Update versions for PHP 7.4.2

* PHP-7.3:
  Update NEWS
  Fix bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`)
  Fix #79099: OOB read in php_strip_tags_ex
  Fix #79091: heap use-after-free in session_create_id()

CONTRIBUTING.md

@@ -35,7 +35,7 @@ If you are fixing a bug, then please submit your PR against the lowest actively
 supported branch of PHP that the bug affects (only green branches on
 [the supported version page](https://www.php.net/supported-versions.php) are
 supported). For example, at the time of writing, the lowest supported version is
-PHP 7.2, which corresponds to the `PHP-7.2` branch in Git. Please also make sure
+PHP 7.3, which corresponds to the `PHP-7.3` branch in Git. Please also make sure
 you add a link to the PR in the bug on [the bug tracker](https://bugs.php.net/).
 
 Pull requests implementing RFCs should be submitted against `master`.
@@ -331,10 +331,10 @@ Currently we have the following branches in use:
 | Branch    |           |
 | --------- | --------- |
 | master    | Active development branch for PHP 8.0, which is open for backwards incompatible changes and major internal API changes. |
-| PHP-7.4   | Active development branch for PHP 7.4, which is open for new features and minor internal API changes. |
+| PHP-7.4   | Is used to release the PHP 7.4.x series. This is a current stable version and is open for bugfixes only. |
 | PHP-7.3   | Is used to release the PHP 7.3.x series. This is a current stable version and is open for bugfixes only. |
-| PHP-7.2   | Is used to release the PHP 7.2.x series. This is a current stable version and is open for bugfixes only. |
-| PHP-7.1   | Is used to release the PHP 7.1.x series. This is an old stable version and is open for security fixes only. |
+| PHP-7.2   | Is used to release the PHP 7.2.x series. This is an old stable version and is open for security fixes only. |
+| PHP-7.1   | This branch is closed. |
 | PHP-7.0   | This branch is closed. |
 | PHP-5.6   | This branch is closed. |
 | PHP-5.5   | This branch is closed. |
@@ -348,8 +348,8 @@ Currently we have the following branches in use:
 The next few rules are more of a technical nature:
 
 1. All non-security bugfix changes should first go to the lowest bugfix branch
-   (i.e. 7.2) and then get merged up to all other branches. All security fixes
-   should go to the lowest security fixes branch (i.e 7.1). If a change is not
+   (i.e. 7.3) and then get merged up to all other branches. All security fixes
+   should go to the lowest security fixes branch (i.e 7.2). If a change is not
    needed for later branches (i.e. fixes for features which were dropped from
    later branches) an empty merge should be done.
 

TSRM/tsrm_win32.c

@@ -720,6 +720,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 TSRM_API int shmdt(const void *shmaddr)
 {/*{{{*/
 	shm_pair *shm = shm_get(0, (void*)shmaddr);
+	int ret;
 
 	if (!shm->segment) {
 		return -1;
@@ -729,7 +730,12 @@ TSRM_API int shmdt(const void *shmaddr)
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch--;
 
-	return UnmapViewOfFile(shm->addr) ? 0 : -1;
+	ret = UnmapViewOfFile(shm->addr) ? 0 : -1;
+	if (!ret  && shm->descriptor->shm_nattch <= 0) {
+		ret = UnmapViewOfFile(shm->descriptor) ? 0 : -1;
+		shm->descriptor = NULL;
+	}
+	return ret;
 }/*}}}*/
 
 TSRM_API int shmctl(int key, int cmd, struct shmid_ds *buf)

UPGRADING

@@ -45,6 +45,9 @@ PHP 7.4 UPGRADE NOTES
   . The "creating default object from empty value" warning is now consistently
     thrown if a falsy value is promoted into an stdClass object. Previously some
     cases like `$null->prop[0] = $val` missed this warning.
+  . Previously get_declared_classes() always returned parent classes before
+    child classes. This is no longer the case. No particular order is guaranteed
+    for the get_declared_classes() return value.
 
 - BCMath:
   . BCMath functions will now warn if a non well-formed number is passed, such
@@ -110,6 +113,11 @@ PHP 7.4 UPGRADE NOTES
     to serialize them. Serialization for reflection objects was never
     supported and resulted in corrupted reflection objects. It has been
     explicitly prohibited now.
+  . The signature of the ReflectionMethod::getClosure() method changed to
+    account for existing behavior with static methods:
+        Before: ReflectionMethod::getClosure($object)
+        After: ReflectionMethod::getClosure($object = null)
+    The new signature is also (LSP) compatible with older PHP versions.
 
 - SPL:
   . Calling get_object_vars() on an ArrayObject instance will now always return
@@ -120,6 +128,9 @@ PHP 7.4 UPGRADE NOTES
      * ReflectionObject::getProperties()
      * reset(), current(), etc. Use Iterator methods instead.
      * Potentially others working on object properties as a list.
+     * Other internal functions that iterate over an array, but which
+       previously silently accepted an ArrayObject as well; eg curl_setopt()
+       when used with an option that expects an array.
 
     (array) casts are *not* affected. They will continue to return either the
     wrapped array, or the ArrayObject properties, depending on whether the
@@ -552,6 +563,12 @@ PHP 7.4 UPGRADE NOTES
 9. Other Changes to Extensions
 ========================================
 
+ DBA:
+   . As of PHP 7.4.2, dba_open() accepts a fifth optional parameter for lmdb
+     databases which allows to specify the mapsize. The parameter defaults to
+     zero, in which case the compiled in default mapsize (usually 1048576) will
+     be used. The mapsize should be a multiple of the page size of the OS.
+
 - GD:
   . The behavior of imagecropauto() in the bundled libgd has been synced with
     that of system libgd:

UPGRADING.INTERNALS

@@ -213,8 +213,8 @@ PHP 7.4 INTERNALS UPGRADE NOTES
      an exception. For instructions on how to gracefully handle this see
      https://wiki.php.net/rfc/tostring_exceptions#extension_guidelines.
 
-  u. The Windows typedefs uint and ulong are no longer available, and have to be
-     replaced with standard types.
+  u. The typedefs uint and ulong are no longer guaranteed to be available, and
+     have to be replaced with standard types.
 
   v. Compound assignment opcodes were changed. Instead of ZEND_ASSIGN_ADD (and
      others) with 0, ZEND_ASSIGN_DIM, ZEND_ASSIGN_OBJ or

Zend/tests/assert/expect_015.phpt

@@ -94,7 +94,7 @@ L0:
 	}
 }));
 
-assert(0 && ($a = function &(array &$a, X $b = null) use ($c,&$d) : X {
+assert(0 && ($a = function &(?array &$a, X $b = null) use ($c,&$d) : X {
 	class A {
 		use T1, T2 {
 			T1::foo insteadof foo;
@@ -244,7 +244,7 @@ Warning: assert(): assert(0 && ($a = function &(array &$a, X $b = null) use($c,
 
 })) failed in %sexpect_015.php on line %d
 
-Warning: assert(): assert(0 && ($a = function &(array &$a, X $b = null) use($c, &$d): X {
+Warning: assert(): assert(0 && ($a = function &(?array &$a, X $b = null) use($c, &$d): X {
     class A {
         use T1, T2 {
             T1::foo insteadof foo;

Zend/tests/assign_ref_func_leak.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Assigning the result of a non-reference function by-reference should not leak
+--FILE--
+<?php
+
+function func() {
+    return [0];
+}
+
+$x = $y =& func();
+var_dump($x, $y);
+
+?>
+--EXPECTF--
+Notice: Only variables should be assigned by reference in %s on line %d
+array(1) {
+  [0]=>
+  int(0)
+}
+array(1) {
+  [0]=>
+  int(0)
+}

Zend/tests/bug60909_1.phpt

@@ -11,14 +11,12 @@ set_error_handler(function($errno, $errstr, $errfile, $errline){
 require 'notfound.php';
 --EXPECTF--
 error(require(notfound.php): failed to open stream: %s)
-Warning: Uncaught Exception: Foo in %sbug60909_1.php:5
+Fatal error: Uncaught Exception: Foo in %sbug60909_1.php:5
 Stack trace:
 #0 %sbug60909_1.php(8): {closure}(2, 'require(notfoun...', '%s', 8, Array)
 #1 %sbug60909_1.php(8): require()
 #2 {main}
   thrown in %sbug60909_1.php on line 5
 
-Fatal error: main(): Failed opening required 'notfound.php' (include_path='%s') in %sbug60909_1.php on line 8
-
 
 !!!shutdown!!!

Zend/tests/bug73816.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #73816: Broken eval(anonymous class)
+--FILE--
+<?php
+
+function anon()
+{
+    static $i = 0;
+    return eval(sprintf('return new class { private $prop%s; };', ++$i));
+}
+
+var_dump(anon());
+var_dump(anon());
+
+?>
+--EXPECT--
+object(class@anonymous)#1 (1) {
+  ["prop1":"class@anonymous":private]=>
+  NULL
+}
+object(class@anonymous)#1 (1) {
+  ["prop2":"class@anonymous":private]=>
+  NULL
+}

Zend/tests/bug78776.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #78776: Abstract method implementation from trait does not check "static"
+--FILE--
+<?php
+
+abstract class A
+{
+    abstract public function createApp();
+}
+
+class B extends A
+{
+    use C;
+}
+
+trait C
+{
+    public static function createApp()
+    {
+        echo "You should not be here\n";
+    }
+}
+
+B::createApp();
+
+?>
+--EXPECTF--
+Fatal error: Cannot make non static method A::createApp() static in class C in %s on line %d

Zend/tests/bug78810.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #78810: RW fetches do not throw "uninitialized property" exception
+--FILE--
+<?php
+
+class Test {
+    public int $i;
+}
+
+$test = new Test;
+try {
+    $test->i++;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $test->i += 1;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Typed property Test::$i must not be accessed before initialization
+Typed property Test::$i must not be accessed before initialization

Zend/tests/bug78868.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #78868: Calling __autoload() with incorrect EG(fake_scope) value
+--FILE--
+<?php
+class C {
+	private $private = 1;
+
+	function foo() {
+		$this->private++; //fails with EG(fake_scope) != NULL && EG(fake_scope) != "C"
+	}
+}
+
+class A {
+	static $foo = B::foo; //not resolved on include()
+}
+
+function main_autoload($class_name) {
+	$c = new C;
+	$c->foo();
+	//doesn't affect the error
+	eval("class B {const foo = 1;}");
+}
+
+spl_autoload_register('main_autoload', false);
+
+$classA = new ReflectionClass("A");
+$props = $classA->getProperties();
+$props[0]->setValue(2); //causes constant resolving, which runs autoload, all with EG(fake_scope) == "A"
+
+echo "OK\n";
+?>
+--EXPECT--
+OK

Zend/tests/bug78898.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #78898: call_user_func(['parent', ...]) fails while other succeed
+--FILE--
+<?php
+
+class A
+{
+	protected function _x()
+	{
+		echo "a";
+	}
+
+	public function __call($methodName, array $arguments)
+	{
+		throw new Exception("Unknown method.");
+	}
+}
+
+class B extends A
+{
+	public function x()
+	{
+		parent::_x();
+		call_user_func('parent::_x');
+		call_user_func(['parent', '_x']);
+	}
+}
+
+$b = new B;
+$b->x();
+
+?>
+--EXPECT--
+aaa

Zend/tests/bug78921.phpt

@@ -0,0 +1,36 @@
+--TEST--
+Bug #78921: When Reflection triggers class load, property visibility is incorrect
+--FILE--
+<?php
+
+spl_autoload_register(function($className) {
+    if ($className == 'PrivateStatic') {
+        class PrivateStatic
+        {
+            const SOME_CONST = 13;
+            private static $privateStaticVarArray = ['a', 'b', 'c'];
+            private static $otherStatic;
+            public static function init()
+            {
+                self::$otherStatic = self::$privateStaticVarArray;
+            }
+        }
+        PrivateStatic::init();
+    }
+});
+
+class OtherClass
+{
+    const MY_CONST = PrivateStatic::SOME_CONST;
+    public static $prop = 'my property';
+}
+
+$reflectionClass = new ReflectionClass('OtherClass');
+$reflectionProperty = $reflectionClass->getProperty('prop');
+$reflectionProperty->setAccessible(true);
+$value = $reflectionProperty->getValue();
+echo "Value is $value\n";
+
+?>
+--EXPECT--
+Value is my property

Zend/tests/bug78926.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #78926: Segmentation fault on Symfony cache:clear
+--FILE--
+<?php
+
+spl_autoload_register(function($class) {
+    for ($i = 0; $i < 100; $i++) {
+        eval("class C$i {}");
+    }
+});
+
+try {
+    class B extends A {}
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump(class_exists('B', false));
+
+?>
+--EXPECT--
+Class 'A' not found
+bool(false)

Zend/tests/bug78973.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #78973: Destructor during CV freeing causes segfault if opline never saved
+--INI--
+opcache.optimization_level=0
+--FILE--
+<?php
+
+function test($x) {
+}
+test(new class {
+    public function __destruct() {
+        debug_print_backtrace();
+    }
+});
+
+?>
+--EXPECTF--
+#0  class@anonymous->__destruct() called at [%s:%d]
+#1  test() called at [%s:%d]

Zend/tests/bug78999.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #78999 (Cycle leak when using function result as temporary)
+--FILE--
+<?php
+function get() {
+	$t = new stdClass;
+	$t->prop = $t;
+	return $t;
+}
+var_dump(get());
+var_dump(gc_collect_cycles());
+--EXPECT--
+object(stdClass)#1 (1) {
+  ["prop"]=>
+  *RECURSION*
+}
+int(1)

Zend/tests/bug79022.phpt

@@ -0,0 +1,39 @@
+--TEST--
+Bug #79022 (class_exists returns True for classes that are not ready to be used)
+--FILE--
+<?php
+function my_autoloader($class) {
+    if (class_exists('Foo', 0)) {
+		new Foo();
+    }
+	if ($class == 'Foo') {
+		eval("class Foo extends Bar{}");
+	}
+
+	if ($class == 'Bar') {
+		eval("class Bar {}");
+    }
+
+	if ($class == 'Dummy') {
+		eval ("class Dummy implements iFoo {}");
+	}
+
+
+	if (interface_exists('iFoo', 0)) {
+		new Dummy();
+	}
+	if ($class == 'iFoo') {
+		eval ("interface iFoo extends iBar {}");
+	}
+
+	if ($class == 'iBar') {
+		eval ("interface iBar {}");
+	}
+}
+spl_autoload_register('my_autoloader');
+new Foo();
+new Dummy();
+echo "okey";
+?>
+--EXPECT--
+okey

Zend/tests/closure_write_prop.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Cannot write to closure properties
+--FILE--
+<?php
+
+class A {
+    function getFn() {
+        return function() {
+        };
+    }
+}
+
+$a = new A;
+try {
+    $c = $a->getFn()->b = new stdClass;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Closure object cannot have properties

Zend/tests/const_eval_and.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Incorrect constant evaluation of and/or (OSS-Fuzz #19255)
+--FILE--
+<?php
+const C = 0 && __namespace__;
+var_dump(C);
+?>
+--EXPECT--
+bool(false)

Zend/tests/dynamic_call_freeing.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Freeing of function "name" when dynamic call fails
+--FILE--
+<?php
+
+try {
+    $bar = "bar";
+    ("foo" . $bar)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $bar = ["bar"];
+    (["foo"] + $bar)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    (new stdClass)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Call to undefined function foobar()
+Function name must be a string
+Function name must be a string

Zend/tests/exception_during_include_stat.phpt

@@ -0,0 +1,41 @@
+--TEST--
+Make sure exceptions during include/require stating are properly propagated
+--FILE--
+<?php
+
+class StreamWrapper {
+    public function url_stat($path, $flags) {
+        throw new Exception('stat failed');
+    }
+}
+
+stream_wrapper_register('test', StreamWrapper::class);
+set_include_path('test://foo:test://bar');
+
+try {
+    require_once 'doesnt_exist.php';
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    require 'doesnt_exist.php';
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    include_once 'doesnt_exist.php';
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    include 'doesnt_exist.php';
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+stat failed
+stat failed
+stat failed
+stat failed

Zend/tests/generators/exception_during_shutdown.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Generator exceptions during shutdown should not be swallowed
+--FILE--
+<?php
+
+function gen() {
+    try {
+        echo "before yield\n";
+        yield;
+        echo "after yield\n";
+    } finally {
+        echo "before yield in finally\n";
+        yield;
+        echo "after yield in finally\n";
+    }
+    echo "after finally\n";
+}
+
+$gen = gen();
+$gen->rewind();
+
+?>
+--EXPECTF--
+before yield
+before yield in finally
+
+Fatal error: Uncaught Error: Cannot yield from finally in a force-closed generator in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/generators/yield_in_finally_cleanup.phpt

