_add_literal(op_array, val);
-	if (Z_TYPE_P(val) == IS_STRING) {
-		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
-		switch (opline->opcode) {
-			case ZEND_FETCH_R:
-			case ZEND_FETCH_W:
-			case ZEND_FETCH_RW:
-			case ZEND_FETCH_IS:
-			case ZEND_FETCH_UNSET:
-			case ZEND_FETCH_FUNC_ARG:
-			case ZEND_FETCH_CLASS:
-			case ZEND_INIT_FCALL_BY_NAME:
-			/*case ZEND_INIT_NS_FCALL_BY_NAME:*/
-			case ZEND_UNSET_VAR:
-			case ZEND_ISSET_ISEMPTY_VAR:
-			case ZEND_ADD_INTERFACE:
-			case ZEND_ADD_TRAIT:
-			case ZEND_INSTANCEOF:
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += sizeof(void*);
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				break;
-			case ZEND_INIT_DYNAMIC_CALL:
-				opline->opcode = ZEND_INIT_FCALL_BY_NAME;
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += sizeof(void*);
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				break;
-			case ZEND_INIT_METHOD_CALL:
-			case ZEND_INIT_STATIC_METHOD_CALL:
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
-				zend_optimizer_add_literal(op_array, val);
-				zend_string_hash_val(Z_STR(op_array->literals[opline->op2.constant+1]));
-				/* break missing intentionally */
-			/*case ZEND_FETCH_CONSTANT:*/
-			case ZEND_ASSIGN_OBJ:
-			case ZEND_FETCH_OBJ_R:
-			case ZEND_FETCH_OBJ_W:
-			case ZEND_FETCH_OBJ_RW:
-			case ZEND_FETCH_OBJ_IS:
-			case ZEND_FETCH_OBJ_UNSET:
-			case ZEND_FETCH_OBJ_FUNC_ARG:
-			case ZEND_UNSET_OBJ:
-			case ZEND_PRE_INC_OBJ:
-			case ZEND_PRE_DEC_OBJ:
-			case ZEND_POST_INC_OBJ:
-			case ZEND_POST_DEC_OBJ:
-			case ZEND_ISSET_ISEMPTY_PROP_OBJ:
-				Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-				op_array->cache_size += 2 * sizeof(void*);
-				break;
-			case ZEND_ASSIGN_ADD:
-			case ZEND_ASSIGN_SUB:
-			case ZEND_ASSIGN_MUL:
-			case ZEND_ASSIGN_DIV:
-			case ZEND_ASSIGN_POW:
-			case ZEND_ASSIGN_MOD:
-			case ZEND_ASSIGN_SL:
-			case ZEND_ASSIGN_SR:
-			case ZEND_ASSIGN_CONCAT:
-			case ZEND_ASSIGN_BW_OR:
-			case ZEND_ASSIGN_BW_AND:
-			case ZEND_ASSIGN_BW_XOR:
-				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
-					Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
-					op_array->cache_size += 2 * sizeof(void*);
-				}
-				break;
-			case ZEND_OP_DATA:
-				if ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
-				    ((opline-1)->extended_value == ZEND_ASSIGN_DIM &&
-				     ((opline-1)->opcode == ZEND_ASSIGN_ADD ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SUB ||
-				     (opline-1)->opcode == ZEND_ASSIGN_MUL ||
-				     (opline-1)->opcode == ZEND_ASSIGN_DIV ||
-				     (opline-1)->opcode == ZEND_ASSIGN_POW ||
-				     (opline-1)->opcode == ZEND_ASSIGN_MOD ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SL ||
-				     (opline-1)->opcode == ZEND_ASSIGN_SR ||
-				     (opline-1)->opcode == ZEND_ASSIGN_CONCAT ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_OR ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_AND ||
-				     (opline-1)->opcode == ZEND_ASSIGN_BW_XOR))) {
-					goto check_numeric;
-				}
-				break;
-			case ZEND_ISSET_ISEMPTY_DIM_OBJ:
-			case ZEND_ADD_ARRAY_ELEMENT:
-			case ZEND_INIT_ARRAY:
-			case ZEND_ASSIGN_DIM:
-			case ZEND_UNSET_DIM:
-			case ZEND_FETCH_DIM_R:
-			case ZEND_FETCH_DIM_W:
-			case ZEND_FETCH_DIM_RW:
-			case ZEND_FETCH_DIM_IS:
-			case ZEND_FETCH_DIM_FUNC_ARG:
-			case ZEND_FETCH_DIM_UNSET:
-			case ZEND_FETCH_LIST:
-check_numeric:
-				{
-					zend_ulong index;
+static inline void alloc_cache_slots_op2(zend_op_array *op_array, zend_op *opline, uint32_t num) {
+	Z_CACHE_SLOT(op_array->literals[opline->op2.constant]) = op_array->cache_size;
+	op_array->cache_size += num * sizeof(void *);
+}
 
-					if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
-						zval_dtor(val);
-						ZVAL_LONG(val, index);
-						op_array->literals[opline->op2.constant] = *val;
-		        	}
-				}
-				break;
-			default:
-				break;
-		}
+#define REQUIRES_STRING(val) do { \
+	if (Z_TYPE_P(val) != IS_STRING) { \
+		zval_dtor(val); \
+		return 0; \
+	} \
+} while (0)
+
+#define TO_STRING_NOWARN(val) do { \
+	if (Z_TYPE_P(val) >= IS_ARRAY) { \
+		zval_dtor(val); \
+		return 0; \
+	} \
+	convert_to_string(val); \
+} while (0)
+
+int zend_optimizer_update_op1_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val)
+{
+	switch (opline->opcode) {
+		case ZEND_FREE:
+			MAKE_NOP(opline);
+			zval_dtor(val);
+			break;
+		case ZEND_INIT_STATIC_METHOD_CALL:
+		case ZEND_CATCH:
+		case ZEND_FETCH_CONSTANT:
+		case ZEND_DEFINED:
+		case ZEND_NEW:
+			REQUIRES_STRING(val);
+			ZEND_OP1_TYPE(opline) = IS_CONST;
+			drop_leading_backslash(val);
+			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
+			zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
+			Z_CACHE_SLOT(op_array->literals[opline->op1.constant]) = op_array->cache_size;
+			op_array->cache_size += sizeof(void*);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			break;
+		case ZEND_CONCAT:
+		case ZEND_FAST_CONCAT:
+			TO_STRING_NOWARN(val);
+			/* break missing intentionally */
+		default:
+			ZEND_OP1_TYPE(opline) = IS_CONST;
+			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
+			if (Z_TYPE_P(val) == IS_STRING) {
+				zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
+			}
+			break;
 	}
+
+	return 1;
+}
+
+int zend_optimizer_update_op2_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val)
+{
+	switch (opline->opcode) {
+		case ZEND_ASSIGN_REF:
+			zval_dtor(val);
+			return 0;
+		case ZEND_FETCH_R:
+		case ZEND_FETCH_W:
+		case ZEND_FETCH_RW:
+		case ZEND_FETCH_IS:
+		case ZEND_FETCH_UNSET:
+		case ZEND_FETCH_FUNC_ARG:
+		case ZEND_FETCH_CLASS:
+		case ZEND_INIT_FCALL_BY_NAME:
+		/*case ZEND_INIT_NS_FCALL_BY_NAME:*/
+		case ZEND_UNSET_VAR:
+		case ZEND_ISSET_ISEMPTY_VAR:
+		case ZEND_ADD_INTERFACE:
+		case ZEND_ADD_TRAIT:
+		case ZEND_INSTANCEOF:
+			REQUIRES_STRING(val);
+			drop_leading_backslash(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			alloc_cache_slots_op2(op_array, opline, 1);
+			break;
+		case ZEND_INIT_FCALL:
+			REQUIRES_STRING(val);
+			zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			alloc_cache_slots_op2(op_array, opline, 1);
+			break;
+		case ZEND_INIT_DYNAMIC_CALL:
+			if (Z_TYPE_P(val) == IS_STRING) {
+				if (zend_memrchr(Z_STRVAL_P(val), ':', Z_STRLEN_P(val))) {
+					zval_dtor(val);
+					return 0;
+				}
+
+				opline->opcode = ZEND_INIT_FCALL_BY_NAME;
+				drop_leading_backslash(val);
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+				alloc_cache_slots_op2(op_array, opline, 1);
+			} else {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			}
+			break;
+		case ZEND_INIT_METHOD_CALL:
+		case ZEND_INIT_STATIC_METHOD_CALL:
+			REQUIRES_STRING(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			alloc_cache_slots_op2(op_array, opline, 2);
+			break;
+		/*case ZEND_FETCH_CONSTANT:*/
+		case ZEND_ASSIGN_OBJ:
+		case ZEND_FETCH_OBJ_R:
+		case ZEND_FETCH_OBJ_W:
+		case ZEND_FETCH_OBJ_RW:
+		case ZEND_FETCH_OBJ_IS:
+		case ZEND_FETCH_OBJ_UNSET:
+		case ZEND_FETCH_OBJ_FUNC_ARG:
+		case ZEND_UNSET_OBJ:
+		case ZEND_PRE_INC_OBJ:
+		case ZEND_PRE_DEC_OBJ:
+		case ZEND_POST_INC_OBJ:
+		case ZEND_POST_DEC_OBJ:
+		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+			TO_STRING_NOWARN(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			alloc_cache_slots_op2(op_array, opline, 2);
+			break;
+		case ZEND_ASSIGN_ADD:
+		case ZEND_ASSIGN_SUB:
+		case ZEND_ASSIGN_MUL:
+		case ZEND_ASSIGN_DIV:
+		case ZEND_ASSIGN_POW:
+		case ZEND_ASSIGN_MOD:
+		case ZEND_ASSIGN_SL:
+		case ZEND_ASSIGN_SR:
+		case ZEND_ASSIGN_CONCAT:
+		case ZEND_ASSIGN_BW_OR:
+		case ZEND_ASSIGN_BW_AND:
+		case ZEND_ASSIGN_BW_XOR:
+			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
+				TO_STRING_NOWARN(val);
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				alloc_cache_slots_op2(op_array, opline, 2);
+			} else {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			}
+			break;
+		case ZEND_OP_DATA:
+			if ((opline-1)->opcode != ZEND_ASSIGN_DIM &&
+				((opline-1)->extended_value != ZEND_ASSIGN_DIM ||
+				 ((opline-1)->opcode != ZEND_ASSIGN_ADD &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SUB &&
+				 (opline-1)->opcode != ZEND_ASSIGN_MUL &&
+				 (opline-1)->opcode != ZEND_ASSIGN_DIV &&
+				 (opline-1)->opcode != ZEND_ASSIGN_POW &&
+				 (opline-1)->opcode != ZEND_ASSIGN_MOD &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SL &&
+				 (opline-1)->opcode != ZEND_ASSIGN_SR &&
+				 (opline-1)->opcode != ZEND_ASSIGN_CONCAT &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_OR &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_AND &&
+				 (opline-1)->opcode != ZEND_ASSIGN_BW_XOR))
+			) {
+				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+				break;
+			}
+			/* break missing intentionally */
+		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
+		case ZEND_ADD_ARRAY_ELEMENT:
+		case ZEND_INIT_ARRAY:
+		case ZEND_ASSIGN_DIM:
+		case ZEND_UNSET_DIM:
+		case ZEND_FETCH_DIM_R:
+		case ZEND_FETCH_DIM_W:
+		case ZEND_FETCH_DIM_RW:
+		case ZEND_FETCH_DIM_IS:
+		case ZEND_FETCH_DIM_FUNC_ARG:
+		case ZEND_FETCH_DIM_UNSET:
+		case ZEND_FETCH_LIST:
+			if (Z_TYPE_P(val) == IS_STRING) {
+				zend_ulong index;
+				if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
+					zval_dtor(val);
+					ZVAL_LONG(val, index);
+				}
+			}
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			break;
+		case ZEND_ROPE_INIT:
+		case ZEND_ROPE_ADD:
+		case ZEND_ROPE_END:
+		case ZEND_CONCAT:
+		case ZEND_FAST_CONCAT:
+			TO_STRING_NOWARN(val);
+			/* break missing intentionally */
+		default:
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			break;
+	}
+
+	ZEND_OP2_TYPE(opline) = IS_CONST;
+	if (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING) {
+		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
+	}
+	return 1;
 }
 
