Prepare for 7.3.27

Revert "Updated to version 2021.1 (2021a)"
This reverts commit 491488d217, since PHP-7.3 is in security mode, and this does not look security related.
2026-11-12 03:30:50 +00:00 · 2021-02-02 10:38:52 +01:00 · 2021-02-01 13:41:32 +01:00 · 2021-01-31 21:15:23 -08:00 · 2021-01-27 00:13:43 -08:00 · 2021-01-26 22:54:58 -08:00
552 changed files with 33401 additions and 28983 deletions
@@ -1,13 +1,595 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.13
+04 Feb 2021, PHP 7.3.27
+
+- SOAP:
+  . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
+
+07 Jan 2021, PHP 7.3.26
+
+- Standard:
+  . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). 
+    (CVE-2020-7071) (cmb)
+  . Fixed bug #80457 (stream_get_contents() fails with maxlength=-1 or default).
+    (bruno dot premont at restena dot lu)
+
+26 Nov 2020, PHP 7.3.25

 - Core:
+  . Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
+    (cmb)
+  . Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
+    (cmb)
+
+- COM:
+  . Fixed bug #62474 (com_event_sink crashes on certain arguments). (cmb)
+
+- DOM:
+  . Fixed bug #80268 (loadHTML() truncates at NUL bytes). (cmb)
+
+- IMAP:
+  . Fixed bug #64076 (imap_sort() does not return FALSE on failure). (cmb)
+  . Fixed bug #76618 (segfault on imap_reopen). (girgias)
+  . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb)
+  . Fixed minor regression caused by fixing bug #80220. (cmb)
+  . Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
+    (cmb)
+
+- Intl:
+  . Fixed bug #80310 (ext-intl with icu4c 68.1: use of undeclared identifier
+    'TRUE'). (Alexander M. Turek)
+
+- ODBC:
+  . Fixed bug #44618 (Fetching may rely on uninitialized data). (cmb)
+
+- SNMP:
+  . Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
+    (Alexander Bergmann, cmb)
+
+- Standard:
+  . Fixed bug #80266 (parse_url silently drops port number 0). (cmb, Nikita)
+
+29 Oct 2020, PHP 7.3.24
+
+- Core:
+  . Fixed bug #79423 (copy command is limited to size of file it can copy).
+    (cmb)
+
+- Calendar:
+  . Fixed bug #80185 (jdtounix() fails after 2037). (cmb)
+
+- IMAP:
+  . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
+  . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
+  . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
+  . Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
+    (cmb)
+  . Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
+    (cmb)
+  . Fixed bug #80226 (imap_sort() leaks sortpgm memory). (cmb)
+
+- MySQLnd:
+  . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with
+    slashes). (cmb)
+  . Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when
+    compression is enabled). (Nikita)
+
+- ODBC:
+  . Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable). (cmb)
+  . Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
+    (cmb)
+  . Fixed bug #80150 (Failure to fetch error message). (cmb)
+  . Fixed bug #80152 (odbc_execute() moves internal pointer of $params). (cmb)
+  . Fixed bug #46050 (odbc_next_result corrupts prepared resource). (cmb)
+
+- OPcache:
+  . Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data
+    binding). (Nikita)
+
+- PDO_ODBC:
+  . Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer). (cmb)
+
+- Standard:
+  . Fixed bug #80114 (parse_url does not accept URLs with port 0). (cmb, twosee)
+  . Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors). (cmb)
+  . Fixed bug #76735 (Incorrect message in fopen on invalid mode). (cmb)
+
+- Tidy:
+  . Fixed bug #77040 (tidyNode::isHtml() is completely broken). (cmb)
+
+01 Oct 2020, PHP 7.3.23
+
+- Core:
+  . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb)
+  . Fixed bug #80049 (Memleak when coercing integers to string via variadic
+    argument). (Nikita)
+  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` 
+    cookies can be sent). (CVE-2020-7070) (Stas)
+
+- Calendar:
+  . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
+    (Andy Postnikov)
+
+- COM:
+  . Fixed bug #64130 (COM obj parameters passed by reference are not updated).
+    (cmb)
+
+- OPcache:
+  . Fixed bug #80002 (calc free space for new interned string is wrong).
+    (t-matsuno)
+  . Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode
+    handlers changed). (SammyK)
+
+- OpenSSL:
+  . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 
+    bytes IV). (CVE-2020-7069) (Jakub Zelenka)
+
+- PDO:
+  . Fixed bug #80027 (Terrible performance using $query->fetch on queries with
+    many bind parameters). (Matteo)
+
+- SOAP:
+  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
+    "Transfer-Encoding: chunked"). (Matteo)
+
+- Standard:
+  . Fixed bug #79986 (str_ireplace bug with diacritics characters). (cmb)
+  . Fixed bug #80077 (getmxrr test bug). (Rainer Jung)
+  . Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
+    (cmb)
+  . Fixed bug #80067 (Omitting the port in bindto setting errors). (cmb)
+
+03 Sep 2020, PHP 7.3.22
+
+- Core:
+  . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
+  . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
+  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
+  . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
+    (Santiago M. Mola)
+  . Fixed bug #79919 (Stack use-after-scope in define()). (cmb)
+  . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
+    (Pieter van den Ham)
+
+- COM:
+  . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
+    (cmb)
+
+- Exif:
+  . Fixed bug #75785 (Many errors from exif_read_data).
+    (Níckolas Daniel da Silva)
+
+- Gettext:
+  . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
+    gettext()). (Florian Engelhardt)
+
+- LDAP:
+  . Fixed memory leaks. (ptomulik)
+
+- OPcache:
+  . Fixed bug #73060 (php failed with error after temp folder cleaned up).
+    (cmb)
+
+- PDO:
+  . Fixed bug #64705 (errorInfo property of PDOException is null when
+    PDO::__construct() fails). (Ahmed Abdou)
+
+- Standard:
+  . Fixed bug #79930 (array_merge_recursive() crashes when called with array
+    with single reference). (Nikita)
+  . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita)
+  . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita)
+
+- XML:
+  . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb)
+
+06 Aug 2020, PHP 7.3.21
+
+- Apache:
+  . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
+    to return usec). (Herbert256)
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+  . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
+    static variable). (Nikita)
+  . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
+    (Nikita)
+
+- COM:
+  . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb)
+  . Fixed bug #63527 (DCOM does not work with Username, Password parameter).
+    (cmb)
+
+- Curl:
+  . Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with
+    declared properties). (Nikita)
+
+- Fileinfo:
+  . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)
+
+- FTP:
+  . Fixed bug #55857 (ftp_size on large files). (cmb)
+
+- Mbstring:
+  . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+- Standard:
+  . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
+  . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita)
+  . Fixed bug #78008 (dns_check_record() always return true on Alpine).
+    (Andy Postnikov)
+
+09 Jul 2020, PHP 7.3.20
+
+- Core:
+  . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)
+  . Fixed bug #79668 (get_defined_functions(true) may miss functions). (cmb,
+    Nikita)
+  . Fixed possibly unsupported timercmp() usage. (cmb)
+
+- Exif:
+  . Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes). 
+    (cmb)
+
+- Filter:
+  . Fixed bug #73527 (Invalid memory access in php_filter_strip). (cmb)
+
+- GD:
+  . Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC). (cmb)
+
+- OpenSSL:
+  . Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
+    (cmb)
+
+- PDO SQLite:
+  . Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
+    (cmb)
+
+- SPL:
+  . Fixed bug #79710 (Reproducible segfault in error_handler during GC
+    involved an SplFileObject). (Nikita)
+
+- Standard:
+  . Fixed bug #74267 (segfault with streams and invalid data). (cmb)
+  . Fixed bug #79579 (ZTS build of PHP 7.3.17 doesn't handle ERANGE for
+    posix_getgrgid and others). (Böszörményi Zoltán)
+
+11 Jun 2020, PHP 7.3.19
+
+- Core:
+  . Fixed bug #79566 (Private SHM is not private on Windows). (cmb)
+  . Fixed bug #79489 (.user.ini does not inherit). (cmb)
+
+- GD:
+  . Fixed bug #79615 (Wrong GIF header written in GD GIFEncode). (sageptr, cmb)
+
+- MySQLnd:
+  . Fixed bug #79596 (MySQL FLOAT truncates to int some locales). (cmb)
+
+- Opcache:
+  . Fixed bug #79535 (PHP crashes with specific opcache.optimization_level).
+    (Nikita)
+  . Fixed bug #79588 (Boolean opcache settings ignore on/off values). (cmb)
+
+- Standard:
+  . Fixed bug #79561 (dns_get_record() fails with DNS_ALL). (cmb)
+
+14 May 2020, PHP 7.3.18
+
+- Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
+  . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
+    on !CS constant). (Nikita)
+  . Fixed bug #79477 (casting object into array creates references). (Nikita)
+  . Fixed bug #79470 (PHP incompatible with 3rd party file system on demand).
+    (cmb)
+  . Fixed bug #78784 (Unable to interact with files inside a VFS for Git
+    repository). (cmb)
+
+- DOM:
+  . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
+    (cmb)
+
+- FCGI:
+  . Fixed bug #79491 (Search for .user.ini extends up to root dir). (cmb)
+
+- MBString:
+  . Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
+    (Girgias)
+
+- OpenSSL:
+  . Fixed bug #79497 (stream_socket_client() throws an unknown error sometimes
+    with <1s timeout). (Joe Cai)
+
+- Phar:
+  . Fix bug #79503 (Memory leak on duplicate metadata). (cmb)
+
+- SimpleXML:
+  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
+    7.4.4). (cmb)
+
+- Standard:
+  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
+    appended). (dinosaur)
+
+16 Apr 2020, PHP 7.3.17
+
+- Core:
+  . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
+  . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita)
+
+- CURL:
+  . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb)
+
+- Date:
+  . Fixed bug #79396 (DateTime hour incorrect during DST jump forward). (Nate
+    Brunette)
+
+- Iconv:
+  . Fixed bug #79200 (Some iconv functions cut Windows-1258). (cmb)
+
+- OPcache:
+  . Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script).
+    (Dmitry)
+
+- Session:
+  . Fixed bug #79413 (session_create_id() fails for active sessions). (cmb)
+
+- Shmop:
+  . Fixed bug #79427 (Integer Overflow in shmop_open()). (cmb)
+
+- SimpleXML:
+  . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb)
+
+- Spl:
+  . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
+  . Fixed bug #79393 (Null coalescing operator failing with SplFixedArray).
+    (cmb)
+
+- Standard:
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (CVE-2020-7067) (stas)
+  . Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes
+    without newline). (Christian Schneider)
+
+- Zip:
+  . Fixed Bug #79296 (ZipArchive::open fails on empty file). (Remi)
+  . Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree).
+    (Max Rees)
+
+19 Mar 2020, PHP 7.3.16
+
+- Core:
+  . Fixed bug #63206 (restore_error_handler does not restore previous errors
+    mask). (Mark Plomer)
+
+- COM:
+  . Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location).
+    (cmb)
+  . Fixed bug #79242 (COM error constants don't match com_exception codes on
+    x86). (cmb)
+  . Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception). (cmb)
+  . Fixed bug #79299 (com_print_typeinfo prints duplicate variables). (Litiano
+    Moura)
+  . Fixed bug #79332 (php_istreams are never freed). (cmb)
+  . Fixed bug #79333 (com_print_typeinfo() leaks memory). (cmb)
+
+- DOM:
+  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
+    cmb)
+  . Fixed bug #79271 (DOMDocumentType::$childNodes is NULL). (cmb)
+
+- Enchant:
+  . Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture).
+    (cmb)
+
+- EXIF:
+  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064)
+    (Nikita)
+
+- MBstring:
+  . Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at 
+    php_unicode_tolower_full). (CVE-2020-7065) (cmb)
+
+- MySQLi:
+  . Fixed bug #64032 (mysqli reports different client_version). (cmb)
+
+- PCRE:
+  . Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback
+    and unicode). (Nikita)
+
+- PDO_ODBC:
+  . Fixed bug #79038 (PDOStatement::nextRowset() leaks column values). (cmb)
+
+- Reflection:
+  . Fixed bug #79062 (Property with heredoc default value returns false for
+    getDocComment). (Nikita)
+
+- SQLite3:
+  . Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). (cmb)
+
+- Standard:
+  . Fixed bug #79329 (get_headers() silently truncates after a null byte). 
+    (CVE-2020-7066) (cmb)
+  . Fixed bug #79254 (getenv() w/o arguments not showing changes). (cmb)
+  . Fixed bug #79265 (Improper injection of Host header when using fopen for
+    http requests). (Miguel Xavier Penha Neto)
+
+20 Feb 2020, PHP 7.3.15
+
+- Core:
+  . Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not
+    supported). (Nikita)
+  . Fixed bug #79146 (cscript can fail to run on some systems). (clarodeus)
+  . Fixed bug #78323 (Code 0 is returned on invalid options). (Ivan Mikheykin)
+  . Fixed bug #76047 (Use-after-free when accessing already destructed
+    backtrace arguments). (Nikita)
+
+- CURL:
+  . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
+    (cmb)
+
+- Intl:
+  . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb)
+
+- Libxml:
+  . Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).
+    (Nikita, cmb)
+
+- MBString:
+  . Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb)
+
+- MySQLnd:
+  . Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
+    (cmb)
+
+- OpenSSL:
+  . Fixed bug #79145 (openssl memory leak). (cmb, Nikita)
+
+- Phar:
+  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
+    all-access permissions). (CVE-2020-7063) (stas)
+  . Fixed bug #79171 (heap-buffer-overflow in phar_extract_file).
+    (CVE-2020-7061) (cmb)
+  . Fixed bug #76584 (PharFileInfo::decompress not working). (cmb)
+
+- Reflection:
+  . Fixed bug #79115 (ReflectionClass::isCloneable call reflected class
+    __destruct). (Nikita)
+
+- Session:
+  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
+    (CVE-2020-7062) (stas)
+
+- SPL:
+  . Fixed bug #79151 (heap use after free caused by
+    spl_dllist_it_helper_move_forward). (Nikita)
+
+- Standard:
+  . Fixed bug #78902 (Memory leak when using stream_filter_append). (liudaixiao)
+
+- Testing:
+  . Fixed bug #78090 (bug45161.phpt takes forever to finish). (cmb)
+
+- XSL:
+  . Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory). (cmb)
+
+23 Jan 2020, PHP 7.3.14
+
+- Core
+  . Fixed bug #78999 (Cycle leak when using function result as temporary).
+    (Dmitry)
+
+- CURL:
+  . Fixed bug #79033 (Curl timeout error with specific url and post). (cmb)
+
+- Date:
+  . Fixed bug #79015 (undefined-behavior in php_date.c). (cmb)
+
+- DBA:
+  . Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached).
+    (cmb)
+
+- Fileinfo:
+  . Fixed bug #74170 (locale information change after mime_content_type).
+    (Sergei Turchanov)
+
+- GD:
+  . Fixed bug #78923 (Artifacts when convoluting image with transparency).
+    (wilson chen)
+  . Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values). (cmb)
+  . Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method).
+    (cmb)
+
+- Libxml:
+  . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
+
+- Mbstring:
+  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
+    (CVE-2020-7060) (Nikita)
+
+- OPcache:
+  . Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). (cmb)
+
+- Pcntl:
+  . Fixed bug #78402 (Converting null to string in error message is bad DX).
+    (SATŌ Kentarō)
+
+- PDO_PgSQL:
+  . Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h). (SATŌ
+    Kentarō)
+  . Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection). (SATŌ
+    Kentarō)
+  . Fixed bug #78982 (pdo_pgsql returns dead persistent connection). (SATŌ
+    Kentarō)
+
+- Session:
+  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
+
+- Shmop:
+  . Fixed bug #78538 (shmop memory leak). (cmb)
+
+- Standard:
+  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
+  . Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF).
+    (cmb)
+
+18 Dec 2019, PHP 7.3.13
+
+- Bcmath:
+  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
+    (cmb)
+
+- Core:
+  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
+    (CVE-2019-11044). (cmb)
+  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
+    byte). (CVE-2019-11045). (cmb)
+  . Fixed bug #78943 (mail() may release string with refcount==1 twice).
+    (CVE-2019-11049). (cmb)
  . Fixed bug #78787 (Segfault with trait overriding inherited private shadow
    property). (Nikita)
+  . Fixed bug #78868 (Calling __autoload() with incorrect EG(fake_scope) value).
+    (Antony Dovgal, Dmitry)
+  . Fixed bug #78296 (is_file fails to detect file). (cmb)
+
+- EXIF:
+  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
+    (CVE-2019-11050). (Nikita)
+  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
+    (Nikita)
+
+- GD:
+  . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb)
+
+- MBString:
+  . Upgraded bundled Oniguruma to 6.9.4. (cmb)
+
+- OPcache:
+  . Fixed potential ASLR related invalid opline handler issues. (cmb)
+  . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
+    (Tyson Andre)
+
+- PCRE:
+  . Fixed bug #78853 (preg_match() may return integer > 1). (cmb)