@@ -0,0 +1,51 @@
+--TEST--
+Free pending exceptions / return values on clone on yield in finally
+--FILE--
+<?php
+function gen1() {
+    try {
+        throw new Exception();
+    } finally {
+        yield;
+    }
+}
+function gen2() {
+    try {
+        $bar = "bar";
+        return "foo" . $bar;
+    } finally {
+        yield;
+    }
+}
+function gen3() {
+    try {
+        throw new Exception();
+    } finally {
+        try {
+            $bar = "bar";
+            return "foo" . $bar;
+        } finally {
+            yield;
+        }
+    }
+}
+function gen4() {
+    try {
+        try {
+            $bar = "bar";
+            return "foo" . $bar;
+        } finally {
+            yield;
+        }
+    } finally {
+    }
+}
+gen1()->rewind();
+gen2()->rewind();
+gen3()->rewind();
+gen4()->rewind();
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/include_stat_is_quiet.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Stats executed during include path resolution should be silent
+--FILE--
+<?php
+
+class StreamWrapper {
+    public function url_stat($path, $flags) {
+        $path = str_replace('test://', 'file://', $path);
+        if ($flags & STREAM_URL_STAT_QUIET) {
+            return @stat($path);
+        } else {
+            return stat($path);
+        }
+    }
+}
+
+stream_wrapper_register('test', StreamWrapper::class);
+set_include_path('test://foo:test://bar');
+
+try {
+    require_once 'doesnt_exist.php';
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Warning: require_once(doesnt_exist.php): failed to open stream: No such file or directory in %s on line %d
+
+Fatal error: require_once(): Failed opening required 'doesnt_exist.php' (include_path='test://foo:test://bar') in %s on line %d

Zend/tests/overloaded_assign_prop_return_value.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Make sure the return value of a property assignment is not freed to early
+--FILE--
+<?php
+class Overloaded {
+    function __set($r, $a) {}
+}
+$obj = new Overloaded;
+$x = $obj->prop = new stdClass;
+var_dump($x);
+?>
+--EXPECT--
+object(stdClass)#2 (0) {
+}

Zend/tests/string_offset_int_min_max.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Accessing PHP_INT_MAX and PHP_INT_MIN as string offsets
+--FILE--
+<?php
+
+$str = "";
+var_dump($str[PHP_INT_MAX]);
+var_dump($str[PHP_INT_MIN]);
+
+?>
+--EXPECTF--
+Notice: Uninitialized string offset: %d in %s on line %d
+string(0) ""
+
+Notice: Uninitialized string offset: -%d in %s on line %d
+string(0) ""

Zend/tests/type_declarations/typed_properties_040.phpt

@@ -14,12 +14,13 @@ class Foo {
 
 $foo = new Foo();
 
+unset($foo->bar);
 var_dump($foo->bar);
 ?>
 --EXPECTF--
 string(3) "bar"
 
-Fatal error: Uncaught TypeError: Typed property Foo::$bar must be int, null used in %s:14
+Fatal error: Uncaught TypeError: Typed property Foo::$bar must be int, null used in %s:%d
 Stack trace:
 #0 {main}
-  thrown in %s on line 14
+  thrown in %s on line %d

Zend/tests/type_declarations/typed_properties_072.phpt

@@ -12,6 +12,7 @@ class Test {
 }
 
 $test = new Test;
+unset($test->val);
 var_dump($test);
 var_dump($test->val);
 

Zend/tests/type_declarations/typed_properties_073.phpt

@@ -13,6 +13,7 @@ class Test {
 }
 
 $test = new Test;
+unset($test->val);
 var_dump($test);
 var_dump($val = &$test->val);
 var_dump($test);

Zend/tests/type_declarations/typed_properties_074.phpt

@@ -14,6 +14,7 @@ class Test {
 
 $test = new Test;
 $dummyRef = &$test->prop;
+unset($test->val);
 var_dump($test);
 try {
 	var_dump($test->val);

Zend/tests/type_declarations/typed_properties_106.phpt

@@ -0,0 +1,26 @@
+--TEST--
+CONST/CV should not be freed on failed reference assignment
+--FILE--
+<?php
+class Test {
+    public ?Type $prop;
+}
+$obj = new Test;
+$ref =& $obj->prop;
+try {
+    $ref = [1];
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $ary = [1];
+    $ref = $ary;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump($ref);
+?>
+--EXPECT--
+Cannot assign array to reference held by property Test::$prop of type ?Type
+Cannot assign array to reference held by property Test::$prop of type ?Type
+NULL

Zend/tests/type_declarations/typed_properties_magic_set.phpt

@@ -5,12 +5,29 @@ __set() should not be invoked when setting an uninitialized typed property
 
 class Test {
     public int $foo;
+    public function __get($name) {
+        echo "__get ", $name, "\n";
+        return null;
+    }
     public function __set($name, $value) {
         echo "__set ", $name, " = ", $value, "\n";
     }
+    public function __isset($name) {
+        echo "__isset ", $name, "\n";
+        return true;
+    }
+    public function __unset($name) {
+        echo "__unset ", $name, "\n";
+    }
 }
 
 $test = new Test;
+try {
+    var_dump($test->foo);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump(isset($test->foo));
 $test->foo = 42;
 var_dump($test->foo);
 
@@ -44,6 +61,8 @@ $test->foo = 42;
 
 ?>
 --EXPECT--
+Typed property Test::$foo must not be accessed before initialization
+bool(false)
 int(42)
 __set foo = 42
 __set foo = 42

Zend/tests/type_declarations/typed_properties_protected_inheritance_mismatch.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Typed property invariance violation for protected properties
+--FILE--
+<?php
+
+class A { protected int $x; }
+class B extends A { protected $x; }
+
+?>
+--EXPECTF--
+Fatal error: Type of B::$x must be int (as in class A) in %s on line %d

Zend/zend.c

@@ -524,6 +524,8 @@ static void zend_set_default_compile_time_values(void) /* {{{ */
 	/* default compile-time values */
 	CG(short_tags) = short_tags_default;
 	CG(compiler_options) = compiler_options_default;
+
+	CG(rtd_key_counter) = 0;
 }
 /* }}} */
 

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.4.0-dev"
+#define ZEND_VERSION "3.4.0"
 
 #define ZEND_ENGINE_3
 

Zend/zend_API.c

@@ -29,6 +29,7 @@
 #include "zend_exceptions.h"
 #include "zend_closures.h"
 #include "zend_inheritance.h"
+#include "zend_ini.h"
 
 #include <stdarg.h>
 
@@ -2562,6 +2563,12 @@ void module_destructor(zend_module_entry *module) /* {{{ */
 		module->module_shutdown_func(module->type, module->module_number);
 	}
 
+	if (module->module_started
+	 && !module->module_shutdown_func
+	 && module->type == MODULE_TEMPORARY) {
+		zend_unregister_ini_entries(module->module_number);
+	}
+
 	/* Deinitilaise module globals */
 	if (module->globals_size) {
 #ifdef ZTS
@@ -2649,17 +2656,22 @@ ZEND_API void zend_post_deactivate_modules(void) /* {{{ */
 {
 	if (EG(full_tables_cleanup)) {
 		zend_module_entry *module;
+		zval *zv;
+		zend_string *key;
 
 		ZEND_HASH_FOREACH_PTR(&module_registry, module) {
 			if (module->post_deactivate_func) {
 				module->post_deactivate_func();
 			}
 		} ZEND_HASH_FOREACH_END();
-		ZEND_HASH_REVERSE_FOREACH_PTR(&module_registry, module) {
+		ZEND_HASH_REVERSE_FOREACH_STR_KEY_VAL(&module_registry, key, zv) {
+			module = Z_PTR_P(zv);
 			if (module->type != MODULE_TEMPORARY) {
 				break;
 			}
 			module_destructor(module);
+			free(module);
+			zend_string_release_ex(key, 0);
 		} ZEND_HASH_FOREACH_END_DEL();
 	} else {
 		zend_module_entry **p = module_post_deactivate_handlers;
@@ -2755,6 +2767,7 @@ ZEND_API zend_class_entry *zend_register_internal_interface(zend_class_entry *or
 ZEND_API int zend_register_class_alias_ex(const char *name, size_t name_len, zend_class_entry *ce, int persistent) /* {{{ */
 {
 	zend_string *lcname;
+	zval zv, *ret;
 
 	/* TODO: Move this out of here in 7.4. */
 	if (persistent && EG(current_module) && EG(current_module)->type == MODULE_TEMPORARY) {
@@ -2772,9 +2785,11 @@ ZEND_API int zend_register_class_alias_ex(const char *name, size_t name_len, zen
 	zend_assert_valid_class_name(lcname);
 
 	lcname = zend_new_interned_string(lcname);
-	ce = zend_hash_add_ptr(CG(class_table), lcname, ce);
+
+	ZVAL_ALIAS_PTR(&zv, ce);
+	ret = zend_hash_add(CG(class_table), lcname, &zv);
 	zend_string_release_ex(lcname, 0);
-	if (ce) {
+	if (ret) {
 		if (!(ce->ce_flags & ZEND_ACC_IMMUTABLE)) {
 			ce->refcount++;
 		}
@@ -3117,11 +3132,13 @@ static zend_always_inline int zend_is_callable_check_func(int check_flags, zval
 		     ((fcc->object && fcc->calling_scope->__call) ||
 		      (!fcc->object && fcc->calling_scope->__callstatic)))) {
 			scope = zend_get_executed_scope();
-			if (fcc->function_handler->common.scope != scope
-			 || !zend_check_protected(zend_get_function_root_class(fcc->function_handler), scope)) {
-				retval = 0;
-				fcc->function_handler = NULL;
-				goto get_function_via_handler;
+			if (fcc->function_handler->common.scope != scope) {
+				if ((fcc->function_handler->common.fn_flags & ZEND_ACC_PRIVATE)
+				 || !zend_check_protected(zend_get_function_root_class(fcc->function_handler), scope)) {
+					retval = 0;
+					fcc->function_handler = NULL;
+					goto get_function_via_handler;
+				}
 			}
 		}
 	} else {
@@ -3762,7 +3779,9 @@ ZEND_API int zend_declare_typed_property(zend_class_entry *ce, zend_string *name
 		}
 
 		/* Must be interned to avoid ZTS data races */
-		name = zend_new_interned_string(zend_string_copy(name));
+		if (is_persistent_class(ce)) {
+			name = zend_new_interned_string(zend_string_copy(name));
+		}
 	}
 
 	if (access_type & ZEND_ACC_PUBLIC) {
@@ -4206,6 +4225,12 @@ ZEND_API int zend_update_static_property_ex(zend_class_entry *scope, zend_string
 	zend_property_info *prop_info;
 	zend_class_entry *old_scope = EG(fake_scope);
 
+	if (UNEXPECTED(!(scope->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
+		if (UNEXPECTED(zend_update_class_constants(scope)) != SUCCESS) {
+			return FAILURE;
+		}
+	}
+
 	EG(fake_scope) = scope;
 	property = zend_std_get_static_property_with_info(scope, name, BP_VAR_W, &prop_info);
 	EG(fake_scope) = old_scope;

Zend/zend_ast.c

@@ -1557,7 +1557,7 @@ simple_list:
 			}
 			break;
 		case ZEND_AST_TYPE:
-			switch (ast->attr) {
+			switch (ast->attr & ~ZEND_TYPE_NULLABLE) {
 				case IS_ARRAY:    APPEND_STR("array");
 				case IS_CALLABLE: APPEND_STR("callable");
 				EMPTY_SWITCH_DEFAULT_CASE();

Zend/zend_builtin_functions.c

@@ -1476,7 +1476,7 @@ static inline void class_exists_impl(INTERNAL_FUNCTION_PARAMETERS, int flags, in
 	}
 
  	if (ce) {
-		RETURN_BOOL((flags == 0 || (ce->ce_flags & flags)) && !(ce->ce_flags & skip_flags));
+		RETURN_BOOL(((ce->ce_flags & flags) == flags) && !(ce->ce_flags & skip_flags));
 	} else {
 		RETURN_FALSE;
 	}
@@ -1487,7 +1487,7 @@ static inline void class_exists_impl(INTERNAL_FUNCTION_PARAMETERS, int flags, in
    Checks if the class exists */
 ZEND_FUNCTION(class_exists)
 {
-	class_exists_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0, ZEND_ACC_INTERFACE | ZEND_ACC_TRAIT);
+	class_exists_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, ZEND_ACC_LINKED, ZEND_ACC_INTERFACE | ZEND_ACC_TRAIT);
 }
 /* }}} */
 
@@ -1495,7 +1495,7 @@ ZEND_FUNCTION(class_exists)
    Checks if the class exists */
 ZEND_FUNCTION(interface_exists)
 {
-	class_exists_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, ZEND_ACC_INTERFACE, 0);
+	class_exists_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, ZEND_ACC_LINKED|ZEND_ACC_INTERFACE, 0);
 }
 /* }}} */
 

Zend/zend_closures.c

@@ -435,7 +435,7 @@ static ZEND_COLD zval *zend_closure_read_property(zval *object, zval *member, in
 static ZEND_COLD zval *zend_closure_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
 {
 	ZEND_CLOSURE_PROPERTY_ERROR();
-	return value;
+	return &EG(error_zval);
 }
 /* }}} */
 

Zend/zend_compile.c

@@ -122,21 +122,16 @@ static void zend_destroy_property_info_internal(zval *zv) /* {{{ */
 {
 	zend_property_info *property_info = Z_PTR_P(zv);
 
-	zend_string_release_ex(property_info->name, 1);
+	zend_string_release(property_info->name);
 	free(property_info);
 }
 /* }}} */
 
-static zend_string *zend_build_runtime_definition_key(zend_string *name, unsigned char *lex_pos) /* {{{ */
+static zend_string *zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno) /* {{{ */
 {
-	zend_string *result;
-	char char_pos_buf[32];
-	size_t char_pos_len = sprintf(char_pos_buf, "%p", lex_pos);
 	zend_string *filename = CG(active_op_array)->filename;
-
-	/* NULL, name length, filename length, last accepting char position length */
-	result = zend_string_alloc(1 + ZSTR_LEN(name) + ZSTR_LEN(filename) + char_pos_len, 0);
-	sprintf(ZSTR_VAL(result), "%c%s%s%s", '\0', ZSTR_VAL(name), ZSTR_VAL(filename), char_pos_buf);
+	zend_string *result = zend_strpprintf(0, "%c%s%s:%" PRIu32 "$%" PRIx32,
+		'\0', ZSTR_VAL(name), ZSTR_VAL(filename), start_lineno, CG(rtd_key_counter)++);
 	return zend_new_interned_string(result);
 }
 /* }}} */
@@ -1005,9 +1000,16 @@ ZEND_API void function_add_ref(zend_function *function) /* {{{ */
 				GC_ADDREF(op_array->static_variables);
 			}
 		}
-		ZEND_MAP_PTR_INIT(op_array->static_variables_ptr, &op_array->static_variables);
-		ZEND_MAP_PTR_INIT(op_array->run_time_cache, zend_arena_alloc(&CG(arena), sizeof(void*)));
-		ZEND_MAP_PTR_SET(op_array->run_time_cache, NULL);
+
+		if (CG(compiler_options) & ZEND_COMPILE_PRELOAD) {
+			ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_PRELOADED);
+			ZEND_MAP_PTR_NEW(op_array->run_time_cache);
+			ZEND_MAP_PTR_NEW(op_array->static_variables_ptr);
+		} else {
+			ZEND_MAP_PTR_INIT(op_array->static_variables_ptr, &op_array->static_variables);
+			ZEND_MAP_PTR_INIT(op_array->run_time_cache, zend_arena_alloc(&CG(arena), sizeof(void*)));
+			ZEND_MAP_PTR_SET(op_array->run_time_cache, NULL);
+		}
 	} else if (function->type == ZEND_INTERNAL_FUNCTION) {
 		if (function->common.function_name) {
 			zend_string_addref(function->common.function_name);
@@ -1068,8 +1070,12 @@ ZEND_API int do_bind_class(zval *lcname, zend_string *lc_parent_name) /* {{{ */
 
 	if (UNEXPECTED(!zv)) {
 		ce = zend_hash_find_ptr(EG(class_table), Z_STR_P(lcname));
-		ZEND_ASSERT(ce && "Class with lcname should be registered");
-		zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
+		if (ce) {
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
+		} else {
+			ZEND_ASSERT(EG(current_execute_data)->func->op_array.fn_flags & ZEND_ACC_PRELOADED);
+			zend_error_noreturn(E_ERROR, "Class %s wasn't preloaded", Z_STRVAL_P(lcname));
+		}
 		return FAILURE;
 	}
 
@@ -1082,6 +1088,8 @@ ZEND_API int do_bind_class(zval *lcname, zend_string *lc_parent_name) /* {{{ */
 	}
 
 	if (zend_do_link_class(ce, lc_parent_name) == FAILURE) {
+		/* Reload bucket pointer, the hash table may have been reallocated */
+		zv = zend_hash_find(EG(class_table), Z_STR_P(lcname));
 		zend_hash_set_bucket_key(EG(class_table), (Bucket *) zv, Z_STR_P(rtd_key));
 		return FAILURE;
 	}
@@ -2622,7 +2630,7 @@ static void zend_compile_list_assign(
 				continue;
 			}
 		}
-		
+
 		if (elem_ast->kind == ZEND_AST_UNPACK) {
 			zend_error(E_COMPILE_ERROR,
 					"Spread operator is not supported in assignments");
@@ -5611,7 +5619,7 @@ static void find_implicit_binds(closure_info *info, zend_ast *params_ast, zend_a
 	zend_ast_list *param_list = zend_ast_get_list(params_ast);
 	uint32_t i;
 
-	zend_hash_init(&info->uses, param_list->children, NULL, NULL, 0); 
+	zend_hash_init(&info->uses, param_list->children, NULL, NULL, 0);
 
 	find_implicit_binds_recursively(info, stmt_ast);
 
@@ -5911,8 +5919,11 @@ static void zend_begin_func_decl(znode *result, zend_op_array *op_array, zend_as
 		return;
 	}
 