 int zend_optimizer_replace_by_const(zend_op_array *op_array,
@@ -312,6 +364,8 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 				case ZEND_FETCH_DIM_UNSET:
 				case ZEND_ASSIGN_DIM:
 				case ZEND_SEPARATE:
+				case ZEND_RETURN_BY_REF:
+					zval_dtor(val);
 					return 0;
 				case ZEND_SEND_VAR:
 					opline->extended_value = 0;
@@ -334,6 +388,9 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 						opline->opcode = ZEND_SEND_VAL;
 					}
 					break;
+				case ZEND_SEND_USER:
+					opline->opcode = ZEND_SEND_VAL_EX;
+					break;
 				/* In most cases IS_TMP_VAR operand may be used only once.
 				 * The operands are usually destroyed by the opcode handler.
 				 * ZEND_CASE is an exception, that keeps operand unchanged,
@@ -399,21 +456,12 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
 				default:
 					break;
 			}
-			zend_optimizer_update_op1_const(op_array, opline, val);
-			break;
+			return zend_optimizer_update_op1_const(op_array, opline, val);
 		}
 
 		if (ZEND_OP2_TYPE(opline) == type &&
 			ZEND_OP2(opline).var == var) {
-			switch (opline->opcode) {
-				case ZEND_ASSIGN_REF:
-					zval_dtor(val);
-					return 0;
-				default:
-					break;
-			}
-			zend_optimizer_update_op2_const(op_array, opline, val);
-			break;
+			return zend_optimizer_update_op2_const(op_array, opline, val);
 		}
 		opline++;
 	}

ext/opcache/Optimizer/zend_optimizer_internal.h

@@ -118,12 +118,12 @@ int  zend_optimizer_get_persistent_constant(zend_string *name, zval *result, int
 void zend_optimizer_collect_constant(zend_optimizer_ctx *ctx, zval *name, zval* value);
 int  zend_optimizer_get_collected_constant(HashTable *constants, zval *name, zval* value);
 int  zend_optimizer_lookup_cv(zend_op_array *op_array, zend_string* name);
-void zend_optimizer_update_op1_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val);
-void zend_optimizer_update_op2_const(zend_op_array *op_array,
-                                     zend_op       *opline,
-                                     zval          *val);
+int zend_optimizer_update_op1_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val);
+int zend_optimizer_update_op2_const(zend_op_array *op_array,
+                                    zend_op       *opline,
+                                    zval          *val);
 int  zend_optimizer_replace_by_const(zend_op_array *op_array,
                                      zend_op       *opline,
                                      zend_uchar     type,

ext/opcache/ZendAccelerator.c

@@ -249,6 +249,8 @@ static void accel_interned_strings_restore_state(void)
     uint nIndex;
     Bucket *p;
 
+	memset(ZCSG(interned_strings_saved_top),
+			0, ZCSG(interned_strings_top) - ZCSG(interned_strings_saved_top));
 	ZCSG(interned_strings_top) = ZCSG(interned_strings_saved_top);
     while (idx > 0) {
     	idx--;
@@ -2517,13 +2519,13 @@ static int accel_remap_huge_pages(void *start, size_t size, const char *name, si
 	}
 	memcpy(mem, start, size);
 
-#ifdef MAP_HUGETLB
+#  ifdef MAP_HUGETLB
 	ret = mmap(start, size,
 		PROT_READ | PROT_WRITE | PROT_EXEC,
 		MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_HUGETLB,
 		-1, 0);
-#endif
-#ifdef MADV_HUGEPAGE
+#  endif
+#  ifdef MADV_HUGEPAGE
 	if (ret == MAP_FAILED) {
 		ret = mmap(start, size,
 			PROT_READ | PROT_WRITE | PROT_EXEC,
@@ -2531,7 +2533,7 @@ static int accel_remap_huge_pages(void *start, size_t size, const char *name, si
 			-1, 0);
 		madvise(start, size, MADV_HUGEPAGE);
 	}
-#endif
+#  endif
 	if (ret == start) {
 	    memcpy(start, mem, size);
 		mprotect(start, size, PROT_READ | PROT_EXEC);
@@ -2565,7 +2567,13 @@ static void accel_move_code_to_huge_pages(void)
 		fclose(f);
 	}
 }
-# endif
+# else
+static void accel_move_code_to_huge_pages(void)
+{
+	zend_error(E_WARNING, ACCELERATOR_PRODUCT_NAME ": opcache.huge_code_pages has no affect as huge page is not supported");
+	return;
+}
+# endif /* defined(MAP_HUGETLB) || defined(MADV_HUGEPAGE) */
 #endif /* HAVE_HUGE_CODE_PAGES */
 
 static int accel_startup(zend_extension *extension)

ext/opcache/zend_accelerator_module.c

@@ -242,7 +242,6 @@ static ZEND_INI_MH(OnEnable)
 }
 
 #ifdef HAVE_OPCACHE_FILE_CACHE
-
 static ZEND_INI_MH(OnUpdateFileCache)
 {
 	if (new_value) {

ext/opcache/zend_file_cache.c

@@ -20,6 +20,7 @@
 #include "zend_virtual_cwd.h"
 #include "zend_compile.h"
 #include "zend_vm.h"
+#include "zend_interfaces.h"
 
 #include "php.h"
 