 - Standard:
  . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
+  . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb)
+  . Fixed bug #78840 (imploding $GLOBALS crashes). (cmb)
+  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
+    (cmb)
+  . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
+    (cmb)

 21 Nov 2019, PHP 7.3.12

@@ -616,14 +616,16 @@ TSRM_API int shmget(key_t key, size_t size, int flags)
 {/*{{{*/
 	shm_pair *shm;
 	char shm_segment[26], shm_info[29];
-	HANDLE shm_handle, info_handle;
+	HANDLE shm_handle = NULL, info_handle = NULL;
 	BOOL created = FALSE;

-	snprintf(shm_segment, sizeof(shm_segment), "TSRM_SHM_SEGMENT:%d", key);
-	snprintf(shm_info, sizeof(shm_info), "TSRM_SHM_DESCRIPTOR:%d", key);
+	if (key != IPC_PRIVATE) {
+		snprintf(shm_segment, sizeof(shm_segment), "TSRM_SHM_SEGMENT:%d", key);
+		snprintf(shm_info, sizeof(shm_info), "TSRM_SHM_DESCRIPTOR:%d", key);

-	shm_handle  = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_segment);
-	info_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_info);
+		shm_handle  = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_segment);
+		info_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_info);
+	}

 	if (!shm_handle && !info_handle) {
 		if (flags & IPC_CREAT) {
@@ -634,8 +636,8 @@ TSRM_API int shmget(key_t key, size_t size, int flags)
 			DWORD high = 0;
 			DWORD low = size;
 #endif
-			shm_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, shm_segment);
-			info_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(shm->descriptor), shm_info);
+			shm_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, key == IPC_PRIVATE ? NULL : shm_segment);
+			info_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(shm->descriptor), key == IPC_PRIVATE ? NULL : shm_info);
 			created		= TRUE;
 		}
 		if (!shm_handle || !info_handle) {
@@ -721,6 +723,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 TSRM_API int shmdt(const void *shmaddr)
 {/*{{{*/
 	shm_pair *shm = shm_get(0, (void*)shmaddr);
+	int ret;

 	if (!shm->segment) {
 		return -1;
@@ -730,7 +733,12 @@ TSRM_API int shmdt(const void *shmaddr)
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch--;

-	return UnmapViewOfFile(shm->addr) ? 0 : -1;
+	ret = UnmapViewOfFile(shm->addr) ? 0 : -1;
+	if (!ret  && shm->descriptor->shm_nattch <= 0) {
+		ret = UnmapViewOfFile(shm->descriptor) ? 0 : -1;
+		shm->descriptor = NULL;
+	}
+	return ret;
 }/*}}}*/

 TSRM_API int shmctl(int key, int cmd, struct shmid_ds *buf)
@@ -112,6 +112,12 @@ BCMath:
  . bcmul() and bcpow() now return numbers with the requested scale. Formerly,
    the returned numbers may have omitted trailing decimal zeroes.

+DOM:
+  . As of PHP 7.3.16, the value of the $childNodes property of DOMDocument,
+    DOMNode, DOMProcessingInstruction, DOMComment, DOMText, DOMCdataSection and
+    DOMNotation is now an empty DOMNodeList instead of NULL, according to the
+    W3C and WHATWG standards and the PHP manual.
+
 IMAP:
  rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want
  to enable them. Note that the IMAP library does not filter mailbox names before
@@ -145,6 +151,11 @@ Reflection:
  . Reflection export to string now uses `int` and `bool` instead of `integer`
    and `boolean`.

+- SAPI:
+  . Starting with 7.3.23, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 SPL:
  . If an SPL autoloader throws an exception, following autoloaders will not be
    executed. Previously all autoloaders were executed and exceptions were
@@ -490,6 +501,12 @@ JSON:
 Curl:
  . libcurl >= 7.15.5 is now required.