-	key = zend_build_runtime_definition_key(lcname, decl->lex_pos);
-	zend_hash_update_ptr(CG(function_table), key, op_array);
+	key = zend_build_runtime_definition_key(lcname, decl->start_lineno);
+	if (!zend_hash_add_ptr(CG(function_table), key, op_array)) {
+		zend_error_noreturn(E_ERROR,
+			"Runtime definition key collision for function %s. This is a bug", ZSTR_VAL(name));
+	}
 
 	if (op_array->fn_flags & ZEND_ACC_CLOSURE) {
 		opline = zend_emit_op_tmp(result, ZEND_DECLARE_LAMBDA_FUNCTION, NULL, NULL);
@@ -6334,16 +6345,11 @@ void zend_compile_implements(zend_ast *ast) /* {{{ */
 }
 /* }}} */
 
-static zend_string *zend_generate_anon_class_name(unsigned char *lex_pos) /* {{{ */
+static zend_string *zend_generate_anon_class_name(uint32_t start_lineno) /* {{{ */
 {
-	zend_string *result;
-	char char_pos_buf[32];
-	size_t char_pos_len = sprintf(char_pos_buf, "%p", lex_pos);
 	zend_string *filename = CG(active_op_array)->filename;
-
-	/* NULL, name length, filename length, last accepting char position length */
-	result = zend_string_alloc(sizeof("class@anonymous") + ZSTR_LEN(filename) + char_pos_len, 0);
-	sprintf(ZSTR_VAL(result), "class@anonymous%c%s%s", '\0', ZSTR_VAL(filename), char_pos_buf);
+	zend_string *result = zend_strpprintf(0, "class@anonymous%c%s:%" PRIu32 "$%" PRIx32,
+		'\0', ZSTR_VAL(filename), start_lineno, CG(rtd_key_counter)++);
 	return zend_new_interned_string(result);
 }
 /* }}} */
@@ -6383,7 +6389,7 @@ zend_op *zend_compile_class_decl(zend_ast *ast, zend_bool toplevel) /* {{{ */
 
 		zend_register_seen_symbol(lcname, ZEND_SYMBOL_CLASS);
 	} else {
-		name = zend_generate_anon_class_name(decl->lex_pos);
+		name = zend_generate_anon_class_name(decl->start_lineno);
 		lcname = zend_string_tolower(name);
 	}
 	lcname = zend_new_interned_string(lcname);
@@ -6495,13 +6501,13 @@ zend_op *zend_compile_class_decl(zend_ast *ast, zend_bool toplevel) /* {{{ */
 
 	if (toplevel
 		/* We currently don't early-bind classes that implement interfaces or use traits */
-	 && !(ce->ce_flags & (ZEND_ACC_IMPLEMENT_INTERFACES|ZEND_ACC_IMPLEMENT_TRAITS))) {
+	 && !(ce->ce_flags & (ZEND_ACC_IMPLEMENT_INTERFACES|ZEND_ACC_IMPLEMENT_TRAITS))
+	 && !(CG(compiler_options) & ZEND_COMPILE_PRELOAD)) {
 		if (extends_ast) {
 			zend_class_entry *parent_ce = zend_lookup_class_ex(
 				ce->parent_name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
 
 			if (parent_ce
-			 && !(CG(compiler_options) & ZEND_COMPILE_PRELOAD) /* delay inheritance till preloading */
 			 && ((parent_ce->type != ZEND_INTERNAL_CLASS) || !(CG(compiler_options) & ZEND_COMPILE_IGNORE_INTERNAL_CLASSES))
 			 && ((parent_ce->type != ZEND_USER_CLASS) || !(CG(compiler_options) & ZEND_COMPILE_IGNORE_OTHER_FILES) || (parent_ce->info.user.filename == ce->info.user.filename))) {
 
@@ -6540,20 +6546,19 @@ zend_op *zend_compile_class_decl(zend_ast *ast, zend_bool toplevel) /* {{{ */
 		opline->extended_value = zend_alloc_cache_slot();
 		opline->result_type = IS_VAR;
 		opline->result.var = get_temporary_variable();
-
 		if (!zend_hash_add_ptr(CG(class_table), lcname, ce)) {
-			/* this anonymous class has been included */
-			zval zv;
-			ZVAL_PTR(&zv, ce);
-			destroy_zend_class(&zv);
-			return opline;
+			zend_error_noreturn(E_ERROR,
+				"Runtime definition key collision for %s. This is a bug", ZSTR_VAL(name));
 		}
 	} else {
-		zend_string *key = zend_build_runtime_definition_key(lcname, decl->lex_pos);
+		zend_string *key = zend_build_runtime_definition_key(lcname, decl->start_lineno);
 
 		/* RTD key is placed after lcname literal in op1 */
 		zend_add_literal_string(&key);
-		zend_hash_update_ptr(CG(class_table), key, ce);
+		if (!zend_hash_add_ptr(CG(class_table), key, ce)) {
+			zend_error_noreturn(E_ERROR,
+				"Runtime definition key collision for class %s. This is a bug", ZSTR_VAL(name));
+		}
 
 		opline->opcode = ZEND_DECLARE_CLASS;
 		if (extends_ast && toplevel
@@ -7072,7 +7077,7 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		if (elem_ast->kind != ZEND_AST_UNPACK) {
 			zend_eval_const_expr(&elem_ast->child[0]);
 			zend_eval_const_expr(&elem_ast->child[1]);
-			
+
 			if (elem_ast->attr /* by_ref */ || elem_ast->child[0]->kind != ZEND_AST_ZVAL
 				|| (elem_ast->child[1] && elem_ast->child[1]->kind != ZEND_AST_ZVAL)
 			) {
@@ -7080,7 +7085,7 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 			}
 		} else {
 			zend_eval_const_expr(&elem_ast->child[0]);
-			
+
 			if (elem_ast->child[0]->kind != ZEND_AST_ZVAL) {
 				is_constant = 0;
 			}
@@ -7121,13 +7126,13 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 					}
 					Z_TRY_ADDREF_P(val);
 				} ZEND_HASH_FOREACH_END();
-		
+
 				continue;
 			} else {
 				zend_error_noreturn(E_COMPILE_ERROR, "Only arrays and Traversables can be unpacked");
 			}
-		} 
-		
+		}
+
 		Z_TRY_ADDREF_P(value);
 
 		key_ast = elem_ast->child[1];
@@ -8778,25 +8783,28 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 		case ZEND_AST_AND:
 		case ZEND_AST_OR:
 		{
-			int i;
-			for (i = 0; i <= 1; i++) {
-				zend_eval_const_expr(&ast->child[i]);
-				if (ast->child[i]->kind == ZEND_AST_ZVAL) {
-					if (zend_is_true(zend_ast_get_zval(ast->child[i])) == (ast->kind == ZEND_AST_OR)) {
-						ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
-						return;
-					}
-				}
-			}
-
-			if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
+			zend_bool child0_is_true, child1_is_true;
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+			if (ast->child[0]->kind != ZEND_AST_ZVAL) {
 				return;
 			}
 
+			child0_is_true = zend_is_true(zend_ast_get_zval(ast->child[0]));
+			if (child0_is_true == (ast->kind == ZEND_AST_OR)) {
+				ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
+				break;
+			}
+
+			if (ast->child[1]->kind != ZEND_AST_ZVAL) {
+				return;
+			}
+
+			child1_is_true = zend_is_true(zend_ast_get_zval(ast->child[1]));
 			if (ast->kind == ZEND_AST_OR) {
-				ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) || zend_is_true(zend_ast_get_zval(ast->child[1])));
+				ZVAL_BOOL(&result, child0_is_true || child1_is_true);
 			} else {
-				ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) && zend_is_true(zend_ast_get_zval(ast->child[1])));
+				ZVAL_BOOL(&result, child0_is_true && child1_is_true);
 			}
 			break;
 		}

Zend/zend_execute.c

@@ -596,9 +596,6 @@ static zend_never_inline ZEND_COLD int zend_wrong_assign_to_variable_reference(z
 	Z_TRY_ADDREF_P(value_ptr);
 	value_ptr = zend_assign_to_variable(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES());
 
-	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-		ZVAL_COPY(EX_VAR(opline->result.var), value_ptr);
-	}
 	return 1;
 }
 
@@ -2372,7 +2369,7 @@ try_string_offset:
 			offset = Z_LVAL_P(dim);
 		}
 
-		if (UNEXPECTED(Z_STRLEN_P(container) < (size_t)((offset < 0) ? -offset : (offset + 1)))) {
+		if (UNEXPECTED(Z_STRLEN_P(container) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
 			if (type != BP_VAR_IS) {
 				zend_error(E_NOTICE, "Uninitialized string offset: " ZEND_LONG_FMT, offset);
 				ZVAL_EMPTY_STRING(result);
@@ -3187,7 +3184,9 @@ ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *value, zend_uc
 		Z_TRY_DELREF_P(value);
 	}
 	if (!ret) {
-		zval_ptr_dtor(value);
+		if (value_type & (IS_VAR|IS_TMP_VAR)) {
+			zval_ptr_dtor(value);
+		}
 		return Z_REFVAL_P(variable_ptr);
 	}
 
@@ -3606,6 +3605,13 @@ ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name,
 	return NULL;
 } /* }}} */
 
+ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
+{
+	if (!RUN_TIME_CACHE(op_array)) {
+		init_func_run_time_cache_i(op_array);
+	}
+} /* }}} */
+
 static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
 {
 	ZEND_ASSERT(EX(func) == (zend_function*)op_array);
@@ -4186,6 +4192,8 @@ static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval
 					if (zend_hash_exists(&EG(included_files), resolved_path)) {
 						goto already_compiled;
 					}
+				} else if (UNEXPECTED(EG(exception))) {
+					break;
 				} else if (UNEXPECTED(strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename))) {
 					zend_message_dispatcher(
 						(type == ZEND_INCLUDE_ONCE) ?

Zend/zend_execute.h

@@ -311,6 +311,7 @@ ZEND_API zend_class_entry *zend_fetch_class_by_name(zend_string *class_name, zen
 
 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function(zend_string *name);
 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name, size_t len);
+ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array);
 
 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type);
 

Zend/zend_execute_API.c

@@ -890,6 +890,7 @@ ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, zend_string *
 	zend_string *lc_name;
 	zend_fcall_info fcall_info;
 	zend_fcall_info_cache fcall_cache;
+	zend_class_entry *orig_fake_scope;
 
 	if (key) {
 		lc_name = key;
@@ -986,11 +987,14 @@ ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, zend_string *
 	fcall_cache.called_scope = NULL;
 	fcall_cache.object = NULL;
 
+	orig_fake_scope = EG(fake_scope);
+	EG(fake_scope) = NULL;
 	zend_exception_save();
 	if ((zend_call_function(&fcall_info, &fcall_cache) == SUCCESS) && !EG(exception)) {
 		ce = zend_hash_find_ptr(EG(class_table), lc_name);
 	}
 	zend_exception_restore();
+	EG(fake_scope) = orig_fake_scope;
 
 	zval_ptr_dtor(&args[0]);
 	zval_ptr_dtor_str(&fcall_info.function_name);

Zend/zend_gc.c

@@ -1547,11 +1547,11 @@ ZEND_API int zend_gc_collect_cycles(void)
 			}
 		}
 
-		/* Destroy zvals */
+		/* Destroy zvals. The root buffer may be reallocated. */
 		GC_TRACE("Destroying zvals");
-		current = GC_IDX2PTR(GC_FIRST_ROOT);
-		last = GC_IDX2PTR(GC_G(first_unused));
-		while (current != last) {
+		idx = GC_FIRST_ROOT;
+		while (idx != end) {
+			current = GC_IDX2PTR(idx);
 			if (GC_IS_GARBAGE(current->ref)) {
 				p = GC_GET_PTR(current->ref);
 				GC_TRACE_REF(p, "destroying");
@@ -1561,6 +1561,8 @@ ZEND_API int zend_gc_collect_cycles(void)
 					EG(objects_store).object_buckets[obj->handle] = SET_OBJ_INVALID(obj);
 					GC_TYPE_INFO(obj) = IS_NULL |
 						(GC_TYPE_INFO(obj) & ~GC_TYPE_MASK);
+					/* Modify current before calling free_obj (bug #78811: free_obj() can cause the root buffer (with current) to be reallocated.) */
+					current->ref = GC_MAKE_GARBAGE(((char*)obj) - obj->handlers->offset);
 					if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
 						GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
 						GC_ADDREF(obj);
@@ -1569,7 +1571,6 @@ ZEND_API int zend_gc_collect_cycles(void)
 					}
 
 					ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(obj->handle);
-					current->ref = GC_MAKE_GARBAGE(((char*)obj) - obj->handlers->offset);
 				} else if (GC_TYPE(p) == IS_ARRAY) {
 					zend_array *arr = (zend_array*)p;
 
@@ -1582,11 +1583,12 @@ ZEND_API int zend_gc_collect_cycles(void)
 					zend_hash_destroy(arr);
 				}
 			}
-			current++;
+			idx++;
 		}
 
 		/* Free objects */
 		current = GC_IDX2PTR(GC_FIRST_ROOT);
+		last = GC_IDX2PTR(end);
 		while (current != last) {
 			if (GC_IS_GARBAGE(current->ref)) {
 				p = GC_GET_PTR(current->ref);

Zend/zend_generators.c

@@ -95,9 +95,10 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 static void zend_generator_cleanup_unfinished_execution(
 		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
 {
-	if (execute_data->opline != execute_data->func->op_array.opcodes) {
+	zend_op_array *op_array = &execute_data->func->op_array;
+	if (execute_data->opline != op_array->opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
-		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;
+		uint32_t op_num = execute_data->opline - op_array->opcodes - 1;
 
 		if (UNEXPECTED(generator->frozen_call_stack)) {
 			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
@@ -106,6 +107,7 @@ static void zend_generator_cleanup_unfinished_execution(
 			zend_generator_restore_call_stack(generator);
 			generator->execute_data = save_ex;
 		}
+
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
 }
@@ -166,7 +168,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 {
 	zend_generator *generator = (zend_generator*) object;
 	zend_execute_data *ex = generator->execute_data;
-	uint32_t op_num, finally_op_num, finally_op_end;
+	uint32_t op_num, try_catch_offset;
 	int i;
 
 	/* leave yield from mode to properly allow finally execution */
@@ -194,38 +196,57 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	/* -1 required because we want the last run opcode, not the
 	 * next to-be-run one. */
 	op_num = ex->opline - ex->func->op_array.opcodes - 1;
+	try_catch_offset = -1;
 
-	/* Find next finally block */
-	finally_op_num = 0;
-	finally_op_end = 0;
+	/* Find the innermost try/catch that we are inside of. */
 	for (i = 0; i < ex->func->op_array.last_try_catch; i++) {
 		zend_try_catch_element *try_catch = &ex->func->op_array.try_catch_array[i];
-
 		if (op_num < try_catch->try_op) {
 			break;
 		}
-
-		if (op_num < try_catch->finally_op) {
-			finally_op_num = try_catch->finally_op;
-			finally_op_end = try_catch->finally_end;
+		if (op_num < try_catch->catch_op || op_num < try_catch->finally_end) {
+			try_catch_offset = i;
 		}
 	}
 
-	/* If a finally block was found we jump directly to it and
-	 * resume the generator. */
-	if (finally_op_num) {
-		zval *fast_call;
+	/* Walk try/catch/finally structures upwards, performing the necessary actions. */
+	while (try_catch_offset != (uint32_t) -1) {
+		zend_try_catch_element *try_catch = &ex->func->op_array.try_catch_array[try_catch_offset];
 
-		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);
+		if (op_num < try_catch->finally_op) {
+			/* Go to finally block */
+			zval *fast_call =
+				ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[try_catch->finally_end].op1.var);
 
-		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
-		Z_OBJ_P(fast_call) = EG(exception);
-		EG(exception) = NULL;
-		Z_OPLINE_NUM_P(fast_call) = (uint32_t)-1;
+			zend_generator_cleanup_unfinished_execution(generator, ex, try_catch->finally_op);
+			Z_OBJ_P(fast_call) = EG(exception);
+			EG(exception) = NULL;
+			Z_OPLINE_NUM_P(fast_call) = (uint32_t)-1;
 
-		ex->opline = &ex->func->op_array.opcodes[finally_op_num];
-		generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
-		zend_generator_resume(generator);
+			ex->opline = &ex->func->op_array.opcodes[try_catch->finally_op];
+			generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
+			zend_generator_resume(generator);
+
+			/* TODO: If we hit another yield inside try/finally,
+			 * should we also jump to the next finally block? */
+			return;
+		} else if (op_num < try_catch->finally_end) {
+			zval *fast_call =
+				ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[try_catch->finally_end].op1.var);
+			/* Clean up incomplete return statement */
+			if (Z_OPLINE_NUM_P(fast_call) != (uint32_t) -1) {
+				zend_op *retval_op = &ex->func->op_array.opcodes[Z_OPLINE_NUM_P(fast_call)];
+				if (retval_op->op2_type & (IS_TMP_VAR | IS_VAR)) {
+					zval_ptr_dtor(ZEND_CALL_VAR(ex, retval_op->op2.var));
+				}
+			}
+			/* Clean up backed-up exception */
+			if (Z_OBJ_P(fast_call)) {
+				OBJ_RELEASE(Z_OBJ_P(fast_call));
+			}
+		}
+
+		try_catch_offset--;
 	}
 }
 /* }}} */
@@ -824,9 +845,10 @@ try_again:
 		if (UNEXPECTED(EG(exception) != NULL)) {
 			if (generator == orig_generator) {
 				zend_generator_close(generator, 0);
-				if (EG(current_execute_data) &&
-				    EG(current_execute_data)->func &&
-				    ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
+				if (!EG(current_execute_data)) {
+					zend_throw_exception_internal(NULL);
+				} else if (EG(current_execute_data)->func &&
+						ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
 					zend_rethrow_exception(EG(current_execute_data));
 				}
 			} else {