@@ -35,6 +36,10 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 
+#if HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
 #ifdef HAVE_SYS_UIO_H
 # include <sys/uio.h>
 #endif
@@ -801,10 +806,12 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 static void zend_file_cache_unserialize_hash(HashTable               *ht,
                                              zend_persistent_script  *script,
                                              void                    *buf,
-                                             unserialize_callback_t   func)
+                                             unserialize_callback_t   func,
+                                             dtor_func_t              dtor)
 {
 	Bucket *p, *end;
 
+	ht->pDestructor = dtor;
 	if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
 		HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 		return;
@@ -869,7 +876,8 @@ static void zend_file_cache_unserialize_zval(zval                    *zv,
 
 				UNSERIALIZE_PTR(Z_ARR_P(zv));
 				ht = Z_ARR_P(zv);
-				zend_file_cache_unserialize_hash(ht, script, buf, zend_file_cache_unserialize_zval);
+				zend_file_cache_unserialize_hash(ht,
+						script, buf, zend_file_cache_unserialize_zval, ZVAL_PTR_DTOR);
 			}
 			break;
 		case IS_REFERENCE:
@@ -904,7 +912,8 @@ static void zend_file_cache_unserialize_op_array(zend_op_array           *op_arr
 
 		UNSERIALIZE_PTR(op_array->static_variables);
 		ht = op_array->static_variables;
-		zend_file_cache_unserialize_hash(ht, script, buf, zend_file_cache_unserialize_zval);
+		zend_file_cache_unserialize_hash(ht,
+				script, buf, zend_file_cache_unserialize_zval, ZVAL_PTR_DTOR);
 	}
 
 	if (op_array->literals && !IS_UNSERIALIZED(op_array->literals)) {
@@ -1056,7 +1065,8 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 	ce = Z_PTR_P(zv);
 
 	UNSERIALIZE_STR(ce->name);
-	zend_file_cache_unserialize_hash(&ce->function_table, script, buf, zend_file_cache_unserialize_func);
+	zend_file_cache_unserialize_hash(&ce->function_table,
+			script, buf, zend_file_cache_unserialize_func, ZEND_FUNCTION_DTOR);
 	if (ce->default_properties_table) {
 		zval *p, *end;
 
@@ -1079,10 +1089,12 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 			p++;
 		}
 	}
-	zend_file_cache_unserialize_hash(&ce->constants_table, script, buf, zend_file_cache_unserialize_zval);
+	zend_file_cache_unserialize_hash(&ce->constants_table,
+			script, buf, zend_file_cache_unserialize_zval, NULL);
 	UNSERIALIZE_STR(ZEND_CE_FILENAME(ce));
 	UNSERIALIZE_STR(ZEND_CE_DOC_COMMENT(ce));
-	zend_file_cache_unserialize_hash(&ce->properties_info, script, buf, zend_file_cache_unserialize_prop_info);
+	zend_file_cache_unserialize_hash(&ce->properties_info,
+			script, buf, zend_file_cache_unserialize_prop_info, ZVAL_PTR_DTOR);
 
 	if (ce->trait_aliases) {
 		zend_trait_alias **p, *q;
@@ -1168,6 +1180,11 @@ static void zend_file_cache_unserialize_class(zval                    *zv,
 	UNSERIALIZE_PTR(ce->__tostring);
 	UNSERIALIZE_PTR(ce->__callstatic);
 	UNSERIALIZE_PTR(ce->__debugInfo);
+
+	if (UNEXPECTED((ce->ce_flags & ZEND_ACC_ANON_CLASS))) {
+		ce->serialize = zend_class_serialize_deny;
+		ce->unserialize = zend_class_unserialize_deny;
+	}
 }
 
 static void zend_file_cache_unserialize(zend_persistent_script  *script,
@@ -1177,8 +1194,10 @@ static void zend_file_cache_unserialize(zend_persistent_script  *script,
 
 	UNSERIALIZE_STR(script->full_path);
 
-	zend_file_cache_unserialize_hash(&script->class_table, script, buf, zend_file_cache_unserialize_class);
-	zend_file_cache_unserialize_hash(&script->function_table, script, buf, zend_file_cache_unserialize_func);
+	zend_file_cache_unserialize_hash(&script->class_table,
+			script, buf, zend_file_cache_unserialize_class, ZEND_CLASS_DTOR);
+	zend_file_cache_unserialize_hash(&script->function_table,
+			script, buf, zend_file_cache_unserialize_func, ZEND_FUNCTION_DTOR);
 	zend_file_cache_unserialize_op_array(&script->main_op_array, script, buf);
 
 	UNSERIALIZE_PTR(script->arena_mem);

ext/pdo/pdo_sql_parser.c

@@ -575,6 +575,9 @@ safe:
 						zend_string *buf;
 
 						buf = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+						if (!buf) {
+							buf = ZSTR_EMPTY_ALLOC();
+						}
 						if (!stmt->dbh->methods->quoter(stmt->dbh, ZSTR_VAL(buf), ZSTR_LEN(buf), &plc->quoted, &plc->qlen,
 								param->param_type)) {
 							/* bork */

ext/pdo/pdo_sql_parser.re

@@ -217,6 +217,9 @@ safe:
 						zend_string *buf;
 
 						buf = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+						if (!buf) {
+							buf = ZSTR_EMPTY_ALLOC();
+						}
 						if (!stmt->dbh->methods->quoter(stmt->dbh, ZSTR_VAL(buf), ZSTR_LEN(buf), &plc->quoted, &plc->qlen,
 								param->param_type)) {
 							/* bork */

ext/pdo_dblib/dblib_stmt.c

@@ -192,15 +192,25 @@ static int pdo_dblib_stmt_describe(pdo_stmt_t *stmt, int colno)
 	pdo_dblib_stmt *S = (pdo_dblib_stmt*)stmt->driver_data;
 	pdo_dblib_db_handle *H = S->H;
 	struct pdo_column_data *col;
-	zend_string *str;
-
+	char *fname;
+	
 	if(colno >= stmt->column_count || colno < 0)  {
 		return FAILURE;
 	}
 
 	col = &stmt->columns[colno];
-	str = dbcolname(H->link, colno+1);
-	col->name =  zend_string_init(str, strlen(str), 0);
+	fname = (char*)dbcolname(H->link, colno+1);
+
+	if (fname && *fname) {
+		col->name =  zend_string_init(fname, strlen(fname), 0);
+	} else {
+		char buf[16];
+		int len;
+		
+		len = snprintf(buf, sizeof(buf), "computed%d", colno);
+		col->name = zend_string_init(buf, len, 0);
+	}
+
 	col->maxlen = dbcollen(H->link, colno+1);
 	col->param_type = PDO_PARAM_STR;
 

ext/pdo_dblib/tests/bug_69757.phpt

@@ -0,0 +1,32 @@
+--TEST--
+PDO_DBLIB: Segmentation fault on pdo_dblib::nextRowset
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_dblib')) die('skip not loaded');
+require __DIR__ . '/config.inc';
+?>
+--FILE--
+<?php
+require __DIR__ . '/config.inc';
+
+$sql = "
+    exec dbo.sp_executesql N'
+        SELECT * FROM sysobjects
+        SELECT * FROM syscolumns
+    '
+";
+$stmt = $db->query($sql);
+$resultset1 = $stmt->fetchAll(PDO::FETCH_ASSOC);
+if (true !== $stmt->nextRowset()) {
+    die('expect TRUE on nextRowset');
+}
+$resultset2 = $stmt->fetchAll(PDO::FETCH_ASSOC);
+if (false !== $stmt->nextRowset()) {
+    die('expect FALSE on nextRowset');
+}
+$stmt->closeCursor();
+
+echo "OK\n";
+?>
+--EXPECT--
+OK

ext/pdo_firebird/firebird_statement.c

@@ -523,12 +523,13 @@ static int firebird_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_dat
 			}
 
 			if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-				php_stream *stm;
+				php_stream *stm = NULL;
 
 				php_stream_from_zval_no_verify(stm, parameter);
 				if (stm) {
+					zend_string *mem =  php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
 					zval_ptr_dtor(parameter);
-					ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+					ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 				} else {
 					pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 					return 0;

ext/pdo_mysql/mysql_statement.c

@@ -523,10 +523,12 @@ static int pdo_mysql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_da
 							parameter = Z_REFVAL(param->parameter);
 						}
 						if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-							php_stream *stm;
+							php_stream *stm = NULL;
 							php_stream_from_zval_no_verify(stm, parameter);
 							if (stm) {
-								ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+								zend_string *mem = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+								zval_ptr_dtor(parameter);
+								ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 							} else {
 								pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 								return 0;

ext/pdo_mysql/tests/bug70862.phpt

@@ -0,0 +1,46 @@
+--TEST--
+MySQL Prepared Statements and BLOBs
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+	require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+	$db = MySQLPDOTest::factory();
+
+	$db->exec('DROP TABLE IF EXISTS test');
+	$db->exec(sprintf('CREATE TABLE test(id INT, label BLOB)'));
+
+	$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 0);
+	$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+	class HelloWrapper {
+		public function stream_open() { return true; }
+		public function stream_eof() { return true; }
+		public function stream_read() { return NULL; }
+		public function stream_stat() { return array(); }
+	}
+	stream_wrapper_register("hello", "HelloWrapper");
+
+	$f = fopen("hello://there", "r");
+
+	$stmt = $db->prepare('INSERT INTO test(id, label) VALUES (1, :para)');
+	$stmt->bindParam(":para", $f, PDO::PARAM_LOB);
+	$stmt->execute();
+
+	var_dump($f);
+
+	print "done!";
+?>
+--CLEAN--
+<?php
+require dirname(__FILE__) . '/mysql_pdo_test.inc';
+$db = MySQLPDOTest::factory();
+$db->exec('DROP TABLE IF EXISTS test');
+?>
+--EXPECTF--
+string(0) ""
+done!