+ DBA:
+   . As of PHP 7.3.14, dba_open() accepts a fifth optional parameter for lmdb
+     databases which allows to specify the mapsize. The parameter defaults to
+     zero, in which case the compiled in default mapsize (usually 1048576) will
+     be used. The mapsize should be a multiple of the page size of the OS.
+
 Filter:
  . FILTER_VALIDATE_FLOAT now also supports a `thousand` option, which
    defines the set of allowed thousand separator chars.  The default (`"',."`)
@@ -116,16 +116,16 @@ int main()
 		double d = (double) LONG_MIN * LONG_MIN + 2e9;

 		if ((long) d == 2e9 && (long) -d == -2e9) {
-			exit(0);
+			return 0;
 		}
 	} else if (sizeof(long) == 8) {
 		double correct = 18e18 - ((double) LONG_MIN * -2); /* Subtract ULONG_MAX + 1 */

 		if ((long) 18e18 == correct) { /* On 64-bit, only check between LONG_MAX and ULONG_MAX */
-			exit(0);
+			return 0;
 		}
 	}
-	exit(1);
+	return 1;
 }
 ]])], [
  AC_DEFINE([ZEND_DVAL_TO_LVAL_CAST_OK], 1, [Define if double cast to long preserves least significant bits])
@@ -249,7 +249,7 @@ int main()
  fprintf(fp, "%d %d\n", ZEND_MM_ALIGNMENT, zeros);
  fclose(fp);

-  exit(0);
+  return 0;
 }
 ]])], [
  LIBZEND_MM_ALIGN=`cat conftest.zend | cut -d ' ' -f 1`
@@ -318,6 +318,7 @@ AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <sys/mman.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <unistd.h>
 #ifndef MAP_ANON
 # ifdef MAP_ANONYMOUS
 #  define MAP_ANON MAP_ANONYMOUS
@@ -63,7 +63,10 @@ dnl Check for broken sprintf()
 dnl
 AC_DEFUN([AC_ZEND_BROKEN_SPRINTF],[
  AC_CACHE_CHECK(whether sprintf is broken, ac_cv_broken_sprintf,[
-    AC_RUN_IFELSE([AC_LANG_SOURCE([[main() {char buf[20];exit(sprintf(buf,"testing 123")!=11); }]])],[
+    AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <stdio.h>
+int main() {char buf[20]; return sprintf(buf,"testing 123")!=11; }
+]])],[
      ac_cv_broken_sprintf=no
    ],[
      ac_cv_broken_sprintf=yes
@@ -0,0 +1,16 @@
+--TEST--
+Array addition should not add INDIRECT elements
+--FILE--
+<?php
+
+$x = 1;
+$ary = ['y' => 1];
+$ary += $GLOBALS;
+var_dump($ary['x']);
+$x = 2;
+var_dump($ary['x']);
+
+?>
+--EXPECT--
+int(1)
+int(1)
@@ -0,0 +1,10 @@
+--TEST--
+Add $GLOBALS to itself
+--FILE--
+<?php
+$GLOBALS += $GLOBALS;
+$x = $GLOBALS + $GLOBALS;
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -94,7 +94,7 @@ L0:
 	}
 }));

-assert(0 && ($a = function &(array &$a, X $b = null) use ($c,&$d) : X {
+assert(0 && ($a = function &(?array &$a, X $b = null) use ($c,&$d) : X {
 	class A {
 		use T1, T2 {
 			T1::foo insteadof foo;
@@ -244,7 +244,7 @@ Warning: assert(): assert(0 && ($a = function &(array &$a, X $b = null) use($c,

 })) failed in %sexpect_015.php on line %d

-Warning: assert(): assert(0 && ($a = function &(array &$a, X $b = null) use($c, &$d): X {
+Warning: assert(): assert(0 && ($a = function &(?array &$a, X $b = null) use($c, &$d): X {
    class A {
        use T1, T2 {
            T1::foo insteadof foo;
@@ -0,0 +1,13 @@
+--TEST--
+Assign concat of array and empty string
+--FILE--
+<?php
+
+$a = [0];
+$a .= '';
+var_dump($a);
+
+?>
+--EXPECTF--
+Notice: Array to string conversion in %s on line %d
+string(5) "Array"
@@ -25,9 +25,8 @@ try {
 --EXPECTF--
 1. Exception: aaa in %sbug52361.php:5
 Stack trace:
-#0 %sbug52361.php(13): aaa->__destruct()
-#1 %sbug52361.php(16): bbb()
-#2 {main}
+#0 %sbug52361.php(16): aaa->__destruct()
+#1 {main}
 2. Exception: bbb in %sbug52361.php:13
 Stack trace:
 #0 %sbug52361.php(16): bbb()
@@ -26,7 +26,7 @@ namespace N2 {
    echo $a->hello(), PHP_EOL;
    echo $a->foo(), PHP_EOL;
    try {
-    } catch(namespace \Foo $e)
+    } catch(namespace\Foo $e)
    {
    }
 }
@@ -0,0 +1,29 @@
+--TEST--
+Bug #63206 Fully support error_handler stacking, even inside the error_handler
+--FILE--
+<?php
+
+set_error_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_error_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+
+    set_error_handler(function() {
+        echo 'Internal handler' . PHP_EOL;
+    });
+
+    $triggerInternalNotice++; // warnings while handling the error should go into internal handler
+
+    restore_error_handler();
+});
+
+$triggerNotice1++;
+$triggerNotice2++;
+?>
+--EXPECTF--
+Second handler
+Internal handler
+Second handler
+Internal handler
@@ -0,0 +1,26 @@
+--TEST--
+Bug #63206 Fully support error_handler stacking, even with null
+--FILE--
+<?php
+
+set_error_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_error_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+});
+
+set_error_handler(null);
+
+set_error_handler(function() {
+    echo 'Fourth handler' . PHP_EOL;
+});
+
+restore_error_handler();
+restore_error_handler();
+
+$triggerNotice++;
+?>
+--EXPECTF--
+Second handler
@@ -0,0 +1,26 @@
+--TEST--
+Bug #63206 Fully support exception_handler stacking, even with null
+--FILE--
+<?php
+
+set_exception_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_exception_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+});
+
+set_exception_handler(null);
+
+set_exception_handler(function() {
+    echo 'Fourth handler' . PHP_EOL;
+});
+
+restore_exception_handler();
+restore_exception_handler();
+
+throw new Exception();
+?>
+--EXPECTF--
+Second handler
@@ -0,0 +1,68 @@
+--TEST--
+Bug #76047: Use-after-free when accessing already destructed backtrace arguments
+--FILE--
+<?php
+
+class Vuln {
+    public $a;
+    public function __destruct() {
+        unset($this->a);
+        $backtrace = (new Exception)->getTrace();
+        var_dump($backtrace);
+    }
+}
+
+function test($arg) {
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+function test2($arg) {
+    $$arg = 1; // Trigger symbol table
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+test('x');
+test2('x');
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}
@@ -0,0 +1,33 @@
+--TEST--
+Bug #78868: Calling __autoload() with incorrect EG(fake_scope) value
+--FILE--
+<?php
+class C {
+	private $private = 1;
+
+	function foo() {
+		$this->private++; //fails with EG(fake_scope) != NULL && EG(fake_scope) != "C"
+	}
+}
+
+class A {
+	static $foo = B::foo; //not resolved on include()
+}
+
+function main_autoload($class_name) {
+	$c = new C;
+	$c->foo();
+	//doesn't affect the error
+	eval("class B {const foo = 1;}");
+}
+
+spl_autoload_register('main_autoload', false);
+
+$classA = new ReflectionClass("A");
+$props = $classA->getProperties();
+$props[0]->setValue(2); //causes constant resolving, which runs autoload, all with EG(fake_scope) == "A"
+
+echo "OK\n";
+?>
+--EXPECT--
+OK
@@ -0,0 +1,36 @@
+--TEST--
+Bug #78921: When Reflection triggers class load, property visibility is incorrect
+--FILE--
+<?php
+
+spl_autoload_register(function($className) {
+    if ($className == 'PrivateStatic') {
+        class PrivateStatic
+        {
+            const SOME_CONST = 13;
+            private static $privateStaticVarArray = ['a', 'b', 'c'];
+            private static $otherStatic;
+            public static function init()
+            {
+                self::$otherStatic = self::$privateStaticVarArray;
+            }
+        }
+        PrivateStatic::init();
+    }
+});
+
+class OtherClass
+{
+    const MY_CONST = PrivateStatic::SOME_CONST;
+    public static $prop = 'my property';
+}
+
+$reflectionClass = new ReflectionClass('OtherClass');
+$reflectionProperty = $reflectionClass->getProperty('prop');
+$reflectionProperty->setAccessible(true);
+$value = $reflectionProperty->getValue();
+echo "Value is $value\n";
+
+?>
+--EXPECT--
+Value is my property
@@ -0,0 +1,17 @@
+--TEST--
+Bug #78999 (Cycle leak when using function result as temporary)
+--FILE--
+<?php
+function get() {
+	$t = new stdClass;
+	$t->prop = $t;
+	return $t;
+}
+var_dump(get());
+var_dump(gc_collect_cycles());
+--EXPECT--
+object(stdClass)#1 (1) {
+  ["prop"]=>
+  *RECURSION*
+}
+int(1)
@@ -0,0 +1,22 @@
+--TEST--
+Bug #79364 (When copy empty array, next key is unspecified)
+--FILE--
+<?php
+$a = [1, 2];
+unset($a[1], $a[0]);
+$b = $a;
+
+$a[] = 3;
+$b[] = 4;
+
+var_dump($a, $b);
+?>
+--EXPECT--
+array(1) {
+  [2]=>
+  int(3)
+}
+array(1) {
+  [2]=>
+  int(4)
+}
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79477: casting object into array creates references
+--FILE--
+<?php
+
+class Test {
+	public $prop = 'default value';
+}
+
+$obj = new Test;
+$obj->{1} = null;
+
+$arr = (array) $obj;
+$arr['prop'] = 'new value';
+
+echo $obj->prop, "\n";
+
+?>
+--EXPECT--
+default value
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79668 (get_defined_functions(true) may miss functions)
+--INI--
+disable_functions=sha1_file,password_hash
+--FILE--
+<?php
+$df = get_defined_functions(true);
+foreach (['sha1', 'sha1_file', 'hash', 'password_hash'] as $funcname) {
+    var_dump(in_array($funcname, $df['internal'], true));
+}
+?>
+--EXPECT--
+bool(true)
+bool(false)
+bool(true)
+bool(false)
@@ -0,0 +1,26 @@
+--TEST--
+Bug #79778: Assertion failure if dumping closure with unresolved static variable
+--FILE--
+<?php
+$closure1 = function() {
+    static $var = CONST_REF;
+};
+var_dump($closure1);
+print_r($closure1);
+?>
+--EXPECT--
+object(Closure)#1 (1) {
+  ["static"]=>
+  array(1) {
+    ["var"]=>
+    string(14) "<constant ast>"
+  }
+}
+Closure Object
+(
+    [static] => Array
+        (
+            [var] => <constant ast>
+        )
+
+)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79792: HT iterators not removed if empty array is destroyed
+--FILE--
+<?php
+$a = [42];
+foreach ($a as &$c) {
+    // Make the array empty.
+    unset($a[0]);
+    // Destroy the array.
+    $a = null;
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79919 (Stack use-after-scope in define())
+--SKIPIF--
+<?php
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+?>
+--FILE--
+<?php
+$b = error_log(0);
+$b = simplexml_load_string('<xml/>', null, $b);
+define(0, $b);
+?>
+--EXPECT--
+0
@@ -0,0 +1,29 @@
+--TEST--
+Bug #79934: CRLF-only line in heredoc causes parsing error
+--DESCRIPTION--
+This test covers different variations of whitespace-only lines in heredoc strings.
+These whitespace-only lines should be ignored when stripping indentation.
+--FILE--
+<?php
+// lines with only CRLF should not cause a parse error
+eval("\$s1 = <<<HEREDOC\r\n    a\r\n\r\n    b\r\n    HEREDOC;");
+var_dump(addcslashes($s1, "\r\n"));
+
+// lines with only a LF should not cause a parse error
+eval("\$s2 = <<<HEREDOC\n    a\n\n    b\n    HEREDOC;");
+var_dump(addcslashes($s2, "\n"));
+
+// lines with only a CR should not cause a parse error
+eval("\$s3 = <<<HEREDOC\r    a\r\r    b\r    HEREDOC;");
+var_dump(addcslashes($s3, "\r"));
+
+// lines with only whitespace should not cause a parse error
+eval("\$s4 = <<<HEREDOC\r    a\r\n  \r\n    b\r    HEREDOC;");
+var_dump(addcslashes($s4, "\n\r"));
+
+?>
+--EXPECT--
+string(10) "a\r\n\r\nb"
+string(6) "a\n\nb"
+string(6) "a\r\rb"
+string(10) "a\r\n\r\nb"
@@ -0,0 +1,14 @@
+--TEST--
+Bug #80049: Memleak when coercing integers to string via variadic argument
+--FILE--
+<?php
+function coerceToString(string ...$strings) {
+    var_dump($strings);
+}
+coerceToString(...[123]);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(3) "123"
+}
@@ -9,6 +9,7 @@ namespace {

    var_dump(FOO); // Ok
    var_dump(foo); // Deprecated
+    var_dump(\foo); // Deprecated

    var_dump(NS\FOO); // Ok
    var_dump(ns\FOO); // Ok
@@ -72,10 +73,13 @@ int(42)

 Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 8
 int(42)
+
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 9
+int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 12
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 13
 int(24)
 bool(true)
 bool(true)
@@ -84,24 +88,24 @@ bool(true)
 bool(true)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 21
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 22
 int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 24
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 25
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 29
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 30
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 34
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 35
 int(24)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 39
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 40
 int(42)
 bool(true)
 bool(true)
@@ -110,18 +114,18 @@ bool(true)
 bool(true)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 48
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 49
 int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 51
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 52
 int(24)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 55
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 56
 int(42)
 int(43)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 59
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 60
 int(43)
@@ -0,0 +1,9 @@
+--TEST--
+Incorrect constant evaluation of and/or (OSS-Fuzz #19255)
+--FILE--
+<?php
+const C = 0 && __namespace__;
+var_dump(C);
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,28 @@
+--TEST--
+Freeing of function "name" when dynamic call fails
+--FILE--
+<?php
+
+try {
+    $bar = "bar";
+    ("foo" . $bar)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $bar = ["bar"];
+    (["foo"] + $bar)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    (new stdClass)();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Call to undefined function foobar()
+Function name must be a string
+Function name must be a string
@@ -0,0 +1,20 @@
+--TEST--
+Leak when setting recursive previous exception in finally handling
+--FILE--
+<?php
+
+try {
+    try {
+        throw new Exception("Test");
+    } catch (Exception $e) {
+        throw $e;
+    } finally {
+        throw $e;
+    }
+} catch (Exception $e2) {
+    echo $e2->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Test
@@ -0,0 +1,30 @@
+--TEST--
+Generator exceptions during shutdown should not be swallowed
+--FILE--
+<?php
+
+function gen() {
+    try {
+        echo "before yield\n";
+        yield;
+        echo "after yield\n";
+    } finally {
+        echo "before yield in finally\n";
+        yield;
+        echo "after yield in finally\n";
+    }
+    echo "after finally\n";
+}
+
+$gen = gen();
+$gen->rewind();
+
+?>
+--EXPECTF--
+before yield
+before yield in finally
+
+Fatal error: Uncaught Error: Cannot yield from finally in a force-closed generator in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,18 @@
+--TEST--
+Yield from non-iterable
+--FILE--
+<?php
+
+function gen() {
+    yield from new stdClass;
+}
+
+try {
+    gen()->current();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Can use "yield from" only with arrays and Traversables
@@ -0,0 +1,30 @@
+--TEST--
+Exception from valid() during yield from
+--FILE--
+<?php
+
+class FooBar implements Iterator {
+    function rewind() {}
+    function current() {}
+    function key() {}
+    function next() {}
+    function valid() {
+        throw new Exception("Exception from valid()");
+    }
+}
+
+function gen() {
+    try {
+        // the fact that the yield from result is used is relevant.
+        var_dump(yield from new FooBar);
+    } catch (Exception $e) {
+        echo $e->getMessage(), "\n";
+    }
+}
+
+$x = gen();
+$x->current();
+
+?>
+--EXPECT--
+Exception from valid()
@@ -0,0 +1,16 @@
+--TEST--
+String offset error during list() by-ref assignment
+--FILE--
+<?php
+
+$a = [0];
+$v = 'b';
+$i = 0;
+list(&$a[$i++]) = $v;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot create references to/from string offsets in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -6,6 +6,7 @@ No warnings should be thrown during heredoc scan-ahead
 <<<TEST
 ${x}
 \400
+${"\400"}
 ${/*}
 TEST;

@@ -15,6 +16,8 @@ Warning: Unexpected character in input:  '' (ASCII=1) state=0 in %s on line %d

 Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d

+Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d
+
 Warning: Unterminated comment starting line %d in %s on line %d

 Parse error: syntax error, unexpected end of file in %s on line %d
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.13-dev"
+#define ZEND_VERSION "3.3.27"

 #define ZEND_ENGINE_3

@@ -4082,6 +4082,12 @@ ZEND_API int zend_update_static_property_ex(zend_class_entry *scope, zend_string
 	zval *property;
 	zend_class_entry *old_scope = EG(fake_scope);

+	if (UNEXPECTED(!(scope->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
+		if (UNEXPECTED(zend_update_class_constants(scope)) != SUCCESS) {
+			return FAILURE;
+		}
+	}
+
 	EG(fake_scope) = scope;
 	property = zend_std_get_static_property(scope, name, 0);
 	EG(fake_scope) = old_scope;
@@ -4224,7 +4230,7 @@ ZEND_API void zend_save_error_handling(zend_error_handling *current) /* {{{ */
 {
 	current->handling = EG(error_handling);
 	current->exception = EG(exception_class);
-	ZVAL_COPY(&current->user_handler, &EG(user_error_handler));
+	ZVAL_UNDEF(&current->user_handler);
 }
 /* }}} */

@@ -4232,54 +4238,17 @@ ZEND_API void zend_replace_error_handling(zend_error_handling_t error_handling,
 {
 	if (current) {
 		zend_save_error_handling(current);
-		if (error_handling != EH_NORMAL && Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
-			zval_ptr_dtor(&EG(user_error_handler));
-			ZVAL_UNDEF(&EG(user_error_handler));
-		}
 	}
+	ZEND_ASSERT(error_handling == EH_THROW || exception_class == NULL);
 	EG(error_handling) = error_handling;
-	EG(exception_class) = error_handling == EH_THROW ? exception_class : NULL;
-}
-/* }}} */
-
-static int same_zval(zval *zv1, zval *zv2)  /* {{{ */
-{
-	if (Z_TYPE_P(zv1) != Z_TYPE_P(zv2)) {
-		return 0;
-	}
-	switch (Z_TYPE_P(zv1)) {
-		case IS_UNDEF:
-		case IS_NULL:
-		case IS_FALSE:
-		case IS_TRUE:
-			return 1;
-		case IS_LONG:
-			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
-		case IS_DOUBLE:
-			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
-		case IS_STRING:
-		case IS_ARRAY:
-		case IS_OBJECT:
-		case IS_RESOURCE:
-			return Z_COUNTED_P(zv1) == Z_COUNTED_P(zv2);
-		default:
-			return 0;
-	}
+	EG(exception_class) = exception_class;
 }
 /* }}} */

 ZEND_API void zend_restore_error_handling(zend_error_handling *saved) /* {{{ */
 {
 	EG(error_handling) = saved->handling;
-	EG(exception_class) = saved->handling == EH_THROW ? saved->exception : NULL;
-	if (Z_TYPE(saved->user_handler) != IS_UNDEF
-		&& !same_zval(&saved->user_handler, &EG(user_error_handler))) {
-		zval_ptr_dtor(&EG(user_error_handler));
-		ZVAL_COPY_VALUE(&EG(user_error_handler), &saved->user_handler);
-	} else if (Z_TYPE(saved->user_handler)) {
-		zval_ptr_dtor(&saved->user_handler);
-	}
-	ZVAL_UNDEF(&saved->user_handler);
+	EG(exception_class) = saved->exception;
 }
 /* }}} */

@@ -2103,6 +2103,7 @@ static zend_long zend_mm_find_leaks(zend_mm_heap *heap, zend_mm_chunk *p, uint32
 			}
 		}
 		p = p->next;
+		i = ZEND_MM_FIRST_PAGE;
 	} while (p != heap->main_chunk);
 	return count;
 }
@@ -1463,7 +1463,7 @@ simple_list:
 			}
 			break;
 		case ZEND_AST_TYPE:
-			switch (ast->attr) {
+			switch (ast->attr & ~ZEND_TYPE_NULLABLE) {
 				case IS_ARRAY:    APPEND_STR("array");
 				case IS_CALLABLE: APPEND_STR("callable");
 				EMPTY_SWITCH_DEFAULT_CASE();
@@ -882,9 +882,7 @@ repeat:
 		case IS_OBJECT:
 			if (Z_TYPE(val_free) == IS_UNDEF) {
 				if (Z_OBJ_HT_P(val)->get) {
-					zval rv;
-					val = Z_OBJ_HT_P(val)->get(val, &rv);
-					ZVAL_COPY_VALUE(&val_free, val);
+					val = Z_OBJ_HT_P(val)->get(val, &val_free);
 					goto repeat;
 				} else if (Z_OBJ_HT_P(val)->cast_object) {
 					if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) {
@@ -1665,11 +1663,11 @@ ZEND_FUNCTION(set_error_handler)

 	if (Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
 		ZVAL_COPY(return_value, &EG(user_error_handler));
-
-		zend_stack_push(&EG(user_error_handlers_error_reporting), &EG(user_error_handler_error_reporting));
-		zend_stack_push(&EG(user_error_handlers), &EG(user_error_handler));
 	}

+	zend_stack_push(&EG(user_error_handlers_error_reporting), &EG(user_error_handler_error_reporting));
+	zend_stack_push(&EG(user_error_handlers), &EG(user_error_handler));
+
 	if (Z_TYPE_P(error_handler) == IS_NULL) { /* unset user-defined handler */
 		ZVAL_UNDEF(&EG(user_error_handler));
 		return;
@@ -1732,10 +1730,10 @@ ZEND_FUNCTION(set_exception_handler)

 	if (Z_TYPE(EG(user_exception_handler)) != IS_UNDEF) {
 		ZVAL_COPY(return_value, &EG(user_exception_handler));
-
-		zend_stack_push(&EG(user_exception_handlers), &EG(user_exception_handler));
 	}

+	zend_stack_push(&EG(user_exception_handlers), &EG(user_exception_handler));
+
 	if (Z_TYPE_P(exception_handler) == IS_NULL) { /* unset user-defined handler */
 		ZVAL_UNDEF(&EG(user_exception_handler));
 		return;
@@ -1847,16 +1845,9 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 		return 0;
 	}