Zend/zend_globals.h

@@ -127,6 +127,8 @@ struct _zend_compiler_globals {
 
 	HashTable *delayed_variance_obligations;
 	HashTable *delayed_autoloads;
+
+	uint32_t rtd_key_counter;
 };
 
 

Zend/zend_inheritance.c

@@ -812,7 +812,7 @@ static zend_always_inline inheritance_status do_inheritance_check_on_method_ex(z
 		parent = proto;
 	}
 
-	if (!check_only && child_zv && child->common.prototype != proto) {
+	if (!check_only && child->common.prototype != proto) {
 		do {
 			if (child->common.scope != ce
 			 && child->type == ZEND_USER_FUNCTION
@@ -820,7 +820,7 @@ static zend_always_inline inheritance_status do_inheritance_check_on_method_ex(z
 				if (ce->ce_flags & ZEND_ACC_INTERFACE) {
 					/* Few parent interfaces contain the same method */
 					break;
-				} else {
+				} else if (child_zv) {
 					/* op_array wasn't duplicated yet */
 					zend_function *new_function = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
 					memcpy(new_function, child, sizeof(zend_op_array));
@@ -936,7 +936,7 @@ static void emit_incompatible_property_error(
 	zend_error_noreturn(E_COMPILE_ERROR,
 		"Type of %s::$%s must be %s%s (as in class %s)",
 		ZSTR_VAL(child->ce->name),
-		ZSTR_VAL(child->name),
+		zend_get_unmangled_property_name(child->name),
 		ZEND_TYPE_ALLOW_NULL(parent->type) ? "?" : "",
 		ZEND_TYPE_IS_CLASS(parent->type)
 			? ZSTR_VAL(ZEND_TYPE_IS_CE(parent->type) ? ZEND_TYPE_CE(parent->type)->name : resolve_class_name(parent->ce, ZEND_TYPE_NAME(parent->type)))
@@ -1585,17 +1585,14 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
 			}
 			zend_hash_update_mem(*overridden, key, fn, sizeof(zend_function));
 			return;
-		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT &&
-				(existing_fn->common.scope->ce_flags & ZEND_ACC_INTERFACE) == 0) {
-			/* Make sure the trait method is compatible with previosly declared abstract method */
-			perform_delayable_implementation_check(
-				ce, fn, existing_fn, /*always_error*/ 1);
-		} else if (fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
+		} else if ((fn->common.fn_flags & ZEND_ACC_ABSTRACT)
+				&& !(existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT)) {
 			/* Make sure the abstract declaration is compatible with previous declaration */
 			perform_delayable_implementation_check(
 				ce, existing_fn, fn, /*always_error*/ 1);
 			return;
-		} else if (UNEXPECTED(existing_fn->common.scope->ce_flags & ZEND_ACC_TRAIT)) {
+		} else if (UNEXPECTED((existing_fn->common.scope->ce_flags & ZEND_ACC_TRAIT)
+				&& !(existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT))) {
 			/* two traits can't define the same non-abstract method */
 #if 1
 			zend_error_noreturn(E_COMPILE_ERROR, "Trait method %s has not been applied, because there are collisions with other trait methods on %s",

Zend/zend_ini_parser.y

@@ -310,7 +310,7 @@ static void zval_ini_dtor(zval *zv)
 %left '|' '&' '^'
 %right '~' '!'
 
-%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL
+%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL cfg_var_ref constant_literal constant_string encapsed_list expr option_offset section_string_or_value string_or_value var_string_list var_string_list_section
 
 %%
 

Zend/zend_language_scanner.l

@@ -637,11 +637,13 @@ ZEND_API zend_op_array *compile_file(zend_file_handle *file_handle, int type)
 	zend_save_lexical_state(&original_lex_state);
 
 	if (open_file_for_scanning(file_handle)==FAILURE) {
-		if (type==ZEND_REQUIRE) {
-			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename);
-			zend_bailout();
-		} else {
-			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename);
+		if (!EG(exception)) {
+			if (type==ZEND_REQUIRE) {
+				zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename);
+				zend_bailout();
+			} else {
+				zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename);
+			}
 		}
 	} else {
 		op_array = zend_compile(ZEND_USER_FUNCTION);

Zend/zend_object_handlers.c

@@ -679,6 +679,10 @@ ZEND_API zval *zend_std_read_property(zval *object, zval *member, int type, void
 		if (EXPECTED(Z_TYPE_P(retval) != IS_UNDEF)) {
 			goto exit;
 		}
+		if (UNEXPECTED(Z_PROP_FLAG_P(retval) == IS_PROP_UNINIT)) {
+			/* Skip __get() for uninitialized typed properties */
+			goto uninit_error;
+		}
 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
 		if (EXPECTED(zobj->properties != NULL)) {
 			if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
@@ -782,6 +786,7 @@ call_getter:
 		}
 	}
 
+uninit_error:
 	if (type != BP_VAR_IS) {
 		if (UNEXPECTED(prop_info)) {
 			zend_throw_error(NULL, "Typed property %s::$%s must not be accessed before initialization",
@@ -1044,8 +1049,16 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zval *object, zval *member, int typ
 			if (EXPECTED(!zobj->ce->__get) ||
 			    UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
 				if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
-					ZVAL_NULL(retval);
-					zend_error(E_NOTICE, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
+					if (UNEXPECTED(prop_info)) {
+						zend_throw_error(NULL,
+							"Typed property %s::$%s must not be accessed before initialization",
+							ZSTR_VAL(prop_info->ce->name),
+							ZSTR_VAL(name));
+						retval = &EG(error_zval);
+					} else {
+						ZVAL_NULL(retval);
+						zend_error(E_NOTICE, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
+					}
 				}
 			} else {
 				/* we do have getter - fail and let it try again with usual get/set */
@@ -1118,8 +1131,11 @@ ZEND_API void zend_std_unset_property(zval *object, zval *member, void **cache_s
 			}
 			goto exit;
 		}
-		/* Reset the IS_PROP_UNINIT flag, if it exists. */
-		Z_PROP_FLAG_P(slot) = 0;
+		if (UNEXPECTED(Z_PROP_FLAG_P(slot) == IS_PROP_UNINIT)) {
+			/* Reset the IS_PROP_UNINIT flag, if it exists and bypass __unset(). */
+			Z_PROP_FLAG_P(slot) = 0;
+			goto exit;
+		}
 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))
 	 && EXPECTED(zobj->properties != NULL)) {
 		if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
@@ -1678,6 +1694,11 @@ ZEND_API int zend_std_has_property(zval *object, zval *member, int has_set_exist
 		if (Z_TYPE_P(value) != IS_UNDEF) {
 			goto found;
 		}
+		if (UNEXPECTED(Z_PROP_FLAG_P(value) == IS_PROP_UNINIT)) {
+			/* Skip __isset() for uninitialized typed properties */
+			result = 0;
+			goto exit;
+		}
 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
 		if (EXPECTED(zobj->properties != NULL)) {
 			if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {

Zend/zend_operators.h

@@ -35,7 +35,7 @@
 #include "zend_multiply.h"
 #include "zend_object_handlers.h"
 
-#define LONG_SIGN_MASK (((zend_long)1) << (8*sizeof(zend_long)-1))
+#define LONG_SIGN_MASK ZEND_LONG_MIN
 
 BEGIN_EXTERN_C()
 ZEND_API int ZEND_FASTCALL add_function(zval *result, zval *op1, zval *op2);

Zend/zend_types.h

@@ -427,6 +427,7 @@ struct _zend_ast_ref {
 /* internal types */
 #define IS_INDIRECT             	13
 #define IS_PTR						14
+#define IS_ALIAS_PTR				15
 #define _IS_ERROR					15
 
 /* fake types used only for type hinting (Z_TYPE(zv) can not use them) */
@@ -964,6 +965,11 @@ static zend_always_inline uint32_t zval_gc_info(uint32_t gc_type_info) {
 		Z_TYPE_INFO_P(z) = IS_PTR;								\
 	} while (0)
 
+#define ZVAL_ALIAS_PTR(z, p) do {								\
+		Z_PTR_P(z) = (p);										\
+		Z_TYPE_INFO_P(z) = IS_ALIAS_PTR;						\
+	} while (0)
+
 #define ZVAL_ERROR(z) do {				\
 		Z_TYPE_INFO_P(z) = _IS_ERROR;	\
 	} while (0)

Zend/zend_vm_def.h

@@ -1018,8 +1018,10 @@ ZEND_VM_COLD_CONST_HANDLER(14, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			ZVAL_UNDEFINED_OP1();
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2493,6 +2495,9 @@ ZEND_VM_C_LABEL(assign_object):
 				} else {
 ZEND_VM_C_LABEL(fast_assign_obj):
 					value = zend_assign_to_variable(property_val, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
+					if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+						ZVAL_COPY(EX_VAR(opline->result.var), value);
+					}
 					ZEND_VM_C_GOTO(exit_assign_obj);
 				}
 			}
@@ -2540,6 +2545,9 @@ ZEND_VM_C_LABEL(fast_assign_obj):
 					}
 				}
 				zend_hash_add_new(zobj->properties, Z_STR_P(property), value);
+				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+					ZVAL_COPY(EX_VAR(opline->result.var), value);
+				}
 				ZEND_VM_C_GOTO(exit_assign_obj);
 			}
 		}
@@ -2552,11 +2560,11 @@ ZEND_VM_C_LABEL(fast_assign_obj):
 	value = Z_OBJ_HT_P(object)->write_property(object, property, value, (OP2_TYPE == IS_CONST) ? CACHE_ADDR(opline->extended_value) : NULL);
 
 ZEND_VM_C_LABEL(free_and_exit_assign_obj):
-	FREE_OP_DATA();
-ZEND_VM_C_LABEL(exit_assign_obj):
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
 		ZVAL_COPY(EX_VAR(opline->result.var), value);
 	}
+	FREE_OP_DATA();
+ZEND_VM_C_LABEL(exit_assign_obj):
 	FREE_OP2();
 	FREE_OP1_VAR_PTR();
 	/* assign_obj has two opcodes! */
@@ -2865,6 +2873,7 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 {
 	zend_execute_data *old_execute_data;
 	uint32_t call_info = EX_CALL_INFO();
+	SAVE_OPLINE();
 
 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
 		i_free_compiled_variables(execute_data);
@@ -3813,11 +3822,11 @@ ZEND_VM_C_LABEL(try_function_name):
 		call = NULL;
 	}
 
+	FREE_OP2();
 	if (UNEXPECTED(!call)) {
 		HANDLE_EXCEPTION();
 	}
 
-	FREE_OP2();
 	if (OP2_TYPE & (IS_VAR|IS_TMP_VAR)) {
 		if (UNEXPECTED(EG(exception))) {
 			if (call) {
@@ -3829,8 +3838,6 @@ ZEND_VM_C_LABEL(try_function_name):
 			}
 			HANDLE_EXCEPTION();
 		}
-	} else if (UNEXPECTED(!call)) {
-		HANDLE_EXCEPTION();
 	}
 
 	call->prev_execute_data = EX(call);
@@ -4327,7 +4334,11 @@ ZEND_VM_INLINE_HANDLER(62, ZEND_RETURN, CONST|TMP|VAR|CV, ANY)
 				if (Z_OPT_REFCOUNTED_P(retval_ptr)) {
 					if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 						if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+							zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
 							ZVAL_COPY_VALUE(return_value, retval_ptr);
+							if (GC_MAY_LEAK(ref)) {
+								gc_possible_root(ref);
+							}
 							ZVAL_NULL(retval_ptr);
 							break;
 						} else {
@@ -5319,8 +5330,10 @@ ZEND_VM_COLD_CONST_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			ZVAL_UNDEFINED_OP1();
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -7280,6 +7293,8 @@ ZEND_VM_HANDLER(145, ZEND_DECLARE_CLASS_DELAYED, CONST, CONST)
 				zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
 			} else {
 				if (zend_do_link_class(ce, Z_STR_P(RT_CONSTANT(opline, opline->op2))) == FAILURE) {
+					/* Reload bucket pointer, the hash table may have been reallocated */
+					zv = zend_hash_find(EG(class_table), Z_STR_P(lcname));
 					zend_hash_set_bucket_key(EG(class_table), (Bucket *) zv, Z_STR_P(lcname + 1));
 					HANDLE_EXCEPTION();
 				}
@@ -7300,12 +7315,16 @@ ZEND_VM_HANDLER(146, ZEND_DECLARE_ANON_CLASS, ANY, ANY, CACHE_SLOT)
 	if (UNEXPECTED(ce == NULL)) {
 		zend_string *rtd_key = Z_STR_P(RT_CONSTANT(opline, opline->op1));
 		zv = zend_hash_find_ex(EG(class_table), rtd_key, 1);
+		if (UNEXPECTED(zv == NULL)) {
+			SAVE_OPLINE();
+			ZEND_ASSERT(EX(func)->op_array.fn_flags & ZEND_ACC_PRELOADED);
+			zend_error_noreturn(E_ERROR, "Anonymous class wasn't preloaded");
+		}
 		ZEND_ASSERT(zv != NULL);
 		ce = Z_CE_P(zv);
 		if (!(ce->ce_flags & ZEND_ACC_LINKED)) {
 			SAVE_OPLINE();
 			if (zend_do_link_class(ce, (OP2_TYPE == IS_CONST) ? Z_STR_P(RT_CONSTANT(opline, opline->op2)) : NULL) == FAILURE) {
-				zend_hash_set_bucket_key(EG(class_table), (Bucket *) zv, rtd_key);
 				HANDLE_EXCEPTION();
 			}
 		}

configure.ac

@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
 dnl ----------------------------------------------------------------------------
 
 AC_PREREQ([2.68])
-AC_INIT([PHP],[7.4.0-dev],[https://bugs.php.net],[php],[https://www.php.net])
+AC_INIT([PHP],[7.4.2],[https://bugs.php.net],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER

ext/bcmath/libbcmath/src/str2num.c

@@ -56,9 +56,9 @@ bc_str2num (bc_num *num, char *str, int scale)
   zero_int = FALSE;
   if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
   while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
   if (*ptr == '.') ptr++;			/* decimal point */
-  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
   if ((*ptr != '\0') || (digits+strscale == 0))
     {
       *num = bc_copy_num (BCG(_zero_));

ext/bcmath/tests/bug78878.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #78878 (Buffer underflow in bc_shift_addsub)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
+?>
+--EXPECT--
+0

ext/curl/config.m4

@@ -23,14 +23,10 @@ if test "$PHP_CURL" != "no"; then
   esac
 
   if test "$CURL_SSL" = yes; then
-    AC_DEFINE([HAVE_CURL_SSL], [1], [Have cURL with  SSL support])
-
-    save_CFLAGS="$CFLAGS"
-    CFLAGS="$CFLAGS $CURL_CFLAGS"
     save_LDFLAGS="$LDFLAGS"
     LDFLAGS="$LDFLAGS $CURL_LIBS"
 
-    AC_MSG_CHECKING([for openssl support in libcurl])
+    AC_MSG_CHECKING([for libcurl linked against old openssl])
     AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <strings.h>
 #include <curl/curl.h>
@@ -43,21 +39,34 @@ int main(int argc, char *argv[])
     const char *ptr = data->ssl_version;
 
     while(*ptr == ' ') ++ptr;
-    return strncasecmp(ptr, "OpenSSL", sizeof("OpenSSL")-1);
+    if (strncasecmp(ptr, "OpenSSL/1.1", sizeof("OpenSSL/1.1")-1) == 0) {
+      /* New OpenSSL version */
+      return 3;
+    }
+    if (strncasecmp(ptr, "OpenSSL", sizeof("OpenSSL")-1) == 0) {
+      /* Old OpenSSL version */
+      return 0;
+    }
+    /* Different SSL library */
+    return 2;
   }
+  /* No SSL support */
   return 1;
 }
     ]])],[
       AC_MSG_RESULT([yes])
-      AC_DEFINE([HAVE_CURL_OPENSSL], [1], [Have cURL with OpenSSL support])
-      AC_CHECK_HEADERS([openssl/crypto.h])
+      AC_DEFINE([HAVE_CURL_OLD_OPENSSL], [1], [Have cURL with old OpenSSL])
+      PKG_CHECK_MODULES([OPENSSL], [openssl], [
+        PHP_EVAL_LIBLINE($OPENSSL_LIBS, CURL_SHARED_LIBADD)
+        PHP_EVAL_INCLINE($OPENSSL_CFLAGS)
+        AC_CHECK_HEADERS([openssl/crypto.h])
+      ], [])
     ], [
       AC_MSG_RESULT([no])
     ], [
       AC_MSG_RESULT([no])
     ])
 