ext/pdo_pgsql/tests/bug70861.phpt

@@ -0,0 +1,46 @@
+--TEST--
+Bug #70861 Segmentation fault in pdo_parse_params() during Drupal 8 test suite
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+try {
+	@$db->query("SET bytea_output = 'escape'");
+} catch (Exception $e) {
+}
+
+$db->query('DROP TABLE IF EXISTS test_blob_crash CASCADE');
+$db->query('CREATE TABLE test_blob_crash (id SERIAL NOT NULL, blob1 BYTEA)');
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+$stmt = $db->prepare("INSERT INTO test_one_blob (blob1) VALUES (:foo)", array(PDO::ATTR_CURSOR => PDO::CURSOR_SCROLL));
+
+$stmt->bindparam(':foo', $f, PDO::PARAM_LOB);
+$stmt->execute();
+
+fclose($f);
+
+?>
++++DONE+++
+--EXPECTF--
+%a
++++DONE+++

ext/pdo_sqlite/sqlite_statement.c

@@ -138,11 +138,12 @@ static int pdo_sqlite_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_d
 							parameter = &param->parameter;
 						}
 						if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-							php_stream *stm;
+							php_stream *stm = NULL;
 							php_stream_from_zval_no_verify(stm, parameter);
 							if (stm) {
+								zend_string *mem = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
 								zval_ptr_dtor(parameter);
-								ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+								ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 							} else {
 								pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 								return 0;

ext/pdo_sqlite/tests/bug70862.phpt

@@ -0,0 +1,36 @@
+--TEST--
+PDO_sqlite: Testing sqliteCreateCollation()
+--SKIPIF--
+<?php if (!extension_loaded('pdo_sqlite')) print 'skip not loaded'; ?>
+--FILE--
+<?php
+
+$db = new pdo('sqlite::memory:');
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+$db->exec('CREATE TABLE test(field BLOB)');
+
+$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 0);
+$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+$stmt = $db->prepare('INSERT INTO test(field) VALUES (:para)');
+$stmt->bindParam(":para", $f, PDO::PARAM_LOB);
+$stmt->execute();
+
+var_dump($f);
+
+?>
++++DONE+++
+--EXPECTF--
+string(0) ""
++++DONE+++

ext/reflection/php_reflection.c

@@ -1762,7 +1762,12 @@ ZEND_METHOD(reflection_function, getClosure)
 	}
 	GET_REFLECTION_OBJECT_PTR(fptr);
 
-	zend_create_fake_closure(return_value, fptr, NULL, NULL, NULL);
+	if (!Z_ISUNDEF(intern->obj)) {
+		/* Closures are immutable objects */
+		ZVAL_COPY(return_value, &intern->obj);
+	} else {
+		zend_create_fake_closure(return_value, fptr, NULL, NULL, NULL);
+	}
 }
 /* }}} */
 

ext/reflection/tests/ReflectionClass_CannotClone_basic.phpt

@@ -5,7 +5,7 @@ Stefan Koopmanschap <stefan@phpgg.nl>
 TestFest PHP|Tek
 --SKIPIF--
 <?php
-if (!extension_loaded('reflection)) print 'skip';
+if (!extension_loaded('reflection')) print 'skip';
 ?>
 --FILE-- 
 <?php

ext/session/mod_files.c

@@ -443,7 +443,7 @@ PS_CLOSE_FUNC(files)
 
 	efree(data->basedir);
 	efree(data);
-	*mod_data = NULL;
+	PS_SET_MOD_DATA(NULL);
 
 	return SUCCESS;
 }

ext/session/session.c

@@ -2074,7 +2074,12 @@ static PHP_FUNCTION(session_regenerate_id)
 	PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 	if (!PS(id)) {
 		PS(session_status) = php_session_none;
-		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create new session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+		RETURN_FALSE;
+	}
+	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
+		PS(session_status) = php_session_none;
+		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create(open) session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
 		RETURN_FALSE;
 	}
 	if (PS(use_strict_mode) && PS(mod)->s_validate_sid &&
@@ -2083,19 +2088,14 @@ static PHP_FUNCTION(session_regenerate_id)
 		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 		if (!PS(id)) {
 			PS(session_status) = php_session_none;
-			php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+			php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID by collision: %s (path: %s)", PS(mod)->s_name, PS(save_path));
 			RETURN_FALSE;
 		}
 	}
-	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
-		PS(session_status) = php_session_none;
-		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
-		RETURN_FALSE;
-	}
 	/* Read is required to make new session data at this point. */
 	if (PS(mod)->s_read(&PS(mod_data), PS(id), &data, PS(gc_maxlifetime)) == FAILURE) {
 		PS(session_status) = php_session_none;
-		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create(read) session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
 		RETURN_FALSE;
 	}
 	if (data) {

ext/session/tests/bug70876.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #70876 Segmentation fault when regenerating session id with strict mode
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--INI--
+html_errors=0
+session.save_handler=files
+--FILE--
+<?php
+ini_set('session.use_strict_mode', true);
+session_start();
+session_regenerate_id();
+
+echo "ok";
+?>
+--EXPECT--
+ok

ext/soap/php_http.c

@@ -1419,7 +1419,12 @@ static zend_string* get_http_body(php_stream *stream, int close, char *headers)
 						}
 						return NULL;
 					}
-					http_buf = zend_string_realloc(http_buf, http_buf_size + buf_size, 0);
+
+					if (http_buf) {
+						http_buf = zend_string_realloc(http_buf, http_buf_size + buf_size, 0);
+					} else {
+						http_buf = zend_string_alloc(buf_size, 0);
+					}
 
 					while (len_size < buf_size) {
 						int len_read = php_stream_read(stream, http_buf->val + http_buf_size, buf_size - len_size);
@@ -1489,7 +1494,11 @@ static zend_string* get_http_body(php_stream *stream, int close, char *headers)
 	} else if (header_close) {
 		do {
 			int len_read;
-			http_buf = zend_string_realloc(http_buf, http_buf_size + 4096 + 1, 0);
+			if (http_buf) {
+				http_buf = zend_string_realloc(http_buf, http_buf_size + 4096, 0);
+			} else {
+				http_buf = zend_string_alloc(4096, 0);
+			}
 			len_read = php_stream_read(stream, http_buf->val + http_buf_size, 4096);
 			if (len_read > 0) {
 				http_buf_size += len_read;

ext/soap/php_sdl.c

@@ -112,7 +112,7 @@ encodePtr get_encoder(sdlPtr sdl, const char *ns, const char *type)
 {
 	encodePtr enc = NULL;
 	char *nscat;
-	int ns_len = strlen(ns);
+	int ns_len = ns ? strlen(ns) : 0;
 	int type_len = strlen(type);
 	int len = ns_len + type_len + 1;
 
@@ -1149,7 +1149,9 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
 					zend_hash_init(ctx.sdl->bindings, 0, NULL, delete_binding, 0);
 				}
 
-				zend_hash_str_add_ptr(ctx.sdl->bindings, tmpbinding->name, strlen(tmpbinding->name), tmpbinding);
+				if (!zend_hash_str_add_ptr(ctx.sdl->bindings, tmpbinding->name, strlen(tmpbinding->name), tmpbinding)) {
+					zend_hash_next_index_insert_ptr(ctx.sdl->bindings, tmpbinding);
+				}
 				trav= trav->next;
 			}
 

ext/soap/soap.c

@@ -4802,7 +4802,9 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
 						enc = enc->details.sdl_type->encode;
 					}
 					if (enc) {
-						smart_str_appendl(buf, ZSTR_VAL(spaces.s), ZSTR_LEN(spaces.s));
+						if (spaces.s) {
+							smart_str_appendl(buf, ZSTR_VAL(spaces.s), ZSTR_LEN(spaces.s));
+						}
 						smart_str_appendc(buf, ' ');
 						smart_str_appendl(buf, type->encode->details.type_str, strlen(type->encode->details.type_str));
 						smart_str_appendl(buf, " _;\n", 4);
@@ -4815,7 +4817,9 @@ static void type_to_string(sdlTypePtr type, smart_str *buf, int level)
 					sdlAttributePtr attr;
 