-	if (func->type == ZEND_INTERNAL_FUNCTION) {
-		char *disable_functions = INI_STR("disable_functions");
-
-		if ((*exclude_disabled == 1) && (disable_functions != NULL)) {
-			if (strstr(disable_functions, func->common.function_name->val) == NULL) {
-				add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-			}
-		} else {
-			add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-		}
+	if (func->type == ZEND_INTERNAL_FUNCTION
+		&& (!*exclude_disabled || func->internal_function.handler != ZEND_FN(display_disabled_function))) {
+		add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
 	} else if (func->type == ZEND_USER_FUNCTION) {
 		add_next_index_str(user_ar, zend_string_copy(hash_key->key));
 	}
@@ -506,9 +506,16 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	debug_info = zend_new_array(8);

 	if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
+		zval *var;
 		HashTable *static_variables = closure->func.op_array.static_variables;
 		ZVAL_ARR(&val, zend_array_dup(static_variables));
 		zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
+		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(val), var) {
+			if (Z_TYPE_P(var) == IS_CONSTANT_AST) {
+				zval_ptr_dtor(var);
+				ZVAL_STRING(var, "<constant ast>");
+			}
+		} ZEND_HASH_FOREACH_END();
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -659,6 +666,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 	if (func->type == ZEND_USER_FUNCTION) {
 		memcpy(&closure->func, func, sizeof(zend_op_array));
 		closure->func.common.fn_flags |= ZEND_ACC_CLOSURE;
+		closure->func.common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
 		if (closure->func.op_array.static_variables) {
 			closure->func.op_array.static_variables =
 				zend_array_dup(closure->func.op_array.static_variables);
@@ -669,7 +677,9 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 			|| func->common.scope != scope
 			|| (func->common.fn_flags & ZEND_ACC_NO_RT_ARENA)
 		) {
-			if (!func->op_array.run_time_cache && (func->common.fn_flags & ZEND_ACC_CLOSURE)) {
+			if (!func->op_array.run_time_cache
+			 && (func->common.fn_flags & ZEND_ACC_CLOSURE)
+			 && !(func->common.fn_flags & ZEND_ACC_IMMUTABLE)) {
 				/* If a real closure is used for the first time, we create a shared runtime cache
 				 * and remember which scope it is for. */
 				func->common.scope = scope;
@@ -8549,25 +8549,28 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 		case ZEND_AST_AND:
 		case ZEND_AST_OR:
 		{
-			int i;
-			for (i = 0; i <= 1; i++) {
-				zend_eval_const_expr(&ast->child[i]);
-				if (ast->child[i]->kind == ZEND_AST_ZVAL) {
-					if (zend_is_true(zend_ast_get_zval(ast->child[i])) == (ast->kind == ZEND_AST_OR)) {
-						ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
-						return;
-					}
-				}
-			}
-
-			if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
+			zend_bool child0_is_true, child1_is_true;
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+			if (ast->child[0]->kind != ZEND_AST_ZVAL) {
 				return;
 			}

+			child0_is_true = zend_is_true(zend_ast_get_zval(ast->child[0]));
+			if (child0_is_true == (ast->kind == ZEND_AST_OR)) {
+				ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
+				break;
+			}
+
+			if (ast->child[1]->kind != ZEND_AST_ZVAL) {
+				return;
+			}
+
+			child1_is_true = zend_is_true(zend_ast_get_zval(ast->child[1]));
 			if (ast->kind == ZEND_AST_OR) {
-				ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) || zend_is_true(zend_ast_get_zval(ast->child[1])));
+				ZVAL_BOOL(&result, child0_is_true || child1_is_true);
 			} else {
-				ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) && zend_is_true(zend_ast_get_zval(ast->child[1])));
+				ZVAL_BOOL(&result, child0_is_true && child1_is_true);
 			}
 			break;
 		}
@@ -76,9 +76,15 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 	zval  pv, zv, rv;
 	zend_class_entry *base_ce;

-	if (exception == add_previous || !add_previous || !exception) {
+	if (!exception || !add_previous) {
 		return;
 	}
+
+	if (exception == add_previous) {
+		OBJ_RELEASE(add_previous);
+		return;
+	}
+
 	ZVAL_OBJ(&pv, add_previous);
 	if (!instanceof_function(Z_OBJCE(pv), zend_ce_throwable)) {
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
@@ -1329,6 +1329,7 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
 					msg = "Cannot create references to/from string offsets";
 					break;
 				}
+				opline++;
 			}
 			break;
 		EMPTY_SWITCH_DEFAULT_CASE();
@@ -3364,11 +3365,15 @@ static zend_always_inline int _zend_quick_get_constant(
 				is_deprecated = !zend_string_equals(c->name, Z_STR_P(access_key));
 			} else {
 check_short_name:
-				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
-				ZEND_ASSERT(ns_sep);
 				/* Namespaces are always case-insensitive. Only compare shortname. */
-				shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
-				shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
+				if (ns_sep) {
+					shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
+					shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				} else {
+					shortname_offset = 0;
+					shortname_len = ZSTR_LEN(c->name);
+				}

 				is_deprecated = memcmp(ZSTR_VAL(c->name) + shortname_offset, Z_STRVAL_P(orig_key - 1) + shortname_offset, shortname_len) != 0;
 			}
@@ -836,6 +836,7 @@ ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, const zval *k
 	zend_string *lc_name;
 	zend_fcall_info fcall_info;
 	zend_fcall_info_cache fcall_cache;
+	zend_class_entry *orig_fake_scope;

 	if (key) {
 		lc_name = Z_STR_P(key);
@@ -922,11 +923,14 @@ ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, const zval *k
 	fcall_cache.called_scope = NULL;
 	fcall_cache.object = NULL;

+	orig_fake_scope = EG(fake_scope);
+	EG(fake_scope) = NULL;
 	zend_exception_save();
 	if ((zend_call_function(&fcall_info, &fcall_cache) == SUCCESS) && !EG(exception)) {
 		ce = zend_hash_find_ptr(EG(class_table), lc_name);
 	}
 	zend_exception_restore();
+	EG(fake_scope) = orig_fake_scope;

 	zval_ptr_dtor(&args[0]);
 	zval_ptr_dtor_str(&fcall_info.function_name);
@@ -253,10 +253,6 @@ static void zend_generator_free_storage(zend_object *object) /* {{{ */
 	}

 	zend_object_std_dtor(&generator->std);
-
-	if (generator->iterator) {
-		zend_iterator_dtor(generator->iterator);
-	}
 }
 /* }}} */

@@ -713,6 +709,9 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 		}

 		if (iter->funcs->valid(iter) == FAILURE) {
+			if (UNEXPECTED(EG(exception) != NULL)) {
+				goto exception;
+			}
 			/* reached end of iteration */
 			goto failure;
 		}
@@ -741,7 +740,7 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 	return SUCCESS;

 exception:
-	zend_rethrow_exception(generator->execute_data);
+	zend_generator_throw_exception(generator, NULL);

 failure:
 	zval_ptr_dtor(&generator->values);
@@ -827,9 +826,10 @@ try_again:
 		if (UNEXPECTED(EG(exception) != NULL)) {
 			if (generator == orig_generator) {
 				zend_generator_close(generator, 0);
-				if (EG(current_execute_data) &&
-				    EG(current_execute_data)->func &&
-				    ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
+				if (!EG(current_execute_data)) {
+					zend_throw_exception_internal(NULL);
+				} else if (EG(current_execute_data)->func &&
+						ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
 					zend_rethrow_exception(EG(current_execute_data));
 				}
 			} else {
@@ -1504,11 +1504,11 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 				}
 			} while (++p != end);
 		}
-		zend_hash_iterators_remove(ht);
-		SET_INCONSISTENT(HT_DESTROYED);
 	} else if (EXPECTED(!(HT_FLAGS(ht) & HASH_FLAG_INITIALIZED))) {
 		goto free_ht;
 	}
+	zend_hash_iterators_remove(ht);
+	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
 	FREE_HASHTABLE(ht);
@@ -1934,7 +1934,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
-		target->nNextFreeElement = 0;
+		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = 0;
 		HT_SET_DATA_ADDR(target, &uninitialized_bucket);
 	} else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {
@@ -1999,7 +1999,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 {
    uint32_t idx;
 	Bucket *p;
-	zval *t;
+	zval *t, *s;

 	IS_CONSISTENT(source);
 	IS_CONSISTENT(target);
@@ -2008,18 +2008,20 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	if (overwrite) {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
-			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
-			    continue;
+			s = &p->val;
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
+				s = Z_INDIRECT_P(s);
+			}
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
+				continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_UPDATE | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_UPDATE | HASH_UPDATE_INDIRECT);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_update(target, p->h, &p->val);
+				t = zend_hash_index_update(target, p->h, s);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -2028,18 +2030,20 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	} else {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
-			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
-			    continue;
+			s = &p->val;
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
+				s = Z_INDIRECT_P(s);
+			}
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
+				continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_ADD | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_ADD | HASH_UPDATE_INDIRECT);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_add(target, p->h, &p->val);
+				t = zend_hash_index_add(target, p->h, s);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -2722,7 +2726,7 @@ convert:
 	{
 		HashTable *new_ht = zend_new_array(zend_hash_num_elements(ht));

-		ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, zv) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(ht, num_key, str_key, zv) {
 			do {
 				if (Z_OPT_REFCOUNTED_P(zv)) {
 					if (Z_ISREF_P(zv) && Z_REFCOUNT_P(zv) == 1) {
@@ -334,7 +334,7 @@ ZEND_API int zend_alter_ini_entry_ex(zend_string *name, zend_string *new_value,
 {
 	zend_ini_entry *ini_entry;
 	zend_string *duplicate;
-	zend_bool modifiable;
+	uint8_t modifiable;
 	zend_bool modified;

 	if ((ini_entry = zend_hash_find_ptr(EG(ini_directives), name)) == NULL) {
@@ -310,7 +310,7 @@ static void zval_ini_dtor(zval *zv)
 %left '|' '&' '^'
 %right '~' '!'