-    CFLAGS="$save_CFLAGS"
     LDFLAGS="$save_LDFLAGS"
   else
     AC_MSG_RESULT([no])

ext/curl/config.w32

@@ -28,7 +28,6 @@ if (PHP_CURL != "no") {
 		) {
 		EXTENSION("curl", "interface.c multi.c share.c curl_file.c");
 		AC_DEFINE('HAVE_CURL', 1, 'Have cURL library');
-		AC_DEFINE('HAVE_CURL_SSL', 1, 'Have SSL suppurt in cURL');
 		ADD_FLAG("CFLAGS_CURL", "/D CURL_STATICLIB");
 		// TODO: check for curl_version_info
 	} else {

ext/curl/interface.c

@@ -43,22 +43,17 @@
 #endif
 
 /* {{{ cruft for thread safe SSL crypto locks */
-#if defined(ZTS) && defined(HAVE_CURL_SSL)
-# ifdef PHP_WIN32
+#if defined(ZTS) && defined(HAVE_CURL_OLD_OPENSSL)
+# if defined(HAVE_OPENSSL_CRYPTO_H)
 #  define PHP_CURL_NEED_OPENSSL_TSL
 #  include <openssl/crypto.h>
-# elif defined(HAVE_CURL_OPENSSL)
-#  if defined(HAVE_OPENSSL_CRYPTO_H)
-#   define PHP_CURL_NEED_OPENSSL_TSL
-#   include <openssl/crypto.h>
-#  else
-#   warning \
+# else
+#  warning \
 	"libcurl was compiled with OpenSSL support, but configure could not find " \
 	"openssl/crypto.h; thus no SSL crypto locking callbacks will be set, which may " \
 	"cause random crashes on SSL requests"
-#  endif
-# endif /* HAVE_CURL_OPENSSL */
-#endif /* ZTS && HAVE_CURL_SSL */
+# endif
+#endif /* ZTS && HAVE_CURL_OLD_OPENSSL */
 /* }}} */
 
 #define SMART_STR_PREALLOC 4096
@@ -2754,7 +2749,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				zend_string *string_key;
 				zend_ulong  num_key;
 #if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
-				curl_mime *mime;
+				curl_mime *mime = NULL;
 				curl_mimepart *part;
 				CURLcode form_error;
 #else
@@ -2769,9 +2764,11 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				}
 
 #if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
-				mime = curl_mime_init(ch->cp);
-				if (mime == NULL) {
-					return FAILURE;
+				if (zend_hash_num_elements(postfields) > 0) {
+					mime = curl_mime_init(ch->cp);
+					if (mime == NULL) {
+						return FAILURE;
+					}
 				}
 #endif
 

ext/curl/tests/bug78775.phpt

@@ -3,6 +3,7 @@ Bug #78775: TLS issues from HTTP request affecting other encrypted connections
 --SKIPIF--
 <?php
 if (!extension_loaded('curl')) die('skip Requires curl');
+if (!extension_loaded('openssl')) die('skip Requires openssl');
 if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
 ?>
 --FILE--

ext/curl/tests/bug79033.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #79033 (Curl timeout error with specific url and post)
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+include 'server.inc';
+$host = curl_cli_server_start();
+$ch = curl_init();
+curl_setopt_array($ch, [
+	CURLOPT_URL => "{$host}/get.inc?test=post",
+	CURLOPT_POST => true,
+    CURLOPT_POSTFIELDS => [],
+    CURLINFO_HEADER_OUT => true,
+	CURLOPT_RETURNTRANSFER => true,
+]);
+var_dump(curl_exec($ch));
+var_dump(curl_getinfo($ch)["request_header"]);
+?>
+--EXPECTF--
+string(%d) "array(0) {
+}
+"
+string(90) "POST /get.inc?test=post HTTP/1.1
+Host: localhost:%d
+Accept: */*
+Content-Length: 0
+
+"

ext/date/php_date.c

@@ -4426,14 +4426,16 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("h", h, timelib_sll, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("i", i, timelib_sll, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("s", s, timelib_sll, -1)
-	do {
+	{
 		zval *z_arg = zend_hash_str_find(myht, "f", sizeof("f") - 1);
+		(*intobj)->diff->us = -1000000;
 		if (z_arg) {
-			(*intobj)->diff->us = ((double)zval_get_double(z_arg) * 1000000);
-		} else {
-			(*intobj)->diff->us = (double) -1000000;
+			double val = zval_get_double(z_arg) * 1000000;
+			if (val >= 0 && val < 1000000) {
+				(*intobj)->diff->us = val;
+			}
 		}
-	} while (0);
+	}
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday", weekday, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)

ext/date/tests/DateTime_verify.phpt

@@ -1,208 +0,0 @@
---TEST--
-Test DateTime class registration
---FILE--
-<?php
-
-echo "*** Verify DateTime class ***\n";
-
-echo "Verify DateTime class registered OK\n";
-$class = new ReflectionClass('DateTime');
-var_dump($class);
-
-echo "..and get names of all its methods\n";
-$methods = $class->getMethods();
-var_dump($methods);
-
-echo "..and get names of all its class constants\n";
-$constants = $class->getConstants();
-var_dump($constants);
-
-echo "..and get __set_state arguments\n";
-$method = new ReflectionMethod('DateTime', '__set_state');
-var_dump($method->getParameters());
-var_dump($method->getParameters()[0]->isOptional());
-
-?>
-===DONE===
---EXPECTF--
-*** Verify DateTime class ***
-Verify DateTime class registered OK
-object(ReflectionClass)#%d (1) {
-  ["name"]=>
-  string(8) "DateTime"
-}
-..and get names of all its methods
-array(19) {
-  [0]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(11) "__construct"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [1]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(8) "__wakeup"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [2]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(11) "__set_state"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [3]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(19) "createFromImmutable"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [4]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(16) "createFromFormat"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [5]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(13) "getLastErrors"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [6]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(6) "format"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [7]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(6) "modify"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [8]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(3) "add"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [9]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(3) "sub"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [10]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(11) "getTimezone"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [11]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(11) "setTimezone"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [12]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(9) "getOffset"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [13]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(7) "setTime"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [14]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(7) "setDate"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [15]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(10) "setISODate"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [16]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(12) "setTimestamp"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [17]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(12) "getTimestamp"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [18]=>
-  object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(4) "diff"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-}
-..and get names of all its class constants
-array(13) {
-  ["ATOM"]=>
-  string(13) "Y-m-d\TH:i:sP"
-  ["COOKIE"]=>
-  string(16) "l, d-M-Y H:i:s T"
-  ["ISO8601"]=>
-  string(13) "Y-m-d\TH:i:sO"
-  ["RFC822"]=>
-  string(16) "D, d M y H:i:s O"
-  ["RFC850"]=>
-  string(16) "l, d-M-y H:i:s T"
-  ["RFC1036"]=>
-  string(16) "D, d M y H:i:s O"
-  ["RFC1123"]=>
-  string(16) "D, d M Y H:i:s O"
-  ["RFC7231"]=>
-  string(21) "D, d M Y H:i:s \G\M\T"
-  ["RFC2822"]=>
-  string(16) "D, d M Y H:i:s O"
-  ["RFC3339"]=>
-  string(13) "Y-m-d\TH:i:sP"
-  ["RFC3339_EXTENDED"]=>
-  string(15) "Y-m-d\TH:i:s.vP"
-  ["RSS"]=>
-  string(16) "D, d M Y H:i:s O"
-  ["W3C"]=>
-  string(13) "Y-m-d\TH:i:sP"
-}
-..and get __set_state arguments
-array(1) {
-  [0]=>
-  object(ReflectionParameter)#%d (1) {
-    ["name"]=>
-    string(5) "array"
-  }
-}
-bool(false)
-===DONE===

ext/date/tests/bug79015.phpt

@@ -0,0 +1,42 @@
+--TEST--
+Bug #79015 (undefined-behavior in php_date.c)
+--FILE--
+<?php
+$payload = 'O:12:"DateInterval":16:{s:1:"y";i:1;s:1:"m";i:0;s:1:"d";i:4;s:1:"h";i:0;s:1:"i";i:0;s:1:"s";i:0;s:1:"f";i:9999999999990;s:7:"weekday";i:0;s:16:"weekday_behavior";i:0;s:17:"first_last_day_of";i:0;s:6:"invert";i:0;s:4:"days";b:0;s:12:"special_type";i:0;s:14:"special_amount";i:0;s:21:"have_weekday_relative";i:0;s:21:"have_special_relative";i:0;}';
+var_dump(unserialize($payload));
+?>
+--EXPECTF--
+object(DateInterval)#%d (16) {
+  ["y"]=>
+  int(1)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(4)
+  ["h"]=>
+  int(0)
+  ["i"]=>
+  int(0)
+  ["s"]=>
+  int(0)
+  ["f"]=>
+  float(-1)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  bool(false)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}

ext/dba/dba_lmdb.c

@@ -43,10 +43,18 @@ DBA_OPEN_FUNC(lmdb)
 	MDB_env *env;
 	MDB_txn *txn;
 	int rc, mode = 0644, flags = MDB_NOSUBDIR;
+	zend_long mapsize = 0;
 
 	if(info->argc > 0) {
 		mode = zval_get_long(&info->argv[0]);
 
+		if (info->argc > 1) {
+			mapsize = zval_get_long(&info->argv[1]);
+			if (mapsize < 0) {
+				*error = "mapsize must be greater than or equal to zero";
+				return FAILURE;
+			}
+		}
 		/* TODO implement handling of the additional flags. */
 	}
 
@@ -56,6 +64,14 @@ DBA_OPEN_FUNC(lmdb)
 		return FAILURE;
 	}
 
+	if (mapsize > 0) {
+		rc = mdb_env_set_mapsize(env, (size_t) mapsize);
+		if (rc) {
+			*error = mdb_strerror(rc);
+			return FAILURE;
+		}
+	}
+
 	rc = mdb_env_open(env, info->path, flags, mode);
 	if (rc) {
 		*error = mdb_strerror(rc);

ext/dba/tests/bug78808.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached)
+--SKIPIF--
+<?php
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+$handler = 'lmdb';
+require_once __DIR__ .'/skipif.inc';
+?>
+--FILE--
+<?php
+$handler = 'lmdb';
+require_once __DIR__ .'/test.inc';
+$lmdb_h = dba_open($db_filename, 'c', 'lmdb', 0644, 5*1048576);
+for ($i = 0; $i < 50000; $i++) {
+    dba_insert('key' . $i, 'value '. $i, $lmdb_h);
+}
+dba_close($lmdb_h);
+echo "done\n";
+?>
+--EXPECT--
+done
+--CLEAN--
+<?php
+require_once dirname(__FILE__) .'/clean.inc';
+?>

ext/exif/exif.c

@@ -1697,6 +1697,27 @@ static int exif_rewrite_tag_format_to_unsigned(int format)
 }
 /* }}} */
 
+/* Use saturation for out of bounds values to avoid UB */
+static size_t float_to_size_t(float x) {
+	if (x < 0.0f || zend_isnan(x)) {
+		return 0;
+	} else if (x > (float) SIZE_MAX) {
+		return SIZE_MAX;
+	} else {
+		return (size_t) x;
+	}
+}
+
+static size_t double_to_size_t(double x) {
+	if (x < 0.0 || zend_isnan(x)) {
+		return 0;
+	} else if (x > (double) SIZE_MAX) {
+		return SIZE_MAX;
+	} else {
+		return (size_t) x;
+	}
+}
+
 /* {{{ exif_convert_any_to_int
  * Evaluate number, be it int, rational, or float from directory. */
 static size_t exif_convert_any_to_int(void *value, int format, int motorola_intel)
@@ -1735,12 +1756,12 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
 #endif
-			return (size_t) php_ifd_get_float(value);
+			return float_to_size_t(php_ifd_get_float(value));
 		case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
 #endif
-			return (size_t) php_ifd_get_double(value);
+			return double_to_size_t(php_ifd_get_double(value));
 	}
 	return 0;
 }
@@ -3129,7 +3150,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s)", maker_note->make?maker_note->make:"");*/
 		if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
 			continue;
-		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && value_len >= maker_note->id_string_len
+				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
@@ -3203,8 +3225,9 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}
 
 	for (de=0;de<NumDirEntries;de++) {
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
+		size_t offset = 2 + 12 * de;
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
+								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}

ext/exif/tests/bug78793.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #78793: Use-after-free in exif parsing under memory sanitizer
+--FILE--
+<?php
+$f = "ext/exif/tests/bug77950.tiff";
+for ($i = 0; $i < 10; $i++) {
+    @exif_read_data($f);
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/exif/tests/bug78910.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
+--FILE--
+<?php
+
+var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
+
+?>
+--EXPECTF--
+Notice: exif_read_data(): Read from TIFF: tag(0x927C,   MakerNote): Illegal format code 0x2020, switching to BYTE in %s on line %d
+
+Warning: exif_read_data(): Process tag(x927C=MakerNote): Illegal format code 0x2020, suppose BYTE in %s on line %d
+
+Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
+
+Warning: exif_read_data(): Invalid TIFF file in %s on line %d
+bool(false)

ext/exif/tests/bug79046.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #79046: NaN to int cast undefined behavior in exif
+--FILE--
+<?php
+var_dump(exif_read_data('data://image/tiff;base64,TU0AKgAAAA7//wAAANUAAQERAAsAAAABAAD4fwAAAA4A'));
+?>
+--EXPECT--
+array(8) {
+  ["FileDateTime"]=>
+  int(0)
+  ["FileSize"]=>
+  int(33)
+  ["FileType"]=>
+  int(8)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(24) "ANY_TAG, IFD0, THUMBNAIL"
+  ["COMPUTED"]=>
+  array(2) {
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(1)
+  }
+  ["StripOffsets"]=>
+  float(NAN)
+  ["THUMBNAIL"]=>
+  array(1) {
+    ["StripOffsets"]=>
+    float(NAN)
+  }
+}

ext/exif/tests/float_cast_overflow.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Overflow in float to int cast
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/float_cast_overflow.tiff'));
+
+?>
+--EXPECTF--
+array(8) {
+  ["FileName"]=>
+  string(24) "float_cast_overflow.tiff"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(142)
+  ["FileType"]=>
+  int(7)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(24) "ANY_TAG, IFD0, THUMBNAIL"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(20) "width="1" height="1""
+    ["Height"]=>
+    int(1)
+    ["Width"]=>
+    int(1)
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["THUMBNAIL"]=>
+  array(2) {
+    ["ImageWidth"]=>
+    int(1)
+    ["ImageLength"]=>
+    float(-2.5961487387524E+33)
+  }
+}

ext/ffi/ffi.g

@@ -127,16 +127,6 @@ declaration_specifiers(zend_ffi_dcl *dcl):
 			{dcl->flags |= ZEND_FFI_DCL_INLINE;}
 		|	"_Noreturn"
 			{dcl->flags |= ZEND_FFI_DCL_NO_RETURN;}
-		|	"__cdecl"
-			{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_CDECL);}
-		|	"__stdcall"
-			{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_STDCALL);}
-		|	"__fastcall"
-			{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_FASTCALL);}
-		|	"__thiscall"
-			{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_THISCALL);}
-		|	"__vectorcall"
-			{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_VECTORCALL);}
 		|	"_Alignas"
 			"("
 			(	&type_name_start
@@ -494,6 +484,16 @@ attributes(zend_ffi_dcl *dcl):
 				)?
 			)+
 		")"
+	|	"__cdecl"
+		{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_CDECL);}
+	|	"__stdcall"
+		{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_STDCALL);}
+	|	"__fastcall"
+		{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_FASTCALL);}
+	|	"__thiscall"
+		{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_THISCALL);}
+	|	"__vectorcall"
+		{zend_ffi_set_abi(dcl, ZEND_FFI_ABI_VECTORCALL);}
 	)++
 ;
 