 					ZEND_HASH_FOREACH_PTR(type->attributes, attr) {
-						smart_str_appendl(buf, ZSTR_VAL(spaces.s), ZSTR_LEN(spaces.s));
+						if (spaces.s) {
+							smart_str_appendl(buf, ZSTR_VAL(spaces.s), ZSTR_LEN(spaces.s));
+						}
 						smart_str_appendc(buf, ' ');
 						if (attr->encode && attr->encode->details.type_str) {
 							smart_str_appends(buf, attr->encode->details.type_str);

ext/soap/tests/bug70875.phpt

@@ -0,0 +1,50 @@
+--TEST--
+SOAP Bug #70875 - Segmentation fault if wsdl has no targetNamespace attribute
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+
+class bug70875 extends SOAPClient
+{
+	public function __doRequest($request, $location, $action, $version, $one_way = 0)
+	{
+		die("no SIGSEGV");
+	}
+}
+
+$c = new bug70875(__DIR__.'/bug70875.wsdl', [
+	'trace' => 1,
+	'classmap' => [
+		'TestService' => 'TestService',
+		'TestServiceRQ' => 'TestServiceRQ',
+		'RqHeader' => 'RqHeader',
+	],
+]);
+
+
+class TestService
+{
+    public $TestServiceRQ;
+}
+
+class TestServiceRQ
+{
+	public $RqHeader;
+}
+
+class RqHeader
+{
+}
+
+$r = new TestService();
+$r->TestServiceRQ = new TestServiceRQ();
+$r->TestServiceRQ->RqHeader = new RqHeader();
+
+$c->testService($r);
+
+?>
+--EXPECT--
+no SIGSEGV

ext/soap/tests/bug70875.wsdl

@@ -0,0 +1,156 @@
+<?xml version="1.0" encoding="utf-8"?>
+<wsdl:definitions name="BookingService" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
+                  xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy"
+                  xmlns:wsa10="http://www.w3.org/2005/08/addressing"
+                  xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract"
+                  xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
+                  xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex"
+                  xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+                  xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata"
+                  xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
+                  xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
+                  xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl"
+                  xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/"
+                  xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                  xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+    <wsdl:types>
+        <xs:schema elementFormDefault="unqualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+            <xs:element name="TestService">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element minOccurs="0" maxOccurs="1" name="TestServiceRQ" type="TestServiceRQ"/>
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+            <xs:complexType name="TestServiceRQ">
+                <xs:complexContent mixed="false">
+                    <xs:extension base="BaseRequest"/>
+                </xs:complexContent>
+            </xs:complexType>
+            <xs:complexType name="BaseRequest">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="RqHeader" type="RequestHeader"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="RequestHeader">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="AvesAutoLogin" type="AutoLogin"/>
+                </xs:sequence>
+                <xs:attribute name="HostID" type="xs:string"/>
+                <xs:attribute name="Xtoken" type="xs:string"/>
+                <xs:attribute name="Interface" type="xs:string"/>
+                <xs:attribute name="UserName" type="xs:string"/>
+            </xs:complexType>
+            <xs:complexType name="AutoLogin">
+                <xs:attribute name="VatCode" type="xs:string"/>
+                <xs:attribute name="ZipCode" type="xs:string"/>
+                <xs:attribute name="HashCode" type="xs:string"/>
+            </xs:complexType>
+            <xs:element name="TestServiceResponse">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element minOccurs="0" maxOccurs="1" name="TestServiceRS" type="TestServiceRS"/>
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+            <xs:complexType name="TestServiceRS">
+                <xs:complexContent mixed="false">
+                    <xs:extension base="BaseResponse"/>
+                </xs:complexContent>
+            </xs:complexType>
+            <xs:complexType name="BaseResponse">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="RsStatus" type="ResponseStatus"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="ResponseStatus">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ErrorCode" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ErrorDescription" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="unbounded" name="Warnings" type="ResponseWarning"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="InternalLog" type="xs:string"/>
+                    <xs:element minOccurs="0" maxOccurs="1" name="ProviderLogs" type="ArrayOfProviderLog"/>
+                </xs:sequence>
+                <xs:attribute name="Status" type="ResponseStatusType" use="required"/>
+            </xs:complexType>
+            <xs:complexType name="ResponseWarning">
+                <xs:attribute name="WarnType" type="ResponseWarningTypes" use="required"/>
+                <xs:attribute name="Description" type="xs:string"/>
+            </xs:complexType>
+            <xs:simpleType name="ResponseWarningTypes">
+                <xs:restriction base="xs:string">
+                    <xs:enumeration value="Unknown"/>
+                    <xs:enumeration value="DataNotFound"/>
+                    <xs:enumeration value="InactiveAgency"/>
+                </xs:restriction>
+            </xs:simpleType>
+            <xs:complexType name="ArrayOfProviderLog">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="unbounded" name="ProviderLog" nillable="true"
+                                type="ProviderLog"/>
+                </xs:sequence>
+            </xs:complexType>
+            <xs:complexType name="ProviderLog">
+                <xs:sequence>
+                    <xs:element minOccurs="0" maxOccurs="1" name="OtaReqContent">
+                        <xs:complexType mixed="true">
+                            <xs:sequence>
+                                <xs:any/>
+                            </xs:sequence>
+                        </xs:complexType>
+                    </xs:element>
+                    <xs:element minOccurs="0" maxOccurs="1" name="OtaResContent">
+                        <xs:complexType mixed="true">
+                            <xs:sequence>
+                                <xs:any/>
+                            </xs:sequence>
+                        </xs:complexType>
+                    </xs:element>
+                </xs:sequence>
+                <xs:attribute name="ProviderCode" type="xs:string"/>
+                <xs:attribute name="RequestTime" type="xs:string"/>
+                <xs:attribute name="PostRequestTime" type="xs:string"/>
+                <xs:attribute name="ResponseCount" type="xs:string"/>
+                <xs:attribute name="ResponseMessage" type="xs:string"/>
+            </xs:complexType>
+            <xs:simpleType name="ResponseStatusType">
+                <xs:restriction base="xs:string">
+                    <xs:enumeration value="OK"/>
+                    <xs:enumeration value="ERROR"/>
+                    <xs:enumeration value="WARNING"/>
+                    <xs:enumeration value="TIMEOUT"/>
+                </xs:restriction>
+            </xs:simpleType>
+        </xs:schema>
+    </wsdl:types>
+    <wsdl:message name="IBookingService_TestService_InputMessage">
+        <wsdl:part name="parameters" element="TestService"/>
+    </wsdl:message>
+    <wsdl:message name="IBookingService_TestService_OutputMessage">
+        <wsdl:part name="parameters" element="TestServiceResponse"/>
+    </wsdl:message>
+    <wsdl:portType name="IBookingService">
+        <wsdl:operation name="TestService">
+            <wsdl:input wsaw:Action="urn:IBookingService/TestService"
+                        message="IBookingService_TestService_InputMessage"/>
+            <wsdl:output wsaw:Action="urn:IBookingService/TestServiceResponse"
+                         message="IBookingService_TestService_OutputMessage"/>
+        </wsdl:operation>
+    </wsdl:portType>
+    <wsdl:binding name="interop_booking_v2" type="IBookingService">
+        <wsdl:operation name="TestService">
+            <soap:operation soapAction="urn:IBookingService/TestService" style="document"/>
+            <wsdl:input>
+                <soap:body use="literal"/>
+            </wsdl:input>
+            <wsdl:output>
+                <soap:body use="literal"/>
+            </wsdl:output>
+        </wsdl:operation>
+    </wsdl:binding>
+    <wsdl:service name="BookingService">
+        <wsdl:port name="interop_booking_v2" binding="interop_booking_v2">
+            <soap:address location="http://localhost/foobar/soap"/>
+        </wsdl:port>
+    </wsdl:service>
+</wsdl:definitions>

ext/spl/spl_engine.c

@@ -42,6 +42,7 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */
 {
 	zend_ulong idx;
 
+try_again:
 	switch (Z_TYPE_P(offset)) {
 	case IS_STRING:
 		if (ZEND_HANDLE_NUMERIC(Z_STR_P(offset), idx)) {
@@ -56,6 +57,9 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */
 		return 0;
 	case IS_TRUE:
 		return 1;
+	case IS_REFERENCE:
+		offset = Z_REFVAL_P(offset);
+		goto try_again;
 	case IS_RESOURCE:
 		return Z_RES_HANDLE_P(offset);
 	}

ext/spl/spl_iterators.c

@@ -2059,6 +2059,11 @@ SPL_METHOD(RegexIterator, accept)
 	{
 		case REGIT_MODE_MAX: /* won't happen but makes compiler happy */
 		case REGIT_MODE_MATCH:
+#ifdef PCRE_EXTRA_MARK
+			if (intern->u.regex.pce->extra) {
+				intern->u.regex.pce->extra->flags &= ~PCRE_EXTRA_MARK;
+			}
+#endif
 			count = pcre_exec(intern->u.regex.pce->re, intern->u.regex.pce->extra, ZSTR_VAL(subject), ZSTR_LEN(subject), 0, 0, NULL, 0);
 			RETVAL_BOOL(count >= 0);
 			break;

ext/spl/tests/bug70730.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Bug #70730 (Incorrect ArrayObject serialization if unset is called in serialize())
+--FILE--
+<?php
+class A extends \ArrayObject
+{
+	protected $foo;
+
+	public function __construct()
+	{
+		$this->foo = 'bar';
+	}
+
+	public function serialize()
+	{
+		unset($this->foo);
+		$result = parent::serialize();
+		$this->foo = 'bar';
+		return $result;
+	}
+}
+
+$a = new A();
+$a->append('item1');
+$a->append('item2');
+$a->append('item3');
+$b = new A();
+$b->unserialize($a->serialize());
+var_dump($b);
+?>
+--EXPECTF--
+object(A)#%d (2) {
+  ["foo":protected]=>
+  string(3) "bar"
+  ["storage":"ArrayObject":private]=>
+  array(3) {
+    [0]=>
+    string(5) "item1"
+    [1]=>
+    string(5) "item2"
+    [2]=>
+    string(5) "item3"
+  }
+}

ext/spl/tests/bug70853.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #70853 (SplFixedArray throws exception when using ref variable as index)
+--FILE--
+<?php
+
+$list = new SplFixedArray(10);
+$ndx = 1;
+$ndx2 =& $ndx;
+$list[$ndx] = 123;	// This throws an exception;
+$list[$ndx2] = 123;	// as does this, to.
+echo 'ok';
+
+?>
+--EXPECT--
+ok

ext/spl/tests/bug70868.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #70868, with PCRE JIT
+--INI--
+pcre.jit=1
+--SKIPIF--
+<?php if (!extension_loaded("pcre")) die("skip"); ?>
+--FILE--
+<?php
+
+namespace X;
+
+$iterator =
+    new \RegexIterator(
+        new \ArrayIterator(['A.phpt', 'B.phpt', 'C.phpt']),
+        '/\.phpt$/'
+    )
+;
+
+foreach ($iterator as $foo) {
+    var_dump($foo);
+    preg_replace('/\.phpt$/', '', '');
+}
+
+echo "Done", PHP_EOL;
+
+?>
+--EXPECTF--
+
+string(6) "A.phpt"
+string(6) "B.phpt"
+string(6) "C.phpt"
+Done

ext/spl/tests/bug70959.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #70959 (ArrayObject unserialize does not restore protected fields)
+--FILE--
+<?php
+class testObject extends ArrayObject {
+	protected $test;
+
+	public function getTest() {
+		return $this->test;
+	}
+
+	public function setTest($test) {
+		$this->test = $test;
+	}
+}
+
+$obj = new testObject();
+$obj->setTest('test');
+var_dump($obj->getTest());
+$obj2 = unserialize(serialize($obj));
+var_dump($obj2->getTest());
+--EXPECTF--
+string(4) "test"
+string(4) "test"

ext/sqlite3/sqlite3.c

@@ -871,6 +871,8 @@ static int php_sqlite3_callback_compare(void *coll, int a_len, const void *a, in
 		if ((ret = zend_call_function(&collation->fci.fci, &collation->fci.fcc)) == FAILURE) {
 			php_error_docref(NULL, E_WARNING, "An error occurred while invoking the compare callback");
 		}
+	} else {
+		ZVAL_UNDEF(&retval);
 	}
 
 	zval_ptr_dtor(&zargs[0]);
@@ -1525,7 +1527,7 @@ PHP_METHOD(sqlite3stmt, execute)
 				case SQLITE_BLOB:
 				{
 					php_stream *stream = NULL;
-					zend_string *buffer;
+					zend_string *buffer = NULL;
 					if (Z_TYPE_P(parameter) == IS_RESOURCE) {
 						php_stream_from_zval_no_verify(stream, parameter);
 						if (stream == NULL) {
@@ -1538,10 +1540,11 @@ PHP_METHOD(sqlite3stmt, execute)
 						buffer = Z_STR_P(parameter);
 					}
 
-					sqlite3_bind_blob(stmt_obj->stmt, param->param_number, ZSTR_VAL(buffer), ZSTR_LEN(buffer), SQLITE_TRANSIENT);
-
-					if (stream) {
+					if (buffer) {
+						sqlite3_bind_blob(stmt_obj->stmt, param->param_number, ZSTR_VAL(buffer), ZSTR_LEN(buffer), SQLITE_TRANSIENT);
 						zend_string_release(buffer);
+					} else {
+						sqlite3_bind_null(stmt_obj->stmt, param->param_number);
 					}
 					break;
 				}

ext/sqlite3/tests/sqlite3_blob_bind_resource.phpt

@@ -0,0 +1,39 @@
+--TEST--
+SQLite3::execute() with a resource bound for blob param
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+require_once(dirname(__FILE__) . '/new_db.inc');
+require_once(dirname(__FILE__) . '/stream_test.inc');
+
+var_dump($db->exec('CREATE TABLE test (id STRING, data BLOB)'));
+$insert_stmt = $db->prepare("INSERT INTO test (id, data) VALUES (1, ?)");
+
+
+class HelloWrapper {
+	public function stream_open() { return true; }
+	public function stream_eof() { return true; }
+	public function stream_read() { return NULL; }
+	public function stream_stat() { return array(); }
+}
+stream_wrapper_register("hello", "HelloWrapper");
+
+$f = fopen("hello://there", "r");
+
+var_dump($insert_stmt->bindParam(1, $f, SQLITE3_BLOB));
+var_dump($insert_stmt->execute());
+
+var_dump($insert_stmt->close());
+fclose($f);
+
+?>
++++DONE+++
+--EXPECTF--
+bool(true)
+bool(true)
+object(SQLite3Result)#%d (%d) {
+}
+bool(true)
++++DONE+++

ext/standard/array.c

@@ -768,7 +768,7 @@ PHPAPI zend_long php_count_recursive(zval *array, zend_long mode) /* {{{ */
 			return 0;
 		}
 
-		cnt = zend_hash_num_elements(Z_ARRVAL_P(array));
+		cnt = zend_array_count(Z_ARRVAL_P(array));
 		if (mode == COUNT_RECURSIVE) {
 		    if (ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(array))) {
 				Z_ARRVAL_P(array)->u.v.nApplyCount++;
@@ -813,7 +813,7 @@ PHP_FUNCTION(count)
 			RETURN_LONG(0);
 			break;
 		case IS_ARRAY:
-			cnt = zend_hash_num_elements(Z_ARRVAL_P(array));
+			cnt = zend_array_count(Z_ARRVAL_P(array));
 			if (mode == COUNT_RECURSIVE) {
 				ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(array), element) {
 					ZVAL_DEREF(element);
@@ -1895,8 +1895,8 @@ PHP_FUNCTION(extract)
 		}
 
 		if (Z_TYPE(final_name) == IS_STRING && php_valid_var_name(Z_STRVAL(final_name), Z_STRLEN(final_name))) {
+			zval *orig_var;
 			if (extract_refs) {
-				zval *orig_var;
 
 				ZVAL_MAKE_REF(entry);
 				Z_ADDREF_P(entry);
@@ -1913,7 +1913,16 @@ PHP_FUNCTION(extract)
 			} else {
 				ZVAL_DEREF(entry);
 				if (Z_REFCOUNTED_P(entry)) Z_ADDREF_P(entry);
-				zend_hash_update_ind(symbol_table, Z_STR(final_name), entry);
+				if ((orig_var = zend_hash_find(symbol_table, Z_STR(final_name))) != NULL) {
+					if (Z_TYPE_P(orig_var) == IS_INDIRECT) {
+						orig_var = Z_INDIRECT_P(orig_var);
+					}
+					ZVAL_DEREF(orig_var);
+					zval_ptr_dtor(orig_var);
+					ZVAL_COPY_VALUE(orig_var, entry);
+				} else {
+					zend_hash_update(symbol_table, Z_STR(final_name), entry);
+				}
 			}
 			count++;
 		}
@@ -2967,6 +2976,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
 					convert_to_array_ex(dest_zval);
 					add_next_index_null(dest_zval);
+				} else if (Z_TYPE_P(dest_zval) == IS_ARRAY) {
+					if (UNEXPECTED(Z_ARRVAL_P(dest_zval)->nNextFreeElement > Z_ARRVAL_P(dest_zval)->nNumUsed)) {
+						Z_ARRVAL_P(dest_zval)->nNextFreeElement = Z_ARRVAL_P(dest_zval)->nNumUsed;
+					}
 				} else {
 					convert_to_array_ex(dest_zval);
 				}
@@ -5145,7 +5158,7 @@ PHP_FUNCTION(array_filter)
 		}
 	}
 