ext/ffi/ffi_parser.c

@@ -56,50 +56,50 @@ static void yy_error_sym(const char *msg, int sym);
 #define YY___INLINE 13
 #define YY___INLINE__ 14
 #define YY__NORETURN 15
-#define YY___CDECL 16
-#define YY___STDCALL 17
-#define YY___FASTCALL 18
-#define YY___THISCALL 19
-#define YY___VECTORCALL 20
-#define YY__ALIGNAS 21
-#define YY_CONST 22
-#define YY___CONST 23
-#define YY___CONST__ 24
-#define YY_RESTRICT 25
-#define YY___RESTRICT 26
-#define YY___RESTRICT__ 27
-#define YY_VOLATILE 28
-#define YY___VOLATILE 29
-#define YY___VOLATILE__ 30
-#define YY__ATOMIC 31
-#define YY_VOID 32
-#define YY_CHAR 33
-#define YY_SHORT 34
-#define YY_INT 35
-#define YY_LONG 36
-#define YY_FLOAT 37
-#define YY_DOUBLE 38
-#define YY_SIGNED 39
-#define YY_UNSIGNED 40
-#define YY__BOOL 41
-#define YY__COMPLEX 42
-#define YY_COMPLEX 43
-#define YY___COMPLEX 44
-#define YY___COMPLEX__ 45
-#define YY_STRUCT 46
-#define YY_UNION 47
-#define YY__LBRACE 48
-#define YY__RBRACE 49
-#define YY__COLON 50
-#define YY_ENUM 51
-#define YY__EQUAL 52
-#define YY__STAR 53
-#define YY__LBRACK 54
-#define YY__RBRACK 55
-#define YY__POINT_POINT_POINT 56
-#define YY___ATTRIBUTE 57
-#define YY___ATTRIBUTE__ 58
-#define YY___DECLSPEC 59
+#define YY__ALIGNAS 16
+#define YY_CONST 17
+#define YY___CONST 18
+#define YY___CONST__ 19
+#define YY_RESTRICT 20
+#define YY___RESTRICT 21
+#define YY___RESTRICT__ 22
+#define YY_VOLATILE 23
+#define YY___VOLATILE 24
+#define YY___VOLATILE__ 25
+#define YY__ATOMIC 26
+#define YY_VOID 27
+#define YY_CHAR 28
+#define YY_SHORT 29
+#define YY_INT 30
+#define YY_LONG 31
+#define YY_FLOAT 32
+#define YY_DOUBLE 33
+#define YY_SIGNED 34
+#define YY_UNSIGNED 35
+#define YY__BOOL 36
+#define YY__COMPLEX 37
+#define YY_COMPLEX 38
+#define YY___COMPLEX 39
+#define YY___COMPLEX__ 40
+#define YY_STRUCT 41
+#define YY_UNION 42
+#define YY__LBRACE 43
+#define YY__RBRACE 44
+#define YY__COLON 45
+#define YY_ENUM 46
+#define YY__EQUAL 47
+#define YY__STAR 48
+#define YY__LBRACK 49
+#define YY__RBRACK 50
+#define YY__POINT_POINT_POINT 51
+#define YY___ATTRIBUTE 52
+#define YY___ATTRIBUTE__ 53
+#define YY___DECLSPEC 54
+#define YY___CDECL 55
+#define YY___STDCALL 56
+#define YY___FASTCALL 57
+#define YY___THISCALL 58
+#define YY___VECTORCALL 59
 #define YY__POINT 60
 #define YY__QUERY 61
 #define YY__BAR_BAR 62
@@ -158,11 +158,6 @@ static const char * sym_name[] = {
 	"__inline",
 	"__inline__",
 	"_Noreturn",
-	"__cdecl",
-	"__stdcall",
-	"__fastcall",
-	"__thiscall",
-	"__vectorcall",
 	"_Alignas",
 	"const",
 	"__const",
@@ -202,6 +197,11 @@ static const char * sym_name[] = {
 	"__attribute",
 	"__attribute__",
 	"__declspec",
+	"__cdecl",
+	"__stdcall",
+	"__fastcall",
+	"__thiscall",
+	"__vectorcall",
 	".",
 	"?",
 	"||",
@@ -369,6 +369,58 @@ _yy_state_start:
 							if (ch != '_') goto _yy_tunnel_9;
 							ret = YY___INLINE__;
 							goto _yy_state_390;
+						case 'a':
+							ch = *++YYPOS;
+							if (ch == 'l') {
+								ch = *++YYPOS;
+								if (ch != 'i') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'g') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'n') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'o') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'f') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != '_') {ret = YY___ALIGNOF; goto _yy_tunnel_390;}
+								ch = *++YYPOS;
+								if (ch != '_') goto _yy_tunnel_9;
+								ret = YY___ALIGNOF__;
+								goto _yy_state_390;
+							} else if (ch == 's') {
+								ch = *++YYPOS;
+								if (ch != 'm') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != '_') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != '_') goto _yy_tunnel_9;
+								ret = YY___ASM__;
+								goto _yy_state_390;
+							} else if (ch == 't') {
+								ch = *++YYPOS;
+								if (ch != 't') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'r') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'i') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'b') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'u') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 't') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'e') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != '_') {ret = YY___ATTRIBUTE; goto _yy_tunnel_390;}
+								ch = *++YYPOS;
+								if (ch != '_') goto _yy_tunnel_9;
+								ret = YY___ATTRIBUTE__;
+								goto _yy_state_390;
+							} else {
+								goto _yy_tunnel_9;
+							}
 						case 'c':
 							ch = *++YYPOS;
 							if (ch == 'd') {
@@ -414,20 +466,22 @@ _yy_state_start:
 							} else {
 								goto _yy_tunnel_9;
 							}
-						case 's':
+						case 'd':
 							ch = *++YYPOS;
-							if (ch != 't') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'd') goto _yy_tunnel_9;
+							if (ch != 'e') goto _yy_tunnel_9;
 							ch = *++YYPOS;
 							if (ch != 'c') goto _yy_tunnel_9;
 							ch = *++YYPOS;
-							if (ch != 'a') goto _yy_tunnel_9;
-							ch = *++YYPOS;
 							if (ch != 'l') goto _yy_tunnel_9;
 							ch = *++YYPOS;
-							if (ch != 'l') goto _yy_tunnel_9;
-							ret = YY___STDCALL;
+							if (ch != 's') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'p') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'e') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'c') goto _yy_tunnel_9;
+							ret = YY___DECLSPEC;
 							goto _yy_state_390;
 						case 'f':
 							ch = *++YYPOS;
@@ -446,6 +500,52 @@ _yy_state_start:
 							if (ch != 'l') goto _yy_tunnel_9;
 							ret = YY___FASTCALL;
 							goto _yy_state_390;
+						case 'r':
+							ch = *++YYPOS;
+							if (ch != 'e') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 's') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 't') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch == 'i') {
+								ch = *++YYPOS;
+								if (ch != 'c') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 't') goto _yy_tunnel_9;
+								ret = YY___RESTICT;
+								goto _yy_state_390;
+							} else if (ch == 'r') {
+								ch = *++YYPOS;
+								if (ch != 'i') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 'c') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != 't') goto _yy_tunnel_9;
+								ch = *++YYPOS;
+								if (ch != '_') {ret = YY___RESTRICT; goto _yy_tunnel_390;}
+								ch = *++YYPOS;
+								if (ch != '_') goto _yy_tunnel_9;
+								ret = YY___RESTRICT__;
+								goto _yy_state_390;
+							} else {
+								goto _yy_tunnel_9;
+							}
+						case 's':
+							ch = *++YYPOS;
+							if (ch != 't') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'd') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'c') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'a') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'l') goto _yy_tunnel_9;
+							ch = *++YYPOS;
+							if (ch != 'l') goto _yy_tunnel_9;
+							ret = YY___STDCALL;
+							goto _yy_state_390;
 						case 't':
 							ch = *++YYPOS;
 							if (ch != 'h') goto _yy_tunnel_9;
@@ -506,106 +606,6 @@ _yy_state_start:
 							} else {
 								goto _yy_tunnel_9;
 							}
-						case 'a':
-							ch = *++YYPOS;
-							if (ch == 'l') {
-								ch = *++YYPOS;
-								if (ch != 'i') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'g') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'n') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'o') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'f') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != '_') {ret = YY___ALIGNOF; goto _yy_tunnel_390;}
-								ch = *++YYPOS;
-								if (ch != '_') goto _yy_tunnel_9;
-								ret = YY___ALIGNOF__;
-								goto _yy_state_390;
-							} else if (ch == 's') {
-								ch = *++YYPOS;
-								if (ch != 'm') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != '_') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != '_') goto _yy_tunnel_9;
-								ret = YY___ASM__;
-								goto _yy_state_390;
-							} else if (ch == 't') {
-								ch = *++YYPOS;
-								if (ch != 't') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'r') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'i') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'b') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'u') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 't') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'e') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != '_') {ret = YY___ATTRIBUTE; goto _yy_tunnel_390;}
-								ch = *++YYPOS;
-								if (ch != '_') goto _yy_tunnel_9;
-								ret = YY___ATTRIBUTE__;
-								goto _yy_state_390;
-							} else {
-								goto _yy_tunnel_9;
-							}
-						case 'd':
-							ch = *++YYPOS;
-							if (ch != 'e') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'c') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'l') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 's') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'p') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'e') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 'c') goto _yy_tunnel_9;
-							ret = YY___DECLSPEC;
-							goto _yy_state_390;
-						case 'r':
-							ch = *++YYPOS;
-							if (ch != 'e') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 's') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch != 't') goto _yy_tunnel_9;
-							ch = *++YYPOS;
-							if (ch == 'i') {
-								ch = *++YYPOS;
-								if (ch != 'c') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 't') goto _yy_tunnel_9;
-								ret = YY___RESTICT;
-								goto _yy_state_390;
-							} else if (ch == 'r') {
-								ch = *++YYPOS;
-								if (ch != 'i') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 'c') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != 't') goto _yy_tunnel_9;
-								ch = *++YYPOS;
-								if (ch != '_') {ret = YY___RESTRICT; goto _yy_tunnel_390;}
-								ch = *++YYPOS;
-								if (ch != '_') goto _yy_tunnel_9;
-								ret = YY___RESTRICT__;
-								goto _yy_state_390;
-							} else {
-								goto _yy_tunnel_9;
-							}
 						default:
 							goto _yy_tunnel_9;
 					}
@@ -2012,7 +2012,7 @@ static int synpred_6(int sym) {
 }
 
 static int parse_declarations(int sym) {
-	while (YY_IN_SET(sym, (YY___EXTENSION__,YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\202\377\377\377\377\377\010\016\000\000\000\002\000")) {
+	while (YY_IN_SET(sym, (YY___EXTENSION__,YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\202\377\377\377\377\107\360\017\000\000\000\002\000")) {
 		zend_ffi_dcl common_dcl = ZEND_FFI_ATTR_INIT;
 		if (sym == YY___EXTENSION__) {
 			sym = get_sym();
@@ -2039,7 +2039,7 @@ static int parse_declarations(int sym) {
 				}
 				sym = get_sym();
 			}
-			if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+			if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_attributes(sym, &dcl);
 			}
 			if (sym == YY__EQUAL) {
@@ -2050,7 +2050,7 @@ static int parse_declarations(int sym) {
 				sym = get_sym();
 				dcl = common_dcl;
 				sym = parse_declarator(sym, &dcl, &name, &name_len);
-				if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+				if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 					sym = parse_attributes(sym, &dcl);
 				}
 				if (sym == YY__EQUAL) {
@@ -2105,37 +2105,17 @@ static int parse_declaration_specifiers(int sym, zend_ffi_dcl *dcl) {
 				sym = get_sym();
 				dcl->flags |= ZEND_FFI_DCL_NO_RETURN;
 				break;
-			case YY___CDECL:
-				sym = get_sym();
-				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_CDECL);
-				break;
-			case YY___STDCALL:
-				sym = get_sym();
-				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_STDCALL);
-				break;
-			case YY___FASTCALL:
-				sym = get_sym();
-				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_FASTCALL);
-				break;
-			case YY___THISCALL:
-				sym = get_sym();
-				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_THISCALL);
-				break;
-			case YY___VECTORCALL:
-				sym = get_sym();
-				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_VECTORCALL);
-				break;
 			case YY__ALIGNAS:
 				sym = get_sym();
 				if (sym != YY__LPAREN) {
 					yy_error_sym("'(' expected, got", sym);
 				}
 				sym = get_sym();
-				if ((YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\002\000\300\377\377\377\010\016\000\000\000\002\000")) && synpred_1(sym)) {
+				if ((YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\002\000\376\377\377\107\360\017\000\000\000\002\000")) && synpred_1(sym)) {
 					zend_ffi_dcl align_dcl = ZEND_FFI_ATTR_INIT;
 					sym = parse_type_name(sym, &align_dcl);
 					zend_ffi_align_as_type(dcl, &align_dcl);
-				} else if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
+				} else if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
 					zend_ffi_val align_val;
 					sym = parse_constant_expression(sym, &align_val);
 					zend_ffi_align_as_val(dcl, &align_val);
@@ -2150,6 +2130,11 @@ static int parse_declaration_specifiers(int sym, zend_ffi_dcl *dcl) {
 			case YY___ATTRIBUTE:
 			case YY___ATTRIBUTE__:
 			case YY___DECLSPEC:
+			case YY___CDECL:
+			case YY___STDCALL:
+			case YY___FASTCALL:
+			case YY___THISCALL:
+			case YY___VECTORCALL:
 				sym = parse_attributes(sym, dcl);
 				break;
 			case YY_CONST:
@@ -2187,7 +2172,7 @@ static int parse_declaration_specifiers(int sym, zend_ffi_dcl *dcl) {
 			default:
 				yy_error_sym("unexpected", sym);
 		}
-	} while ((YY_IN_SET(sym, (YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\200\377\377\377\377\377\010\016\000\000\000\002\000")) && (sym != YY_ID || !(dcl->flags & ZEND_FFI_DCL_TYPE_SPECIFIERS)));
+	} while ((YY_IN_SET(sym, (YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\200\377\377\377\377\107\360\017\000\000\000\002\000")) && (sym != YY_ID || !(dcl->flags & ZEND_FFI_DCL_TYPE_SPECIFIERS)));
 	return sym;
 }
 
@@ -2196,29 +2181,29 @@ static int parse_specifier_qualifier_list(int sym, zend_ffi_dcl *dcl) {
 		sym = get_sym();
 	}
 	do {
-		if (YY_IN_SET(sym, (YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\000\000\000\000\377\377\010\000\000\000\000\002\000")) {
+		if (YY_IN_SET(sym, (YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID), "\000\000\000\370\377\107\000\000\000\000\000\002\000")) {
 			sym = parse_type_specifier(sym, dcl);
-		} else if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC), "\000\000\300\377\000\000\000\000\000\000\000\000\000")) {
+		} else if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC), "\000\000\376\007\000\000\000\000\000\000\000\000\000")) {
 			sym = parse_type_qualifier(sym, dcl);
-		} else if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		} else if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, dcl);
 		} else {
 			yy_error_sym("unexpected", sym);
 		}
-	} while ((YY_IN_SET(sym, (YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\000\000\300\377\377\377\010\016\000\000\000\002\000")) && (sym != YY_ID || zend_ffi_is_typedef_name((const char*)yy_text, yy_pos - yy_text)));
+	} while ((YY_IN_SET(sym, (YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\376\377\377\107\360\017\000\000\000\002\000")) && (sym != YY_ID || zend_ffi_is_typedef_name((const char*)yy_text, yy_pos - yy_text)));
 	return sym;
 }
 
 static int parse_type_qualifier_list(int sym, zend_ffi_dcl *dcl) {
 	do {
-		if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC), "\000\000\300\377\000\000\000\000\000\000\000\000\000")) {
+		if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC), "\000\000\376\007\000\000\000\000\000\000\000\000\000")) {
 			sym = parse_type_qualifier(sym, dcl);
-		} else if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		} else if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, dcl);
 		} else {
 			yy_error_sym("unexpected", sym);
 		}
-	} while (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\000\000\300\377\000\000\000\016\000\000\000\000\000"));
+	} while (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\376\007\000\000\360\017\000\000\000\000\000"));
 	return sym;
 }
 
@@ -2341,7 +2326,7 @@ static int parse_struct_or_union_specifier(int sym, zend_ffi_dcl *dcl) {
 	} else {
 		yy_error_sym("unexpected", sym);
 	}
-	if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+	if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 		sym = parse_attributes(sym, dcl);
 	}
 	if (sym == YY_ID) {
@@ -2372,7 +2357,7 @@ static int parse_struct_contents(int sym, zend_ffi_dcl *dcl) {
 		yy_error_sym("'{' expected, got", sym);
 	}
 	sym = get_sym();
-	if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\002\000\300\377\377\377\010\016\000\000\000\002\000")) {
+	if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\002\000\376\377\377\107\360\017\000\000\000\002\000")) {
 		sym = parse_struct_declaration(sym, dcl);
 		while (1) {
 			save_pos  = yy_pos;
@@ -2390,7 +2375,7 @@ static int parse_struct_contents(int sym, zend_ffi_dcl *dcl) {
 				yy_error_sym("unexpected", sym2);
 			}
 _yy_state_2_1:
-			if (YY_IN_SET(sym2, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\002\000\300\377\377\377\010\016\000\000\000\002\000")) {
+			if (YY_IN_SET(sym2, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\002\000\376\377\377\107\360\017\000\000\000\002\000")) {
 				alt2 = 3;
 				goto _yy_state_2;
 			} else if (sym2 == YY__RBRACE) {
@@ -2417,7 +2402,7 @@ _yy_state_2:
 		yy_error_sym("'}' expected, got", sym);
 	}
 	sym = get_sym();
-	if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+	if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 		sym = parse_attributes(sym, dcl);
 	}
 	zend_ffi_adjust_struct_size(dcl);
@@ -2434,7 +2419,7 @@ static int parse_struct_declaration(int sym, zend_ffi_dcl *struct_dcl) {
 		while (sym == YY__COMMA) {
 			sym = get_sym();
 			zend_ffi_dcl field_dcl = common_field_dcl;
-			if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+			if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_attributes(sym, &field_dcl);
 			}
 			sym = parse_struct_declarator(sym, struct_dcl, &field_dcl);
@@ -2454,12 +2439,12 @@ static int parse_struct_declarator(int sym, zend_ffi_dcl *struct_dcl, zend_ffi_d
 		if (sym == YY__COLON) {
 			sym = get_sym();
 			sym = parse_constant_expression(sym, &bits);
-			if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+			if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_attributes(sym, field_dcl);
 			}
 			zend_ffi_add_bit_field(struct_dcl, name, name_len, field_dcl, &bits);
-		} else if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY__COMMA,YY__SEMICOLON,YY__RBRACE), "\140\000\000\000\000\000\002\016\000\000\000\000\000")) {
-			if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		} else if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY__COMMA,YY__SEMICOLON,YY__RBRACE), "\140\000\000\000\000\020\360\017\000\000\000\000\000")) {
+			if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_attributes(sym, field_dcl);
 			}
 			zend_ffi_add_field(struct_dcl, name, name_len, field_dcl);
@@ -2482,7 +2467,7 @@ static int parse_enum_specifier(int sym, zend_ffi_dcl *dcl) {
 	}
 	sym = get_sym();
 	dcl->flags |= ZEND_FFI_DCL_ENUM;
-	if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+	if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 		sym = parse_attributes(sym, dcl);
 	}
 	if (sym == YY_ID) {
@@ -2497,10 +2482,10 @@ static int parse_enum_specifier(int sym, zend_ffi_dcl *dcl) {
 				yy_error_sym("'}' expected, got", sym);
 			}
 			sym = get_sym();
-			if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+			if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_attributes(sym, dcl);
 			}
-		} else if (YY_IN_SET(sym, (YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY__STAR,YY__LPAREN,YY__SEMICOLON,YY__COLON,YY__LBRACK,YY__RBRACE,YY__COMMA,YY__RPAREN,YY_EOF), "\371\377\377\377\377\377\156\016\000\000\000\002\000")) {
+		} else if (YY_IN_SET(sym, (YY_TYPEDEF,YY_EXTERN,YY_STATIC,YY_AUTO,YY_REGISTER,YY_INLINE,YY___INLINE,YY___INLINE__,YY__NORETURN,YY__ALIGNAS,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY__STAR,YY__LPAREN,YY__SEMICOLON,YY__COLON,YY__LBRACK,YY__RBRACE,YY__COMMA,YY__RPAREN,YY_EOF), "\371\377\377\377\377\167\363\017\000\000\000\002\000")) {
 			zend_ffi_declare_tag(name, name_len, dcl, 1);
 		} else {
 			yy_error_sym("unexpected", sym);
@@ -2513,7 +2498,7 @@ static int parse_enum_specifier(int sym, zend_ffi_dcl *dcl) {
 			yy_error_sym("'}' expected, got", sym);
 		}
 		sym = get_sym();
-		if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, dcl);
 		}
 	} else {
@@ -2594,7 +2579,7 @@ static int parse_declarator(int sym, zend_ffi_dcl *dcl, const char **name, size_
 		sym = parse_ID(sym, name, name_len);
 	} else if (sym == YY__LPAREN) {
 		sym = get_sym();
-		if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, &nested_dcl);
 		}
 		sym = parse_declarator(sym, &nested_dcl, name, name_len);
@@ -2621,7 +2606,7 @@ static int parse_abstract_declarator(int sym, zend_ffi_dcl *dcl) {
 	}
 	if ((sym == YY__LPAREN) && synpred_2(sym)) {
 		sym = get_sym();
-		if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, &nested_dcl);
 		}
 		sym = parse_abstract_declarator(sym, &nested_dcl);
@@ -2646,7 +2631,7 @@ static int parse_parameter_declarator(int sym, zend_ffi_dcl *dcl, const char **n
 	}
 	if ((sym == YY__LPAREN) && synpred_3(sym)) {
 		sym = get_sym();
-		if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC) {
+		if (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_attributes(sym, &nested_dcl);
 		}
 		sym = parse_parameter_declarator(sym, &nested_dcl, name, name_len);
@@ -2675,7 +2660,7 @@ static int parse_pointer(int sym, zend_ffi_dcl *dcl) {
 	do {
 		sym = get_sym();
 		zend_ffi_make_pointer_type(dcl);
-		if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\000\000\300\377\000\000\000\016\000\000\000\000\000")) {
+		if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\376\007\000\000\360\017\000\000\000\000\000")) {
 			sym = parse_type_qualifier_list(sym, dcl);
 		}
 	} while (sym == YY__STAR);
@@ -2687,9 +2672,9 @@ static int parse_array_or_function_declarators(int sym, zend_ffi_dcl *dcl, zend_
 	const unsigned char *save_pos;
 	const unsigned char *save_text;
 	int   save_line;
-	int alt104;
-	int alt100;
-	int alt114;
+	int alt109;
+	int alt105;
+	int alt119;
 	zend_ffi_dcl dummy = ZEND_FFI_ATTR_INIT;
 	zend_ffi_val len = {.kind = ZEND_FFI_VAL_EMPTY};
 	HashTable *args = NULL;
@@ -2699,99 +2684,99 @@ static int parse_array_or_function_declarators(int sym, zend_ffi_dcl *dcl, zend_
 		save_pos  = yy_pos;
 		save_text = yy_text;
 		save_line = yy_line;
-		alt100 = -2;
+		alt105 = -2;
 		sym2 = sym;
 		if (sym2 == YY_STATIC) {
-			alt100 = 101;
-			goto _yy_state_100;
-		} else if (YY_IN_SET(sym2, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\000\000\300\377\000\000\000\016\000\000\000\000\000")) {
-			alt100 = 104;
-			goto _yy_state_100;
+			alt105 = 106;
+			goto _yy_state_105;
+		} else if (YY_IN_SET(sym2, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\376\007\000\000\360\017\000\000\000\000\000")) {
+			alt105 = 109;
+			goto _yy_state_105;
 		} else if (sym2 == YY__STAR) {
 			sym2 = get_sym();
-			goto _yy_state_100_15;
+			goto _yy_state_105_20;
 		} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER), "\010\000\000\000\000\000\000\000\004\030\377\376\000")) {
-			alt100 = 110;
-			goto _yy_state_100;
+			alt105 = 115;
+			goto _yy_state_105;
 		} else if (sym2 == YY__RBRACK) {
-			alt100 = 111;
-			goto _yy_state_100;
+			alt105 = 116;
+			goto _yy_state_105;
 		} else {
 			yy_error_sym("unexpected", sym2);
 		}
-_yy_state_100_15:
+_yy_state_105_20:
 		if (sym2 == YY__RBRACK) {
-			alt100 = 109;
-			goto _yy_state_100;
-		} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__STAR), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
-			alt100 = 110;
-			goto _yy_state_100;
+			alt105 = 114;
+			goto _yy_state_105;
+		} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__STAR), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
+			alt105 = 115;
+			goto _yy_state_105;
 		} else {
 			yy_error_sym("unexpected", sym2);
 		}
-_yy_state_100:
+_yy_state_105:
 		yy_pos  = save_pos;
 		yy_text = save_text;
 		yy_line = save_line;
-		if (alt100 == 101) {
+		if (alt105 == 106) {
 			sym = get_sym();
-			if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\000\000\300\377\000\000\000\016\000\000\000\000\000")) {
+			if (YY_IN_SET(sym, (YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\376\007\000\000\360\017\000\000\000\000\000")) {
 				sym = parse_type_qualifier_list(sym, &dummy);
 			}
 			sym = parse_assignment_expression(sym, &len);
-		} else if (alt100 == 104) {
+		} else if (alt105 == 109) {
 			sym = parse_type_qualifier_list(sym, &dummy);
 			save_pos  = yy_pos;
 			save_text = yy_text;
 			save_line = yy_line;
-			alt104 = -2;
+			alt109 = -2;
 			sym2 = sym;
 			if (sym2 == YY_STATIC) {
-				alt104 = 105;
-				goto _yy_state_104;
+				alt109 = 110;
+				goto _yy_state_109;
 			} else if (sym2 == YY__STAR) {
 				sym2 = get_sym();
-				goto _yy_state_104_2;
+				goto _yy_state_109_2;
 			} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER), "\010\000\000\000\000\000\000\000\004\030\377\376\000")) {
-				alt104 = 108;
-				goto _yy_state_104;
+				alt109 = 113;
+				goto _yy_state_109;
 			} else if (sym2 == YY__RBRACK) {
-				alt104 = 111;
-				goto _yy_state_104;
+				alt109 = 116;
+				goto _yy_state_109;
 			} else {
 				yy_error_sym("unexpected", sym2);
 			}
-_yy_state_104_2:
+_yy_state_109_2:
 			if (sym2 == YY__RBRACK) {
-				alt104 = 107;
-				goto _yy_state_104;
-			} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__STAR), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
-				alt104 = 108;
-				goto _yy_state_104;
+				alt109 = 112;
+				goto _yy_state_109;
+			} else if (YY_IN_SET(sym2, (YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__STAR), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
+				alt109 = 113;
+				goto _yy_state_109;
 			} else {
 				yy_error_sym("unexpected", sym2);
 			}
-_yy_state_104:
+_yy_state_109:
 			yy_pos  = save_pos;
 			yy_text = save_text;
 			yy_line = save_line;
-			if (alt104 == 105) {
+			if (alt109 == 110) {
 				sym = get_sym();
 				sym = parse_assignment_expression(sym, &len);
-			} else if (alt104 == 111) {
+			} else if (alt109 == 116) {
 				attr |= ZEND_FFI_ATTR_INCOMPLETE_ARRAY;
-			} else if (alt104 == 107) {
+			} else if (alt109 == 112) {
 				sym = get_sym();
 				attr |= ZEND_FFI_ATTR_VLA;
-			} else if (alt104 == 108) {
+			} else if (alt109 == 113) {
 				sym = parse_assignment_expression(sym, &len);
 			} else {
 				yy_error_sym("unexpected", sym);
 			}
-		} else if (alt100 == 111 || alt100 == 109 || alt100 == 110) {
-			if (alt100 == 111) {
+		} else if (alt105 == 116 || alt105 == 114 || alt105 == 115) {
+			if (alt105 == 116) {
 				attr |= ZEND_FFI_ATTR_INCOMPLETE_ARRAY;
-			} else if (alt100 == 109) {
+			} else if (alt105 == 114) {
 				sym = get_sym();
 				attr |= ZEND_FFI_ATTR_VLA;
 			} else {
@@ -2811,45 +2796,45 @@ _yy_state_104:
 		zend_ffi_make_array_type(dcl, &len);
 	} else if (sym == YY__LPAREN) {
 		sym = get_sym();
-		if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY__POINT_POINT_POINT), "\002\000\300\377\377\377\010\017\000\000\000\002\000")) {
-			if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\002\000\300\377\377\377\010\016\000\000\000\002\000")) {
+		if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL,YY__POINT_POINT_POINT), "\002\000\376\377\377\107\370\017\000\000\000\002\000")) {
+			if (YY_IN_SET(sym, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\002\000\376\377\377\107\360\017\000\000\000\002\000")) {
 				sym = parse_parameter_declaration(sym, &args);
 				while (1) {
 					save_pos  = yy_pos;
 					save_text = yy_text;
 					save_line = yy_line;
-					alt114 = -2;
+					alt119 = -2;
 					sym2 = sym;
 					if (sym2 == YY__COMMA) {
 						sym2 = get_sym();
-						goto _yy_state_114_1;
+						goto _yy_state_119_1;
 					} else if (sym2 == YY__RPAREN) {
-						alt114 = 120;
-						goto _yy_state_114;
+						alt119 = 125;
+						goto _yy_state_119;
 					} else {
 						yy_error_sym("unexpected", sym2);
 					}
-_yy_state_114_1:
-					if (YY_IN_SET(sym2, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC), "\002\000\300\377\377\377\010\016\000\000\000\002\000")) {
-						alt114 = 115;
-						goto _yy_state_114;
+_yy_state_119_1:
+					if (YY_IN_SET(sym2, (YY___EXTENSION__,YY_VOID,YY_CHAR,YY_SHORT,YY_INT,YY_LONG,YY_FLOAT,YY_DOUBLE,YY_SIGNED,YY_UNSIGNED,YY__BOOL,YY__COMPLEX,YY_COMPLEX,YY___COMPLEX,YY___COMPLEX__,YY_STRUCT,YY_UNION,YY_ENUM,YY_ID,YY_CONST,YY___CONST,YY___CONST__,YY_RESTRICT,YY___RESTRICT,YY___RESTRICT__,YY_VOLATILE,YY___VOLATILE,YY___VOLATILE__,YY__ATOMIC,YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\002\000\376\377\377\107\360\017\000\000\000\002\000")) {
+						alt119 = 120;
+						goto _yy_state_119;
 					} else if (sym2 == YY__POINT_POINT_POINT) {
-						alt114 = 117;
-						goto _yy_state_114;
+						alt119 = 122;
+						goto _yy_state_119;
 					} else {
 						yy_error_sym("unexpected", sym2);
 					}
-_yy_state_114:
+_yy_state_119:
 					yy_pos  = save_pos;
 					yy_text = save_text;
 					yy_line = save_line;
-					if (alt114 != 115) {
+					if (alt119 != 120) {
 						break;
 					}
 					sym = get_sym();
 					sym = parse_parameter_declaration(sym, &args);
 				}
-				if (alt114 == 117) {
+				if (alt119 == 122) {
 					sym = get_sym();
 					if (sym != YY__POINT_POINT_POINT) {
 						yy_error_sym("'...' expected, got", sym);
@@ -2901,55 +2886,79 @@ static int parse_attributes(int sym, zend_ffi_dcl *dcl) {
 	size_t name_len;
 	zend_ffi_val val;
 	do {
-		if (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__) {
-			sym = get_sym();
-			if (sym != YY__LPAREN) {
-				yy_error_sym("'(' expected, got", sym);
-			}
-			sym = get_sym();
-			if (sym != YY__LPAREN) {
-				yy_error_sym("'(' expected, got", sym);
-			}
-			sym = get_sym();
-			sym = parse_attrib(sym, dcl);
-			while (sym == YY__COMMA) {
+		switch (sym) {
+			case YY___ATTRIBUTE:
+			case YY___ATTRIBUTE__:
+				sym = get_sym();
+				if (sym != YY__LPAREN) {
+					yy_error_sym("'(' expected, got", sym);
+				}
+				sym = get_sym();
+				if (sym != YY__LPAREN) {
+					yy_error_sym("'(' expected, got", sym);
+				}
 				sym = get_sym();
 				sym = parse_attrib(sym, dcl);
-			}
-			if (sym != YY__RPAREN) {
-				yy_error_sym("')' expected, got", sym);
-			}
-			sym = get_sym();
-			if (sym != YY__RPAREN) {
-				yy_error_sym("')' expected, got", sym);
-			}
-			sym = get_sym();
-		} else if (sym == YY___DECLSPEC) {
-			sym = get_sym();
-			if (sym != YY__LPAREN) {
-				yy_error_sym("'(' expected, got", sym);
-			}
-			sym = get_sym();
-			do {
-				sym = parse_ID(sym, &name, &name_len);
-				if (sym == YY__LPAREN) {
-					sym = get_sym();
-					sym = parse_assignment_expression(sym, &val);
-					zend_ffi_add_msvc_attribute_value(dcl, name, name_len, &val);
-					if (sym != YY__RPAREN) {
-						yy_error_sym("')' expected, got", sym);
-					}
+				while (sym == YY__COMMA) {
 					sym = get_sym();
+					sym = parse_attrib(sym, dcl);
 				}
-			} while (sym == YY_ID);
-			if (sym != YY__RPAREN) {
-				yy_error_sym("')' expected, got", sym);
-			}
-			sym = get_sym();
-		} else {
-			yy_error_sym("unexpected", sym);
+				if (sym != YY__RPAREN) {
+					yy_error_sym("')' expected, got", sym);
+				}
+				sym = get_sym();
+				if (sym != YY__RPAREN) {
+					yy_error_sym("')' expected, got", sym);
+				}
+				sym = get_sym();
+				break;
+			case YY___DECLSPEC:
+				sym = get_sym();
+				if (sym != YY__LPAREN) {
+					yy_error_sym("'(' expected, got", sym);
+				}
+				sym = get_sym();
+				do {
+					sym = parse_ID(sym, &name, &name_len);
+					if (sym == YY__LPAREN) {
+						sym = get_sym();
+						sym = parse_assignment_expression(sym, &val);
+						zend_ffi_add_msvc_attribute_value(dcl, name, name_len, &val);
+						if (sym != YY__RPAREN) {
+							yy_error_sym("')' expected, got", sym);
+						}
+						sym = get_sym();
+					}
+				} while (sym == YY_ID);
+				if (sym != YY__RPAREN) {
+					yy_error_sym("')' expected, got", sym);
+				}
+				sym = get_sym();
+				break;
+			case YY___CDECL:
+				sym = get_sym();
+				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_CDECL);
+				break;
+			case YY___STDCALL:
+				sym = get_sym();
+				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_STDCALL);
+				break;
+			case YY___FASTCALL:
+				sym = get_sym();
+				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_FASTCALL);
+				break;
+			case YY___THISCALL:
+				sym = get_sym();
+				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_THISCALL);
+				break;
+			case YY___VECTORCALL:
+				sym = get_sym();
+				zend_ffi_set_abi(dcl, ZEND_FFI_ABI_VECTORCALL);
+				break;
+			default:
+				yy_error_sym("unexpected", sym);
 		}
-	} while (sym == YY___ATTRIBUTE || sym == YY___ATTRIBUTE__ || sym == YY___DECLSPEC);
+	} while (YY_IN_SET(sym, (YY___ATTRIBUTE,YY___ATTRIBUTE__,YY___DECLSPEC,YY___CDECL,YY___STDCALL,YY___FASTCALL,YY___THISCALL,YY___VECTORCALL), "\000\000\000\000\000\000\360\017\000\000\000\000\000"));
 	return sym;
 }
 