-	ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_key, string_key, operand) {
+	ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_key, string_key, operand) {
 		if (have_callback) {
 			if (use_type) {
 				/* Set up the key */

ext/standard/image.c

@@ -217,11 +217,16 @@ static struct gfxinfo *php_handle_swc(php_stream * stream)
 
 	if (uncompress(b, &len, a, sizeof(a)) != Z_OK) {
 		/* failed to decompress the file, will try reading the rest of the file */
-		if (php_stream_seek(stream, 8, SEEK_SET))
+		if (php_stream_seek(stream, 8, SEEK_SET)) {
 			return NULL;
+		}
 
 		bufz = php_stream_copy_to_mem(stream, PHP_STREAM_COPY_ALL, 0);
 
+		if (!bufz) {
+			return NULL;
+		}
+
 		/*
 		 * zlib::uncompress() wants to know the output data length
 		 * if none was given as a parameter

ext/standard/tests/array/bug70808.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #70808 (array_merge_recursive corrupts memory of unset items)
+--FILE--
+<?php
+
+$arr1 = array("key" => array(0, 1));
+$arr2 = array("key" => array(2));
+
+unset($arr1["key"][1]);
+
+$result = array_merge_recursive($arr1, $arr2);
+print_r($result);
+?>
+--EXPECT--
+Array
+(
+    [key] => Array
+        (
+            [0] => 0
+            [1] => 2
+        )
+
+)

ext/standard/tests/array/bug70910.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #70910 (extract() breaks variable references)
+--FILE--
+<?php
+$var = 'original value';
+$ref =& $var;
+
+$hash = ['var' => 'new value'];
+
+extract($hash);
+var_dump($var === $ref);
+--EXPECT--
+bool(true)

ext/standard/tests/array/count_symbol_table.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Test count() function : count on symbol table
+--FILE--
+<?php
+
+$c1 = 0;
+$c2 = 0;
+$a = 1;
+$b = 1;
+$c1 = count($GLOBALS);
+unset($a);
+unset($GLOBALS["b"]);
+$c2 = count($GLOBALS);
+
+var_dump($c1 - $c2);
+$c = 1;
+$c1 = count($GLOBALS);
+var_dump($c1 - $c2);
+?>
+--EXPECT--
+int(2)
+int(1)

ext/standard/tests/general_functions/bug70249.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #70249 (Segmentation fault while running PHPUnit tests on phpBB 3.2-dev)
+--FILE--
+<?php
+
+class Logger {
+    public function __construct() {
+        register_shutdown_function(function () {
+            // make regular flush before other shutdown functions, which allows session data collection and so on
+            $this->flush();
+            // make sure log entries written by shutdown functions are also flushed
+            // ensure "flush()" is called last when there are multiple shutdown functions
+            register_shutdown_function([$this, 'flush'], true);
+        });
+    }
+
+    public function flush($final = false) {
+        return 1;
+    }
+}
+
+for ($i = 0; $i < 200; $i++) {
+    $a = new Logger();
+}
+?>
+okey
+--EXPECT--
+okey

ext/standard/tests/general_functions/bug70947.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #70947 (INI parser segfault with INI_SCANNER_TYPED)
+--FILE--
+<?php
+$o = parse_ini_string('foo = bar 123', FALSE, INI_SCANNER_TYPED);
+var_dump($o);
+?>
+--EXPECT--
+array(1) {
+  ["foo"]=>
+  string(7) "bar 123"
+}

ext/standard/tests/serialize/bug70963.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Bug #70963 (Unserialize shows UNKNOW in result)
+--FILE--
+<?php
+var_dump(unserialize('a:2:{i:0;O:9:"exception":1:{s:16:"'."\0".'Exception'."\0".'trace";s:4:"test";}i:1;R:3;}'));
+var_dump(unserialize('a:2:{i:0;O:9:"exception":1:{s:16:"'."\0".'Exception'."\0".'trace";s:4:"test";}i:1;r:3;}'));
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  object(Exception)#%d (5) {
+    ["message":protected]=>
+    string(0) ""
+    ["string":"Exception":private]=>
+    string(0) ""
+    ["code":protected]=>
+    int(0)
+    ["file":protected]=>
+    string(%d) "%s"
+    ["line":protected]=>
+    int(%d)
+  }
+}
+array(1) {
+  [0]=>
+  object(Exception)#%d (5) {
+    ["message":protected]=>
+    string(0) ""
+    ["string":"Exception":private]=>
+    string(0) ""
+    ["code":protected]=>
+    int(0)
+    ["file":protected]=>
+    string(%d) "%s"
+    ["line":protected]=>
+    int(%d)
+  }
+}

ext/standard/var.c

@@ -35,37 +35,6 @@
 #define COMMON (is_ref ? "&" : "")
 /* }}} */
 
-static uint32_t zend_hash_recalc_elements(HashTable *ht) /* {{{ */
-{
-	zval *val;
-	uint32_t num = ht->nNumOfElements;
-
-	ZEND_HASH_FOREACH_VAL(ht, val) {
-		if (Z_TYPE_P(val) == IS_UNDEF) continue;
-		if (Z_TYPE_P(val) == IS_INDIRECT) {
-			if (Z_TYPE_P(Z_INDIRECT_P(val)) == IS_UNDEF) {
-				num--;
-			}
-		}
-	} ZEND_HASH_FOREACH_END();
-	return num;
-}
-/* }}} */
-
-static uint32_t zend_obj_num_elements(HashTable *ht) /* {{{ */
-{
-	uint32_t num = ht->nNumOfElements;
-
-	if (UNEXPECTED(ht->u.v.flags & HASH_FLAG_HAS_EMPTY_IND)) {
-		num = zend_hash_recalc_elements(ht);
-		if (UNEXPECTED(ht->nNumOfElements == num)) {
-			ht->u.v.flags &= ~HASH_FLAG_HAS_EMPTY_IND;
-		}
-	}
-	return num;
-}
-/* }}} */
-
 static void php_array_element_dump(zval *zv, zend_ulong index, zend_string *key, int level) /* {{{ */
 {
 	if (key == NULL) { /* numeric key */
@@ -150,11 +119,7 @@ again:
 				--myht->u.v.nApplyCount;
 				return;
 			}
-			if (UNEXPECTED(Z_SYMBOLTABLE_P(struc))) {
-				count = zend_hash_recalc_elements(myht);
-			} else {
-				count = zend_hash_num_elements(myht);
-			}
+			count = zend_array_count(myht);
 			php_printf("%sarray(%d) {\n", COMMON, count);
 			is_temp = 0;
 
@@ -182,7 +147,7 @@ again:
 
 			myht = Z_OBJDEBUG_P(struc, is_temp);
 			class_name = Z_OBJ_HANDLER_P(struc, get_class_name)(Z_OBJ_P(struc));
-			php_printf("%sobject(%s)#%d (%d) {\n", COMMON, ZSTR_VAL(class_name), Z_OBJ_HANDLE_P(struc), myht ? zend_obj_num_elements(myht) : 0);
+			php_printf("%sobject(%s)#%d (%d) {\n", COMMON, ZSTR_VAL(class_name), Z_OBJ_HANDLE_P(struc), myht ? zend_array_count(myht) : 0);
 			zend_string_release(class_name);
 