@@ -3006,7 +3015,7 @@ static int parse_initializer(int sym) {
 		yy_error_sym("'=' expected, got", sym);
 	}
 	sym = get_sym();
-	if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
+	if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
 		sym = parse_assignment_expression(sym, &dummy);
 	} else if (sym == YY__LBRACE) {
 		sym = get_sym();
@@ -3313,7 +3322,7 @@ static int parse_unary_expression(int sym, zend_ffi_val *val) {
 		case YY_ID:
 			sym = parse_ID(sym, &name, &name_len);
 			zend_ffi_resolve_const(name, name_len, val);
-			while (YY_IN_SET(sym, (YY__LBRACK,YY__LPAREN,YY__POINT,YY__MINUS_GREATER,YY__PLUS_PLUS,YY__MINUS_MINUS), "\010\000\000\000\000\000\100\020\000\200\003\000\000")) {
+			while (YY_IN_SET(sym, (YY__LBRACK,YY__LPAREN,YY__POINT,YY__MINUS_GREATER,YY__PLUS_PLUS,YY__MINUS_MINUS), "\010\000\000\000\000\000\002\020\000\200\003\000\000")) {
 				switch (sym) {
 					case YY__LBRACK:
 						sym = get_sym();
@@ -3325,7 +3334,7 @@ static int parse_unary_expression(int sym, zend_ffi_val *val) {
 						break;
 					case YY__LPAREN:
 						sym = get_sym();
-						if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
+						if (YY_IN_SET(sym, (YY__LPAREN,YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
 							sym = parse_expr_list(sym);
 						}
 						if (sym != YY__RPAREN) {
@@ -3427,7 +3436,7 @@ static int parse_unary_expression(int sym, zend_ffi_val *val) {
 				}
 				sym = get_sym();
 				zend_ffi_expr_sizeof_type(val, &dcl);
-			} else if (YY_IN_SET(sym, (YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
+			} else if (YY_IN_SET(sym, (YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
 				sym = parse_unary_expression(sym, val);
 				zend_ffi_expr_sizeof_val(val);
 			} else {
@@ -3458,7 +3467,7 @@ static int parse_unary_expression(int sym, zend_ffi_val *val) {
 				}
 				sym = get_sym();
 				zend_ffi_expr_alignof_type(val, &dcl);
-			} else if (YY_IN_SET(sym, (YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\040\000\004\030\377\376\000")) {
+			} else if (YY_IN_SET(sym, (YY_ID,YY_OCTNUMBER,YY_DECNUMBER,YY_HEXNUMBER,YY_FLOATNUMBER,YY_STRING,YY_CHARACTER,YY__LPAREN,YY__PLUS_PLUS,YY__MINUS_MINUS,YY__AND,YY__STAR,YY__PLUS,YY__MINUS,YY__TILDE,YY__BANG,YY_SIZEOF,YY__ALIGNOF,YY___ALIGNOF,YY___ALIGNOF__), "\010\000\000\000\000\000\001\000\004\030\377\376\000")) {
 				sym = parse_unary_expression(sym, val);
 				zend_ffi_expr_alignof_val(val);
 			} else {

ext/ffi/tests/300-win32.phpt

@@ -1,24 +0,0 @@
---TEST--
-FFI 300: FFI preloading on Windows
---SKIPIF--
-<?php require_once('skipif.inc'); ?>
-<?php if (!extension_loaded('Zend OPcache')) die('skip Zend OPcache extension not available'); ?>
-<?php if (substr(PHP_OS, 0, 3) != 'WIN') die('skip for Windows only'); ?>
---INI--
-ffi.enable=1
-opcache.enable=1
-opcache.enable_cli=1
-opcache.optimization_level=-1
-opcache.preload={PWD}/preload.inc
---FILE--
-<?php
-$ffi = FFI::scope("TEST_300_WIN32");
-$ffi->php_printf("Hello World from %s!\n", "PHP");
-?>
---CLEAN--
-<?php
-	$fn = __DIR__ . "/300-win32.h";
-	unlink($fn);
-?>
---EXPECT--
-Hello World from PHP!

ext/ffi/tests/bug78270_1.phpt

@@ -5,6 +5,11 @@ FR #78270 (Usage of __vectorcall convention with FFI)
 require_once('skipif.inc');
 if (substr(PHP_OS, 0, 3) != 'WIN') die("skip this test is for Windows platforms only");
 
+ob_start();
+phpinfo(INFO_GENERAL);
+$info = ob_get_clean();
+if (preg_match('/Compiler => .*clang.*/', $info)) die("skip not for clang");
+
 $dll = 'php7' . (PHP_ZTS ? 'ts' : '') . (PHP_DEBUG ? '_debug' : '') . '.dll';
 try {
     FFI::cdef(<<<EOC

ext/ffi/tests/bug78714.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #78714 (funcs returning pointer can't use call convention spec)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+ffi.enable=1
+--FILE--
+<?php
+$def = 'char * __cdecl get_zend_version(void);';
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    $ffi = FFI::cdef($def);
+} else {
+    $dll = 'php7' . (PHP_ZTS ? 'ts' : '') . (PHP_DEBUG ? '_debug' : '') . '.dll';
+    $ffi = FFI::cdef($def, $dll);
+}
+echo substr(FFI::string($ffi->get_zend_version()), 0, 4) . "\n";
+?>
+--EXPECT--
+Zend

ext/ffi/tests/bug78761.phpt

@@ -1,7 +1,10 @@
 --TEST--
 Bug #78761 (Zend memory heap corruption with preload and casting)
 --SKIPIF--
-<?php require_once('skipif.inc'); ?>
+<?php
+require_once('skipif.inc');
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
 --INI--
 opcache.enable_cli=1
 opcache.preload={PWD}/bug78761_preload.php

ext/fileinfo/libmagic/funcs.c

@@ -527,11 +527,9 @@ file_replace(struct magic_set *ms, const char *pat, const char *rep)
 	zend_string *repl;
 	size_t rep_cnt = 0;
 
-	(void)setlocale(LC_CTYPE, "C");
-
 	opts |= PCRE2_MULTILINE;
 	convert_libmagic_pattern(&patt, (char*)pat, strlen(pat), opts);
-	if ((pce = pcre_get_compiled_regex_cache(Z_STR(patt))) == NULL) {
+	if ((pce = pcre_get_compiled_regex_cache_ex(Z_STR(patt), 0)) == NULL) {
 		zval_ptr_dtor(&patt);
 		rep_cnt = -1;
 		goto out;
@@ -553,7 +551,6 @@ file_replace(struct magic_set *ms, const char *pat, const char *rep)
 	zend_string_release_ex(res, 0);
 
 out:
-	(void)setlocale(LC_CTYPE, "");
 	return rep_cnt;
 }
 

ext/fileinfo/libmagic/readcdf.c

@@ -112,14 +112,24 @@ cdf_app_to_mime(const char *vbuf, const struct nv *nv)
 {
 	size_t i;
 	const char *rv = NULL;
+	char *vbuf_lower;
 
-	(void)setlocale(LC_CTYPE, "C");
-	for (i = 0; nv[i].pattern != NULL; i++)
-		if (strcasestr(vbuf, nv[i].pattern) != NULL) {
+	vbuf_lower = zend_str_tolower_dup(vbuf, strlen(vbuf));
+	for (i = 0; nv[i].pattern != NULL; i++) {
+		char *pattern_lower;
+		int found;
+
+		pattern_lower = zend_str_tolower_dup(nv[i].pattern, strlen(nv[i].pattern));
+		found = (strstr(vbuf_lower, pattern_lower) != NULL);
+		efree(pattern_lower);
+
+		if (found) {
 			rv = nv[i].mime;
 			break;
 		}
-	(void)setlocale(LC_CTYPE, "");
+	}
+
+	efree(vbuf_lower);
 	return rv;
 }
 

ext/fileinfo/libmagic/softmagic.c

@@ -469,27 +469,25 @@ flush:
 private int
 check_fmt(struct magic_set *ms, const char *fmt)
 {
-	pcre2_code *pce;
-	uint32_t capture_count;
+	pcre_cache_entry *pce;
 	int rv = -1;
 	zend_string *pattern;
 
 	if (strchr(fmt, '%') == NULL)
 		return 0;
 
-	(void)setlocale(LC_CTYPE, "C");
 	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
-	if ((pce = pcre_get_compiled_regex(pattern, &capture_count)) == NULL) {
+	if ((pce = pcre_get_compiled_regex_cache_ex(pattern, 0)) == NULL) {
 		rv = -1;
 	} else {
-		pcre2_match_data *match_data = php_pcre_create_match_data(capture_count, pce);
+		pcre2_code *re = php_pcre_pce_re(pce);
+		pcre2_match_data *match_data = php_pcre_create_match_data(0, re);
 		if (match_data) {
-			rv = pcre2_match(pce, (PCRE2_SPTR)fmt, strlen(fmt), 0, 0, match_data, php_pcre_mctx()) > 0;
+			rv = pcre2_match(re, (PCRE2_SPTR)fmt, strlen(fmt), 0, 0, match_data, php_pcre_mctx()) > 0;
 			php_pcre_free_match_data(match_data);
 		}
 	}
-	zend_string_release_ex(pattern, 0);
-	(void)setlocale(LC_CTYPE, "");
+	zend_string_release(pattern);
 	return rv;
 }
 

ext/fileinfo/tests/bug74170.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #74170 locale information change after mime_content_type
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+if (setlocale(LC_CTYPE, 'ru_RU.koi8r') === false)
+	die('skip ru_RU.koi8r locale is not available');
+?>
+--FILE--
+<?php
+var_dump(setlocale(LC_CTYPE, 'ru_RU.koi8r'));
+var_dump(nl_langinfo(CODESET));
+var_dump(mime_content_type(__DIR__ . '/resources/test.ppt'));
+var_dump(nl_langinfo(CODESET));
+--EXPECT--
+string(11) "ru_RU.koi8r"
+string(6) "KOI8-R"
+string(29) "application/vnd.ms-powerpoint"
+string(6) "KOI8-R"

ext/gd/gd.c

@@ -1235,6 +1235,7 @@ PHP_MSHUTDOWN_FUNCTION(gd)
 #if defined(HAVE_GD_FREETYPE) && defined(HAVE_GD_BUNDLED)
 	gdFontCacheMutexShutdown();
 #endif
+	UNREGISTER_INI_ENTRIES();
 	return SUCCESS;
 }
 /* }}} */

ext/gd/libgd/gd_filter.c

@@ -362,6 +362,7 @@ int gdImageConvolution(gdImagePtr src, float filter[3][3], float filter_div, flo
 	for ( y=0; y<src->sy; y++) {
 		for(x=0; x<src->sx; x++) {
 			new_r = new_g = new_b = 0;
+			pxl = f(srcback, x, y);
 			new_a = gdImageAlpha(srcback, pxl);
 
 			for (j=0; j<3; j++) {

ext/gd/libgd/gd_gif_out.c

@@ -548,7 +548,7 @@ compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *ctx)
     output( (code_int)ctx->ClearCode, ctx );
 
 #ifdef SIGNED_COMPARE_SLOW
-    while ( (c = GIFNextPixel( im )) != (unsigned) EOF ) {
+    while ( (c = GIFNextPixel( im, ctx )) != (unsigned) EOF ) {
 #else /*SIGNED_COMPARE_SLOW*/
     while ( (c = GIFNextPixel( im, ctx )) != EOF ) {  /* } */
 #endif /*SIGNED_COMPARE_SLOW*/

ext/gd/libgd/gd_interpolation.c

@@ -2289,7 +2289,7 @@ int gdTransformAffineGetImage(gdImagePtr *dst,
  *  src_area - Rectangular region to rotate in the src image
  *
  * Returns:
- *  GD_TRUE if the affine is rectilinear or GD_FALSE
+ *  GD_TRUE on success or GD_FALSE on failure
  */
 int gdTransformAffineCopy(gdImagePtr dst,
 		  int dst_x, int dst_y,
@@ -2306,7 +2306,7 @@ int gdTransformAffineCopy(gdImagePtr dst,
 	gdPointF pt, src_pt;
 	gdRect bbox;
 	int end_x, end_y;
-	gdInterpolationMethod interpolation_id_bak = GD_DEFAULT;
+	gdInterpolationMethod interpolation_id_bak = src->interpolation_id;
 
 	/* These methods use special implementations */
 	if (src->interpolation_id == GD_BILINEAR_FIXED || src->interpolation_id == GD_BICUBIC_FIXED || src->interpolation_id == GD_NEAREST_NEIGHBOUR) {
@@ -2346,7 +2346,10 @@ int gdTransformAffineCopy(gdImagePtr dst,
 	end_y = bbox.height + abs(bbox.y);
 
 	/* Get inverse affine to let us work with destination -> source */
-	gdAffineInvert(inv, affine);
+	if (gdAffineInvert(inv, affine) == GD_FALSE) {
+		gdImageSetInterpolationMethod(src, interpolation_id_bak);
+		return GD_FALSE;
+	}
 
 	src_offset_x =  src_region->x;
 	src_offset_y =  src_region->y;

ext/gd/libgd/gd_matrix.c

@@ -55,7 +55,7 @@ int gdAffineApplyToPointF (gdPointFPtr dst, const gdPointFPtr src,
  *  <gdAffineIdentity>
  *
  * Returns:
- *  GD_TRUE if the affine is rectilinear or GD_FALSE
+ *  GD_TRUE on success or GD_FALSE on failure
  */
 int gdAffineInvert (double dst[6], const double src[6])
 {

ext/gd/tests/bug47946.phpt

@@ -1,11 +1,9 @@
 --TEST--
 Bug #47946 (ImageConvolution overwrites background)
---DESCRIPTION--
-The expected image has black pixel artifacts, what is another issue, though
-(perhaps #40158).
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream fix not yet released');
 ?>
 --FILE--
 <?php

ext/gd/tests/bug79067.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #79067 (gdTransformAffineCopy() may use unitialized values)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$matrix = [1, 1, 1, 1, 1, 1];
+$src = imagecreatetruecolor(8, 8);
+var_dump(imageaffine($src, $matrix));
+?>
+--EXPECT--
+bool(false)

ext/gd/tests/bug79068.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #79068 (gdTransformAffineCopy() changes interpolation method)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . '/func.inc';
+
+$src = imagecreatetruecolor(100, 100);
+imagefilledrectangle($src, 0, 0, 99, 99, 0xffffff);
+imageline($src, 10, 10, 90, 90, 0x000000);
+imagesetinterpolation($src, IMG_BSPLINE);
+imageaffine($src, [1, 1, 1, 1, 1, 1]);
+$dst = imagerotate($src, 80, 0xffffff);
+
+test_image_equals_file(__DIR__ . '/bug79068.png', $dst);
+?>
+--EXPECT--
+The images are equal.

ext/intl/formatter/formatter.c

@@ -51,7 +51,9 @@ void formatter_register_constants( INIT_FUNC_ARGS )
 	FORMATTER_EXPOSE_CLASS_CONST( DURATION );
 	FORMATTER_EXPOSE_CLASS_CONST( PATTERN_RULEBASED );
 	FORMATTER_EXPOSE_CLASS_CONST( IGNORE );
-
+#if U_ICU_VERSION_MAJOR_NUM >= 53
+	FORMATTER_EXPOSE_CLASS_CONST( CURRENCY_ACCOUNTING );
+#endif
 	FORMATTER_EXPOSE_CUSTOM_CLASS_CONST( "DEFAULT_STYLE",  UNUM_DEFAULT );
 
 	/* UNumberFormatRoundingMode */

ext/intl/locale/locale_methods.c

@@ -1285,7 +1285,7 @@ PHP_FUNCTION(locale_filter_matches)
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize loc_range" , 0 );
 			RETURN_FALSE;
@@ -1293,7 +1293,7 @@ PHP_FUNCTION(locale_filter_matches)
 
 		/* canonicalize lang_tag */
 		can_lang_tag = get_icu_value_internal( lang_tag , LOC_CANONICALIZE_TAG , &result ,  0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize lang_tag" , 0 );
 			RETURN_FALSE;

ext/intl/tests/bug78804.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #78804: Segmentation fault in Locale::filterMatches
+--FILE--
+<?php
+
+if (Locale::filterMatches('en-US', 'und', true)) {
+    echo 'Matches';
+} else {
+    echo 'Not matches';
+}
+?>
+--EXPECT--
+Not matches

ext/intl/tests/bug78912.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Request #78912 (INTL Support for accounting format)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension not available');
+if (version_compare(INTL_ICU_VERSION, '53.0') < 0) die('skip for ICU >= 53.0');
+?>
+--FILE--
+<?php
+$nf = new NumberFormatter('en_US', NumberFormatter::CURRENCY_ACCOUNTING);
+var_dump($nf->formatCurrency(-12345.67, 'USD'));
+?>
+--EXPECT--
+string(12) "($12,345.67)"

ext/libxml/libxml.c

@@ -355,6 +355,10 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
 	context = php_stream_context_from_zval(Z_ISUNDEF(LIBXML(stream_context))? NULL : &LIBXML(stream_context), 0);
 
 	ret_val = php_stream_open_wrapper_ex(path_to_open, (char *)mode, REPORT_ERRORS, NULL, context);
+	if (ret_val) {
+		/* Prevent from closing this by fclose() */
+		((php_stream*)ret_val)->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
+	}
 	if (isescaped) {
 		xmlFree(resolved_path);
 	}

ext/mbstring/libmbfl/filters/mbfilter_big5.c

@@ -145,10 +145,10 @@ static unsigned short cp950_pua_tbl[][4] = {
 static inline int is_in_cp950_pua(int c1, int c) {
 	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
 			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
-		return (c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff);
+		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
 	}
 	if (c1 == 0xc6) {
-		return c > 0xa0 && c < 0xff;
+		return c >= 0xa1 && c <= 0xfe;
 	}
 	return 0;
 }