 			if (myht) {
@@ -324,11 +289,7 @@ again:
 			PUTS("*RECURSION*\n");
 			return;
 		}
-		if (UNEXPECTED(Z_SYMBOLTABLE_P(struc))) {
-			count = zend_hash_recalc_elements(myht);
-		} else {
-			count = zend_hash_num_elements(myht);
-		}
+		count = zend_array_count(myht);
 		php_printf("%sarray(%d) refcount(%u){\n", COMMON, count, Z_REFCOUNTED_P(struc) ? Z_REFCOUNT_P(struc) : 1);
 		ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
 			zval_array_element_dump(val, index, key, level);
@@ -356,7 +317,7 @@ again:
 			}
 		}
 		class_name = Z_OBJ_HANDLER_P(struc, get_class_name)(Z_OBJ_P(struc));
-		php_printf("%sobject(%s)#%d (%d) refcount(%u){\n", COMMON, ZSTR_VAL(class_name), Z_OBJ_HANDLE_P(struc), myht ? zend_obj_num_elements(myht) : 0, Z_REFCOUNT_P(struc));
+		php_printf("%sobject(%s)#%d (%d) refcount(%u){\n", COMMON, ZSTR_VAL(class_name), Z_OBJ_HANDLE_P(struc), myht ? zend_array_count(myht) : 0, Z_REFCOUNT_P(struc));
 		zend_string_release(class_name);
 		if (myht) {
 			ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
@@ -707,14 +668,10 @@ static void php_var_serialize_class(smart_str *buf, zval *struc, zval *retval_pt
 	 * changes the count if the variable is incomplete class */
 	if (Z_TYPE_P(retval_ptr) == IS_ARRAY) {
 		ht = Z_ARRVAL_P(retval_ptr);
-		if (UNEXPECTED(Z_SYMBOLTABLE_P(struc))) {
-			count = zend_hash_recalc_elements(ht);
-		} else {
-			count = zend_hash_num_elements(ht);
-		}
+		count = zend_array_count(ht);
 	} else if (Z_TYPE_P(retval_ptr) == IS_OBJECT) {
 		ht = Z_OBJPROP_P(retval_ptr);
-		count = zend_obj_num_elements(ht);
+		count = zend_array_count(ht);
 		if (incomplete_class) {
 			--count;
 		}
@@ -935,17 +892,13 @@ again:
 			if (Z_TYPE_P(struc) == IS_ARRAY) {
 				smart_str_appendl(buf, "a:", 2);
 				myht = Z_ARRVAL_P(struc);
-				if (UNEXPECTED(Z_SYMBOLTABLE_P(struc))) {
-					i = zend_hash_recalc_elements(myht);
-				} else {
-					i = zend_hash_num_elements(myht);
-				}
+				i = zend_array_count(myht);
 			} else {
 				incomplete_class = php_var_serialize_class_name(buf, struc);
 				myht = Z_OBJPROP_P(struc);
 				/* count after serializing name, since php_var_serialize_class_name
 				 * changes the count if the variable is incomplete class */
-				i = zend_obj_num_elements(myht);
+				i = zend_array_count(myht);
 				if (i > 0 && incomplete_class) {
 					--i;
 				}

ext/standard/var_unserializer.c

@@ -365,13 +365,22 @@ string_key:
 			}
 		}
 
-		zval_dtor(&key);
-
 		if (!php_var_unserialize_ex(data, p, max, var_hash, classes)) {
+			zval_dtor(&key);
 			return 0;
 		}
 
-		var_push_dtor(var_hash, data);
+		if (UNEXPECTED(Z_ISUNDEF_P(data))) {
+			if (Z_TYPE(key) == IS_LONG) {
+				zend_hash_index_del(ht, Z_LVAL(key));
+			} else {
+				zend_hash_del_ind(ht, Z_STR(key));
+			}
+		} else {
+			var_push_dtor(var_hash, data);
+		}
+
+		zval_dtor(&key);
 
 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
 			(*p)--;
@@ -505,7 +514,7 @@ PHPAPI int php_var_unserialize_ex(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
-#line 509 "ext/standard/var_unserializer.c"
+#line 518 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -565,9 +574,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 851 "ext/standard/var_unserializer.re"
+#line 869 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 571 "ext/standard/var_unserializer.c"
+#line 580 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -610,13 +619,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 845 "ext/standard/var_unserializer.re"
+#line 863 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 620 "ext/standard/var_unserializer.c"
+#line 629 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -646,7 +655,7 @@ yy20:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 700 "ext/standard/var_unserializer.re"
+#line 718 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	zend_long elements;
@@ -791,7 +800,7 @@ yy20:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 795 "ext/standard/var_unserializer.c"
+#line 804 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -816,14 +825,14 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 693 "ext/standard/var_unserializer.re"
+#line 711 "ext/standard/var_unserializer.re"
 	{
     if (!var_hash) return 0;
 
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 827 "ext/standard/var_unserializer.c"
+#line 836 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -844,7 +853,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 669 "ext/standard/var_unserializer.re"
+#line 687 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -868,7 +877,7 @@ yy34:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 872 "ext/standard/var_unserializer.c"
+#line 881 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -889,7 +898,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 641 "ext/standard/var_unserializer.re"
+#line 659 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	zend_string *str;
@@ -917,7 +926,7 @@ yy41:
 	ZVAL_STR(rval, str);
 	return 1;
 }
-#line 921 "ext/standard/var_unserializer.c"
+#line 930 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -938,7 +947,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 614 "ext/standard/var_unserializer.re"
+#line 632 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -965,7 +974,7 @@ yy48:
 	ZVAL_STRINGL(rval, str, len);
 	return 1;
 }
-#line 969 "ext/standard/var_unserializer.c"
+#line 978 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1053,7 +1062,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 605 "ext/standard/var_unserializer.re"
+#line 623 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 use_double:
@@ -1062,7 +1071,7 @@ use_double:
 	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1066 "ext/standard/var_unserializer.c"
+#line 1075 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1121,7 +1130,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 589 "ext/standard/var_unserializer.re"
+#line 607 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 
@@ -1137,7 +1146,7 @@ yy73:
 
 	return 1;
 }
-#line 1141 "ext/standard/var_unserializer.c"
+#line 1150 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1164,7 +1173,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 563 "ext/standard/var_unserializer.re"
+#line 581 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1190,7 +1199,7 @@ yy79:
 	ZVAL_LONG(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1194 "ext/standard/var_unserializer.c"
+#line 1203 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1198,22 +1207,22 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 557 "ext/standard/var_unserializer.re"
+#line 575 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_BOOL(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1208 "ext/standard/var_unserializer.c"
+#line 1217 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 551 "ext/standard/var_unserializer.re"
+#line 569 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_NULL(rval);
 	return 1;
 }
-#line 1217 "ext/standard/var_unserializer.c"
+#line 1226 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1236,7 +1245,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 535 "ext/standard/var_unserializer.re"
+#line 548 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1248,11 +1257,16 @@ yy91:
 		return 0;
 	}
 
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		ZVAL_UNDEF(rval);
+		return 1;
+	}
+
 	ZVAL_COPY(rval, rval_ref);
 
 	return 1;
 }
-#line 1256 "ext/standard/var_unserializer.c"
+#line 1270 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1275,7 +1289,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 513 "ext/standard/var_unserializer.re"
+#line 522 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1288,6 +1302,10 @@ yy97:
 	}
 
 	zval_ptr_dtor(rval);
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		ZVAL_UNDEF(rval);
+		return 1;
+	}
 	if (Z_ISREF_P(rval_ref)) {
 		ZVAL_COPY(rval, rval_ref);
 	} else {
@@ -1297,9 +1315,9 @@ yy97:
 
 	return 1;
 }
-#line 1301 "ext/standard/var_unserializer.c"
+#line 1319 "ext/standard/var_unserializer.c"
 }
-#line 853 "ext/standard/var_unserializer.re"
+#line 871 "ext/standard/var_unserializer.re"
 
 
 	return 0;

ext/standard/var_unserializer.re

@@ -369,13 +369,22 @@ string_key:
 			}
 		}
 
-		zval_dtor(&key);
-
 		if (!php_var_unserialize_ex(data, p, max, var_hash, classes)) {
+			zval_dtor(&key);
 			return 0;
 		}
 
-		var_push_dtor(var_hash, data);
+		if (UNEXPECTED(Z_ISUNDEF_P(data))) {
+			if (Z_TYPE(key) == IS_LONG) {
+				zend_hash_index_del(ht, Z_LVAL(key));
+			} else {
+				zend_hash_del_ind(ht, Z_STR(key));
+			}
+		} else {
+			var_push_dtor(var_hash, data);
+		}
+
+		zval_dtor(&key);
 
 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
 			(*p)--;
@@ -522,6 +531,10 @@ PHPAPI int php_var_unserialize_ex(UNSERIALIZE_PARAMETER)
 	}
 
 	zval_ptr_dtor(rval);
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		ZVAL_UNDEF(rval);
+		return 1;
+	}
 	if (Z_ISREF_P(rval_ref)) {
 		ZVAL_COPY(rval, rval_ref);
 	} else {
@@ -543,6 +556,11 @@ PHPAPI int php_var_unserialize_ex(UNSERIALIZE_PARAMETER)
 		return 0;
 	}
 
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		ZVAL_UNDEF(rval);
+		return 1;
+	}
+
 	ZVAL_COPY(rval, rval_ref);
 
 	return 1;

ext/xsl/xsltprocessor.c

@@ -351,7 +351,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 				nodep = dom_object_get_node(obj);
 				valuePush(ctxt, xmlXPathNewNodeSet(nodep));
 			} else if (Z_TYPE(retval) == IS_TRUE || Z_TYPE(retval) == IS_FALSE) {
-				valuePush(ctxt, xmlXPathNewBoolean(Z_LVAL(retval)));
+				valuePush(ctxt, xmlXPathNewBoolean(Z_TYPE(retval) == IS_TRUE));
 			} else if (Z_TYPE(retval) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "A PHP Object cannot be converted to a XPath-string");
 				valuePush(ctxt, xmlXPathNewString((const xmlChar *) ""));

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 0
 #define PHP_RELEASE_VERSION 0
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.0.0-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.0.0"
 #define PHP_VERSION_ID 70000