-%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL
+%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL cfg_var_ref constant_literal constant_string encapsed_list expr option_offset section_string_or_value string_or_value var_string_list var_string_list_section

 %%

@@ -1,4 +1,4 @@
-/* Generated by re2c 1.0.1 */
+/* Generated by re2c 1.3 */
 #line 1 "Zend/zend_language_scanner.l"
 /*
   +----------------------------------------------------------------------+
@@ -1069,8 +1069,7 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								octal_buf[2] = *(++s);
 							}
 						}
-						if (octal_buf[2] &&
-						    (octal_buf[0] > '3')) {
+						if (octal_buf[2] && (octal_buf[0] > '3') && !SCNG(heredoc_scan_ahead)) {
 							/* 3 octit values must not overflow 0xFF (\377) */
 							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
 						}
@@ -1115,6 +1114,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -1454,7 +1454,7 @@ yy3:
 		++YYCURSOR;
 		YYDEBUG(4, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2765 "Zend/zend_language_scanner.l"
+#line 2768 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -2269,7 +2269,7 @@ yy62:
 		++YYCURSOR;
 		YYDEBUG(63, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2412 "Zend/zend_language_scanner.l"
+#line 2415 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_BACKQUOTE);
 	RETURN_TOKEN('`');
@@ -4730,6 +4730,7 @@ yy397:

 	if (is_heredoc && !SCNG(heredoc_scan_ahead)) {
 		zend_lex_state current_state;
+		zend_string *saved_doc_comment = CG(doc_comment);
 		int heredoc_nesting_level = 1;
 		int first_token = 0;
 		int error = 0;
@@ -4740,6 +4741,7 @@ yy397:
 		SCNG(heredoc_indentation) = 0;
 		SCNG(heredoc_indentation_uses_spaces) = 0;
 		LANG_SCNG(on_event) = NULL;
+		CG(doc_comment) = NULL;

 		zend_ptr_stack_reverse_apply(&current_state.heredoc_label_stack, copy_heredoc_label_stack);

@@ -4789,6 +4791,7 @@ yy397:
 		zend_restore_lexical_state(&current_state);
 		SCNG(heredoc_scan_ahead) = 0;
 		CG(increment_lineno) = 0;
+		CG(doc_comment) = saved_doc_comment;

 		if (PARSER_MODE() && error) {
 			RETURN_TOKEN(T_ERROR);
@@ -4797,7 +4800,7 @@ yy397:

 	RETURN_TOKEN(T_START_HEREDOC);
 }
-#line 4801 "Zend/zend_language_scanner.c"
+#line 4804 "Zend/zend_language_scanner.c"
 yy398:
 		YYDEBUG(398, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4821,7 +4824,7 @@ yy400:
 		{
 	RETURN_TOKEN(T_ARRAY);
 }
-#line 4825 "Zend/zend_language_scanner.c"
+#line 4828 "Zend/zend_language_scanner.c"
 yy402:
 		YYDEBUG(402, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4834,7 +4837,7 @@ yy402:
 		{
 	RETURN_TOKEN(T_BREAK);
 }
-#line 4838 "Zend/zend_language_scanner.c"
+#line 4841 "Zend/zend_language_scanner.c"
 yy404:
 		YYDEBUG(404, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4853,7 +4856,7 @@ yy405:
 		{
 	RETURN_TOKEN(T_CATCH);
 }
-#line 4857 "Zend/zend_language_scanner.c"
+#line 4860 "Zend/zend_language_scanner.c"
 yy407:
 		YYDEBUG(407, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4866,7 +4869,7 @@ yy407:
 		{
 	RETURN_TOKEN(T_CLASS);
 }
-#line 4870 "Zend/zend_language_scanner.c"
+#line 4873 "Zend/zend_language_scanner.c"
 yy409:
 		YYDEBUG(409, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4879,7 +4882,7 @@ yy409:
 		{
 	RETURN_TOKEN(T_CLONE);
 }
-#line 4883 "Zend/zend_language_scanner.c"
+#line 4886 "Zend/zend_language_scanner.c"
 yy411:
 		YYDEBUG(411, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4892,7 +4895,7 @@ yy411:
 		{
 	RETURN_TOKEN(T_CONST);
 }
-#line 4896 "Zend/zend_language_scanner.c"
+#line 4899 "Zend/zend_language_scanner.c"
 yy413:
 		YYDEBUG(413, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4929,7 +4932,7 @@ yy417:
 		{
 	RETURN_TOKEN(T_EMPTY);
 }
-#line 4933 "Zend/zend_language_scanner.c"
+#line 4936 "Zend/zend_language_scanner.c"
 yy419:
 		YYDEBUG(419, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4954,7 +4957,7 @@ yy421:
 		{
 	RETURN_TOKEN(T_ENDIF);
 }
-#line 4958 "Zend/zend_language_scanner.c"
+#line 4961 "Zend/zend_language_scanner.c"
 yy423:
 		YYDEBUG(423, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5000,7 +5003,7 @@ yy427:
 		{
 	RETURN_TOKEN(T_FINAL);
 }
-#line 5004 "Zend/zend_language_scanner.c"
+#line 5007 "Zend/zend_language_scanner.c"
 yy428:
 		YYDEBUG(428, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5061,7 +5064,7 @@ yy436:
 		{
 	RETURN_TOKEN(T_ISSET);
 }
-#line 5065 "Zend/zend_language_scanner.c"
+#line 5068 "Zend/zend_language_scanner.c"
 yy438:
 		YYDEBUG(438, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5080,7 +5083,7 @@ yy439:
 		{
 	RETURN_TOKEN(T_PRINT);
 }
-#line 5084 "Zend/zend_language_scanner.c"
+#line 5087 "Zend/zend_language_scanner.c"
 yy441:
 		YYDEBUG(441, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5135,7 +5138,7 @@ yy448:
 		{
 	RETURN_TOKEN(T_THROW);
 }
-#line 5139 "Zend/zend_language_scanner.c"
+#line 5142 "Zend/zend_language_scanner.c"
 yy450:
 		YYDEBUG(450, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5148,7 +5151,7 @@ yy450:
 		{
 	RETURN_TOKEN(T_TRAIT);
 }
-#line 5152 "Zend/zend_language_scanner.c"
+#line 5155 "Zend/zend_language_scanner.c"
 yy452:
 		YYDEBUG(452, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5161,7 +5164,7 @@ yy452:
 		{
 	RETURN_TOKEN(T_UNSET);
 }
-#line 5165 "Zend/zend_language_scanner.c"
+#line 5168 "Zend/zend_language_scanner.c"
 yy454:
 		YYDEBUG(454, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5174,7 +5177,7 @@ yy454:
 		{
 	RETURN_TOKEN(T_WHILE);
 }
-#line 5178 "Zend/zend_language_scanner.c"
+#line 5181 "Zend/zend_language_scanner.c"
 yy456:
 		YYDEBUG(456, *YYCURSOR);
 		yyaccept = 6;
@@ -5196,7 +5199,7 @@ yy457:
 		{
 	RETURN_TOKEN(T_YIELD);
 }
-#line 5200 "Zend/zend_language_scanner.c"
+#line 5203 "Zend/zend_language_scanner.c"
 yy458:
 		YYDEBUG(458, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5292,7 +5295,7 @@ yy471:
 		{
 	RETURN_TOKEN(T_BOOL_CAST);
 }
-#line 5296 "Zend/zend_language_scanner.c"
+#line 5299 "Zend/zend_language_scanner.c"
 yy474:
 		YYDEBUG(474, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5326,7 +5329,7 @@ yy478:
 		{
 	RETURN_TOKEN(T_DOUBLE_CAST);
 }
-#line 5330 "Zend/zend_language_scanner.c"
+#line 5333 "Zend/zend_language_scanner.c"
 yy480:
 		YYDEBUG(480, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5395,7 +5398,7 @@ yy489:
 		{
 	RETURN_TOKEN(T_ELSEIF);
 }
-#line 5399 "Zend/zend_language_scanner.c"
+#line 5402 "Zend/zend_language_scanner.c"
 yy491:
 		YYDEBUG(491, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5429,7 +5432,7 @@ yy493:
 		{
 	RETURN_TOKEN(T_ENDFOR);
 }
-#line 5433 "Zend/zend_language_scanner.c"
+#line 5436 "Zend/zend_language_scanner.c"
 yy494:
 		YYDEBUG(494, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5478,7 +5481,7 @@ yy500:
 		{
 	RETURN_TOKEN(T_GLOBAL);
 }
-#line 5482 "Zend/zend_language_scanner.c"
+#line 5485 "Zend/zend_language_scanner.c"
 yy502:
 		YYDEBUG(502, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5539,7 +5542,7 @@ yy510:
 		{
 	RETURN_TOKEN(T_PUBLIC);
 }
-#line 5543 "Zend/zend_language_scanner.c"
+#line 5546 "Zend/zend_language_scanner.c"
 yy512:
 		YYDEBUG(512, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5558,7 +5561,7 @@ yy513:
 		{
 	RETURN_TOKEN(T_RETURN);
 }
-#line 5562 "Zend/zend_language_scanner.c"
+#line 5565 "Zend/zend_language_scanner.c"
 yy515:
 		YYDEBUG(515, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5571,7 +5574,7 @@ yy515:
 		{
 	RETURN_TOKEN(T_STATIC);
 }
-#line 5575 "Zend/zend_language_scanner.c"
+#line 5578 "Zend/zend_language_scanner.c"
 yy517:
 		YYDEBUG(517, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5584,7 +5587,7 @@ yy517:
 		{
 	RETURN_TOKEN(T_SWITCH);
 }
-#line 5588 "Zend/zend_language_scanner.c"
+#line 5591 "Zend/zend_language_scanner.c"
 yy519:
 		YYDEBUG(519, *YYCURSOR);
 		++YYCURSOR;
@@ -5668,7 +5671,7 @@ yy530:
 		{
 	RETURN_TOKEN(T_ARRAY_CAST);
 }
-#line 5672 "Zend/zend_language_scanner.c"
+#line 5675 "Zend/zend_language_scanner.c"
 yy532:
 		YYDEBUG(532, *YYCURSOR);
 		++YYCURSOR;
@@ -5718,7 +5721,7 @@ yy538:
 		{
 	RETURN_TOKEN(T_UNSET_CAST);
 }
-#line 5722 "Zend/zend_language_scanner.c"
+#line 5725 "Zend/zend_language_scanner.c"
 yy540:
 		YYDEBUG(540, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5749,7 +5752,7 @@ yy543:
 		{
 	RETURN_TOKEN(T_DECLARE);
 }
-#line 5753 "Zend/zend_language_scanner.c"
+#line 5756 "Zend/zend_language_scanner.c"
 yy545:
 		YYDEBUG(545, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5762,7 +5765,7 @@ yy545:
 		{
 	RETURN_TOKEN(T_DEFAULT);
 }
-#line 5766 "Zend/zend_language_scanner.c"
+#line 5769 "Zend/zend_language_scanner.c"
 yy547:
 		YYDEBUG(547, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5799,7 +5802,7 @@ yy551:
 		{
 	RETURN_TOKEN(T_EXTENDS);
 }
-#line 5803 "Zend/zend_language_scanner.c"
+#line 5806 "Zend/zend_language_scanner.c"
 yy553:
 		YYDEBUG(553, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5812,7 +5815,7 @@ yy553:
 		{
 	RETURN_TOKEN(T_FINALLY);
 }
-#line 5816 "Zend/zend_language_scanner.c"
+#line 5819 "Zend/zend_language_scanner.c"
 yy555:
 		YYDEBUG(555, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5825,7 +5828,7 @@ yy555:
 		{
 	RETURN_TOKEN(T_FOREACH);
 }
-#line 5829 "Zend/zend_language_scanner.c"
+#line 5832 "Zend/zend_language_scanner.c"
 yy557:
 		YYDEBUG(557, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5863,7 +5866,7 @@ yy560:
 		{
 	RETURN_TOKEN(T_INCLUDE);
 }
-#line 5867 "Zend/zend_language_scanner.c"
+#line 5870 "Zend/zend_language_scanner.c"
 yy561:
 		YYDEBUG(561, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5900,7 +5903,7 @@ yy565:
 		{
 	RETURN_TOKEN(T_PRIVATE);
 }
-#line 5904 "Zend/zend_language_scanner.c"
+#line 5907 "Zend/zend_language_scanner.c"
 yy567:
 		YYDEBUG(567, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5932,7 +5935,7 @@ yy569:
 		{
 	RETURN_TOKEN(T_REQUIRE);
 }
-#line 5936 "Zend/zend_language_scanner.c"
+#line 5939 "Zend/zend_language_scanner.c"
 yy570:
 		YYDEBUG(570, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5956,7 +5959,7 @@ yy572:
 		{
 	RETURN_TOKEN(T_DIR);
 }
-#line 5960 "Zend/zend_language_scanner.c"
+#line 5963 "Zend/zend_language_scanner.c"
 yy574:
 		YYDEBUG(574, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6005,7 +6008,7 @@ yy581:
 		{
 	RETURN_TOKEN(T_STRING_CAST);
 }
-#line 6009 "Zend/zend_language_scanner.c"
+#line 6012 "Zend/zend_language_scanner.c"
 yy583:
 		YYDEBUG(583, *YYCURSOR);
 		++YYCURSOR;
@@ -6015,7 +6018,7 @@ yy583:
 		{
 	RETURN_TOKEN(T_OBJECT_CAST);
 }
-#line 6019 "Zend/zend_language_scanner.c"
+#line 6022 "Zend/zend_language_scanner.c"
 yy585:
 		YYDEBUG(585, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6028,7 +6031,7 @@ yy585:
 		{
 	RETURN_TOKEN(T_ABSTRACT);
 }
-#line 6032 "Zend/zend_language_scanner.c"
+#line 6035 "Zend/zend_language_scanner.c"
 yy587:
 		YYDEBUG(587, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6041,7 +6044,7 @@ yy587:
 		{
 	RETURN_TOKEN(T_CALLABLE);
 }
-#line 6045 "Zend/zend_language_scanner.c"
+#line 6048 "Zend/zend_language_scanner.c"
 yy589:
 		YYDEBUG(589, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6054,7 +6057,7 @@ yy589:
 		{
 	RETURN_TOKEN(T_CONTINUE);
 }
-#line 6058 "Zend/zend_language_scanner.c"
+#line 6061 "Zend/zend_language_scanner.c"
 yy591:
 		YYDEBUG(591, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6085,7 +6088,7 @@ yy594:
 		{
 	RETURN_TOKEN(T_ENDWHILE);
 }
-#line 6089 "Zend/zend_language_scanner.c"
+#line 6092 "Zend/zend_language_scanner.c"
 yy596:
 		YYDEBUG(596, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6098,7 +6101,7 @@ yy596:
 		{
 	RETURN_TOKEN(T_FUNCTION);
 }
-#line 6102 "Zend/zend_language_scanner.c"
+#line 6105 "Zend/zend_language_scanner.c"
 yy598:
 		YYDEBUG(598, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6170,7 +6173,7 @@ yy608:
 		{
 	RETURN_TOKEN(T_FILE);
 }
-#line 6174 "Zend/zend_language_scanner.c"
+#line 6177 "Zend/zend_language_scanner.c"
 yy610:
 		YYDEBUG(610, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6195,7 +6198,7 @@ yy612:
 		{
 	RETURN_TOKEN(T_LINE);
 }
-#line 6199 "Zend/zend_language_scanner.c"
+#line 6202 "Zend/zend_language_scanner.c"
 yy614:
 		YYDEBUG(614, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6236,7 +6239,7 @@ yy619:
 		{
 	RETURN_TOKEN(T_ENDSWITCH);
 }
-#line 6240 "Zend/zend_language_scanner.c"
+#line 6243 "Zend/zend_language_scanner.c"
 yy621:
 		YYDEBUG(621, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6267,7 +6270,7 @@ yy624:
 		{
    RETURN_TOKEN(T_INSTEADOF);
 }
-#line 6271 "Zend/zend_language_scanner.c"
+#line 6274 "Zend/zend_language_scanner.c"
 yy626:
 		YYDEBUG(626, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6280,7 +6283,7 @@ yy626:
 		{
 	RETURN_TOKEN(T_INTERFACE);
 }
-#line 6284 "Zend/zend_language_scanner.c"
+#line 6287 "Zend/zend_language_scanner.c"
 yy628:
 		YYDEBUG(628, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6293,7 +6296,7 @@ yy628:
 		{
 	RETURN_TOKEN(T_NAMESPACE);
 }
-#line 6297 "Zend/zend_language_scanner.c"
+#line 6300 "Zend/zend_language_scanner.c"
 yy630:
 		YYDEBUG(630, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6306,7 +6309,7 @@ yy630:
 		{
 	RETURN_TOKEN(T_PROTECTED);
 }
-#line 6310 "Zend/zend_language_scanner.c"
+#line 6313 "Zend/zend_language_scanner.c"
 yy632:
 		YYDEBUG(632, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6331,7 +6334,7 @@ yy634:
 		{
 	RETURN_TOKEN(T_CLASS_C);
 }
-#line 6335 "Zend/zend_language_scanner.c"
+#line 6338 "Zend/zend_language_scanner.c"
 yy636:
 		YYDEBUG(636, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6367,7 +6370,7 @@ yy640:
 		{
 	RETURN_TOKEN(T_TRAIT_C);
 }
-#line 6371 "Zend/zend_language_scanner.c"
+#line 6374 "Zend/zend_language_scanner.c"
 yy642:
 		YYDEBUG(642, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6380,7 +6383,7 @@ yy642:
 		{
 	RETURN_TOKEN(T_ENDDECLARE);
 }
-#line 6384 "Zend/zend_language_scanner.c"
+#line 6387 "Zend/zend_language_scanner.c"
 yy644:
 		YYDEBUG(644, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6393,7 +6396,7 @@ yy644:
 		{
 	RETURN_TOKEN(T_ENDFOREACH);
 }
-#line 6397 "Zend/zend_language_scanner.c"
+#line 6400 "Zend/zend_language_scanner.c"
 yy646:
 		YYDEBUG(646, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6406,7 +6409,7 @@ yy646:
 		{
 	RETURN_TOKEN(T_IMPLEMENTS);
 }
-#line 6410 "Zend/zend_language_scanner.c"
+#line 6413 "Zend/zend_language_scanner.c"
 yy648:
 		YYDEBUG(648, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6425,7 +6428,7 @@ yy649:
 		{
 	RETURN_TOKEN(T_INSTANCEOF);
 }
-#line 6429 "Zend/zend_language_scanner.c"
+#line 6432 "Zend/zend_language_scanner.c"
 yy651:
 		YYDEBUG(651, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6477,7 +6480,7 @@ yy655:
 		{
 	RETURN_TOKEN(T_METHOD_C);
 }
-#line 6481 "Zend/zend_language_scanner.c"
+#line 6484 "Zend/zend_language_scanner.c"
 yy657:
 		YYDEBUG(657, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6507,7 +6510,7 @@ yy660:
 	HANDLE_NEWLINES(yytext, yyleng);
 	RETURN_TOKEN(T_YIELD_FROM);
 }
-#line 6511 "Zend/zend_language_scanner.c"
+#line 6514 "Zend/zend_language_scanner.c"
 yy662:
 		YYDEBUG(662, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6536,7 +6539,7 @@ yy665:
 		{
 	RETURN_TOKEN(T_INCLUDE_ONCE);
 }
-#line 6540 "Zend/zend_language_scanner.c"
+#line 6543 "Zend/zend_language_scanner.c"
 yy667:
 		YYDEBUG(667, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6549,7 +6552,7 @@ yy667:
 		{
 	RETURN_TOKEN(T_REQUIRE_ONCE);
 }
-#line 6553 "Zend/zend_language_scanner.c"
+#line 6556 "Zend/zend_language_scanner.c"
 yy669:
 		YYDEBUG(669, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6562,7 +6565,7 @@ yy669:
 		{
 	RETURN_TOKEN(T_FUNC_C);
 }
-#line 6566 "Zend/zend_language_scanner.c"
+#line 6569 "Zend/zend_language_scanner.c"
 yy671:
 		YYDEBUG(671, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6592,7 +6595,7 @@ yy674:
 		{
 	RETURN_TOKEN(T_NS_C);
 }
-#line 6596 "Zend/zend_language_scanner.c"
+#line 6599 "Zend/zend_language_scanner.c"
 yy676:
 		YYDEBUG(676, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6610,7 +6613,7 @@ yy677:
 		{
 	RETURN_TOKEN(T_HALT_COMPILER);
 }
-#line 6614 "Zend/zend_language_scanner.c"
+#line 6617 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_LOOKING_FOR_PROPERTY:
@@ -6682,7 +6685,7 @@ yy682:
 	yy_pop_state();
 	goto restart;
 }
-#line 6686 "Zend/zend_language_scanner.c"
+#line 6689 "Zend/zend_language_scanner.c"
 yy683:
 		YYDEBUG(683, *YYCURSOR);
 		++YYCURSOR;
@@ -6698,7 +6701,7 @@ yy683:
 		{
 	goto return_whitespace;
 }
-#line 6702 "Zend/zend_language_scanner.c"
+#line 6705 "Zend/zend_language_scanner.c"
 yy686:
 		YYDEBUG(686, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6720,7 +6723,7 @@ yy687:
 	yy_pop_state();
 	RETURN_TOKEN_WITH_STR(T_STRING, 0);
 }
-#line 6724 "Zend/zend_language_scanner.c"
+#line 6727 "Zend/zend_language_scanner.c"
 yy690:
 		YYDEBUG(690, *YYCURSOR);
 		++YYCURSOR;
@@ -6730,7 +6733,7 @@ yy690:
 		{
 	RETURN_TOKEN(T_OBJECT_OPERATOR);
 }
-#line 6734 "Zend/zend_language_scanner.c"
+#line 6737 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_BACKQUOTE:
@@ -6783,7 +6786,7 @@ yyc_ST_BACKQUOTE:
 yy695:
 		YYDEBUG(695, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2504 "Zend/zend_language_scanner.l"
+#line 2507 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -6828,7 +6831,7 @@ yy695:
 		RETURN_TOKEN(T_ERROR);
 	}
 }
-#line 6832 "Zend/zend_language_scanner.c"
+#line 6835 "Zend/zend_language_scanner.c"
 yy696:
 		YYDEBUG(696, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6852,12 +6855,12 @@ yy697:
 		++YYCURSOR;
 		YYDEBUG(698, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2444 "Zend/zend_language_scanner.l"
+#line 2447 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN('`');
 }
-#line 6861 "Zend/zend_language_scanner.c"
+#line 6864 "Zend/zend_language_scanner.c"
 yy699:
 		YYDEBUG(699, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6882,7 +6885,7 @@ yy702:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6886 "Zend/zend_language_scanner.c"
+#line 6889 "Zend/zend_language_scanner.c"
 yy703:
 		YYDEBUG(703, *YYCURSOR);
 		++YYCURSOR;
@@ -6893,19 +6896,19 @@ yy703:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 6897 "Zend/zend_language_scanner.c"
+#line 6900 "Zend/zend_language_scanner.c"
 yy705:
 		YYDEBUG(705, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(706, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 6909 "Zend/zend_language_scanner.c"
+#line 6912 "Zend/zend_language_scanner.c"
 yy707:
 		YYDEBUG(707, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6925,7 +6928,7 @@ yy709:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6929 "Zend/zend_language_scanner.c"
+#line 6932 "Zend/zend_language_scanner.c"
 yy711:
 		YYDEBUG(711, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6949,7 +6952,7 @@ yy712:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6953 "Zend/zend_language_scanner.c"
+#line 6956 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_DOUBLE_QUOTES:
@@ -7002,7 +7005,7 @@ yyc_ST_DOUBLE_QUOTES:
 yy717:
 		YYDEBUG(717, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2450 "Zend/zend_language_scanner.l"
+#line 2453 "Zend/zend_language_scanner.l"
 		{
 	if (GET_DOUBLE_QUOTES_SCANNED_LENGTH()) {
 		YYCURSOR += GET_DOUBLE_QUOTES_SCANNED_LENGTH() - 1;
@@ -7055,18 +7058,18 @@ double_quotes_scan_done:
 		RETURN_TOKEN(T_ERROR);
 	}
 }
-#line 7059 "Zend/zend_language_scanner.c"
+#line 7062 "Zend/zend_language_scanner.c"
 yy718:
 		YYDEBUG(718, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(719, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2439 "Zend/zend_language_scanner.l"
+#line 2442 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN('"');
 }
-#line 7070 "Zend/zend_language_scanner.c"
+#line 7073 "Zend/zend_language_scanner.c"
 yy720:
 		YYDEBUG(720, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7109,7 +7112,7 @@ yy724:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7113 "Zend/zend_language_scanner.c"
+#line 7116 "Zend/zend_language_scanner.c"
 yy725:
 		YYDEBUG(725, *YYCURSOR);
 		++YYCURSOR;
@@ -7120,19 +7123,19 @@ yy725:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 7124 "Zend/zend_language_scanner.c"
+#line 7127 "Zend/zend_language_scanner.c"
 yy727:
 		YYDEBUG(727, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(728, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 7136 "Zend/zend_language_scanner.c"
+#line 7139 "Zend/zend_language_scanner.c"
 yy729:
 		YYDEBUG(729, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7152,7 +7155,7 @@ yy731:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7156 "Zend/zend_language_scanner.c"
+#line 7159 "Zend/zend_language_scanner.c"
 yy733:
 		YYDEBUG(733, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7176,7 +7179,7 @@ yy734:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7180 "Zend/zend_language_scanner.c"
+#line 7183 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_HEREDOC:
@@ -7225,7 +7228,7 @@ yyc_ST_HEREDOC:
 yy739:
 		YYDEBUG(739, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2550 "Zend/zend_language_scanner.l"
+#line 2553 "Zend/zend_language_scanner.l"
 		{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_top(&SCNG(heredoc_label_stack));
 	int newline = 0, indentation = 0, spacing = 0;
@@ -7348,7 +7351,7 @@ heredoc_scan_done:

 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 7352 "Zend/zend_language_scanner.c"
+#line 7355 "Zend/zend_language_scanner.c"
 yy740:
 		YYDEBUG(740, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7391,7 +7394,7 @@ yy744:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7395 "Zend/zend_language_scanner.c"
+#line 7398 "Zend/zend_language_scanner.c"
 yy745:
 		YYDEBUG(745, *YYCURSOR);
 		++YYCURSOR;
@@ -7402,19 +7405,19 @@ yy745:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 7406 "Zend/zend_language_scanner.c"
+#line 7409 "Zend/zend_language_scanner.c"
 yy747:
 		YYDEBUG(747, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(748, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 7418 "Zend/zend_language_scanner.c"
+#line 7421 "Zend/zend_language_scanner.c"
 yy749:
 		YYDEBUG(749, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7434,7 +7437,7 @@ yy751:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7438 "Zend/zend_language_scanner.c"
+#line 7441 "Zend/zend_language_scanner.c"
 yy753:
 		YYDEBUG(753, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7458,7 +7461,7 @@ yy754:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7462 "Zend/zend_language_scanner.c"
+#line 7465 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_LOOKING_FOR_VARNAME:
@@ -7522,7 +7525,7 @@ yy759:
 	yy_push_state(ST_IN_SCRIPTING);
 	goto restart;
 }
-#line 7526 "Zend/zend_language_scanner.c"
+#line 7529 "Zend/zend_language_scanner.c"
 yy760:
 		YYDEBUG(760, *YYCURSOR);
 		yych = *(YYMARKER = ++YYCURSOR);
@@ -7576,7 +7579,7 @@ yy764:
 	yy_push_state(ST_IN_SCRIPTING);
 	RETURN_TOKEN_WITH_STR(T_STRING_VARNAME, 0);
 }
-#line 7580 "Zend/zend_language_scanner.c"
+#line 7583 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VAR_OFFSET:
@@ -7665,7 +7668,7 @@ yy768:
 		++YYCURSOR;
 		YYDEBUG(769, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2765 "Zend/zend_language_scanner.l"
+#line 2768 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -7676,7 +7679,7 @@ yy768:
 	}
 	goto restart;
 }
-#line 7680 "Zend/zend_language_scanner.c"
+#line 7683 "Zend/zend_language_scanner.c"
 yy770:
 		YYDEBUG(770, *YYCURSOR);
 		++YYCURSOR;
@@ -7690,7 +7693,7 @@ yy770:
 	ZVAL_NULL(zendlval);
 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 7694 "Zend/zend_language_scanner.c"
+#line 7697 "Zend/zend_language_scanner.c"
 yy772:
 		YYDEBUG(772, *YYCURSOR);
 		++YYCURSOR;
@@ -7702,7 +7705,7 @@ yy773:
 	/* Only '[' or '-' can be valid, but returning other tokens will allow a more explicit parse error */
 	RETURN_TOKEN(yytext[0]);
 }
-#line 7706 "Zend/zend_language_scanner.c"
+#line 7709 "Zend/zend_language_scanner.c"
 yy774:
 		YYDEBUG(774, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7753,7 +7756,7 @@ string:
 	}
 	RETURN_TOKEN_WITH_VAL(T_NUM_STRING);
 }
-#line 7757 "Zend/zend_language_scanner.c"
+#line 7760 "Zend/zend_language_scanner.c"
 yy777:
 		YYDEBUG(777, *YYCURSOR);
 		++YYCURSOR;
@@ -7779,7 +7782,7 @@ yy779:
 		{
 	RETURN_TOKEN_WITH_STR(T_STRING, 0);
 }
-#line 7783 "Zend/zend_language_scanner.c"
+#line 7786 "Zend/zend_language_scanner.c"
 yy782:
 		YYDEBUG(782, *YYCURSOR);
 		++YYCURSOR;
@@ -7790,7 +7793,7 @@ yy782:
 	yy_pop_state();
 	RETURN_TOKEN(']');
 }
-#line 7794 "Zend/zend_language_scanner.c"
+#line 7797 "Zend/zend_language_scanner.c"
 yy784:
 		YYDEBUG(784, *YYCURSOR);
 		++YYCURSOR;
@@ -7819,7 +7822,7 @@ yy786:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7823 "Zend/zend_language_scanner.c"
+#line 7826 "Zend/zend_language_scanner.c"
 yy787:
 		YYDEBUG(787, *YYCURSOR);
 		++YYCURSOR;
@@ -7840,7 +7843,7 @@ yy789:
 	}
 	RETURN_TOKEN_WITH_VAL(T_NUM_STRING);
 }
-#line 7844 "Zend/zend_language_scanner.c"
+#line 7847 "Zend/zend_language_scanner.c"
 yy790:
 		YYDEBUG(790, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7937,7 +7940,7 @@ inline_char_handler:
 	HANDLE_NEWLINES(yytext, yyleng);
 	RETURN_TOKEN_WITH_VAL(T_INLINE_HTML);
 }
-#line 7941 "Zend/zend_language_scanner.c"
+#line 7944 "Zend/zend_language_scanner.c"
 yy801:
 	YYDEBUG(801, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7965,7 +7968,7 @@ yy803:
 		goto inline_char_handler;
 	}
 }
-#line 7969 "Zend/zend_language_scanner.c"
+#line 7972 "Zend/zend_language_scanner.c"
 yy804:
 	YYDEBUG(804, *YYCURSOR);
 	++YYCURSOR;
@@ -7979,7 +7982,7 @@ yy804:
 	}
 	RETURN_TOKEN(T_OPEN_TAG_WITH_ECHO);
 }
-#line 7983 "Zend/zend_language_scanner.c"
+#line 7986 "Zend/zend_language_scanner.c"
 yy806:
 	YYDEBUG(806, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -8019,7 +8022,7 @@ yy811:
 	}
 	RETURN_TOKEN(T_OPEN_TAG);
 }
-#line 8023 "Zend/zend_language_scanner.c"
+#line 8026 "Zend/zend_language_scanner.c"
 yy812:
 	YYDEBUG(812, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -8034,7 +8037,7 @@ yyc_ST_END_HEREDOC:
 	++YYCURSOR;
 	YYDEBUG(816, *YYCURSOR);
 	yyleng = YYCURSOR - SCNG(yy_text);
-#line 2418 "Zend/zend_language_scanner.l"
+#line 2421 "Zend/zend_language_scanner.l"
 	{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_pop(&SCNG(heredoc_label_stack));

@@ -8047,7 +8050,7 @@ yyc_ST_END_HEREDOC:
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN(T_END_HEREDOC);
 }
-#line 8051 "Zend/zend_language_scanner.c"
+#line 8054 "Zend/zend_language_scanner.c"
 /* *********************************** */
 yyc_ST_NOWDOC:
 	YYDEBUG(817, *YYCURSOR);
@@ -8057,7 +8060,7 @@ yyc_ST_NOWDOC:
 	++YYCURSOR;
 	YYDEBUG(820, *YYCURSOR);
 	yyleng = YYCURSOR - SCNG(yy_text);
-#line 2674 "Zend/zend_language_scanner.l"
+#line 2677 "Zend/zend_language_scanner.l"
 	{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_top(&SCNG(heredoc_label_stack));
 	int newline = 0, indentation = 0, spacing = -1;
@@ -8147,9 +8150,9 @@ nowdoc_scan_done:
 	HANDLE_NEWLINES(yytext, yyleng - newline);
 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 8151 "Zend/zend_language_scanner.c"
+#line 8154 "Zend/zend_language_scanner.c"
 }
-#line 2776 "Zend/zend_language_scanner.l"
+#line 2779 "Zend/zend_language_scanner.l"


 emit_token_with_str:
@@ -1066,8 +1066,7 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								octal_buf[2] = *(++s);
 							}
 						}
-						if (octal_buf[2] &&
-						    (octal_buf[0] > '3')) {
+						if (octal_buf[2] && (octal_buf[0] > '3') && !SCNG(heredoc_scan_ahead)) {
 							/* 3 octit values must not overflow 0xFF (\377) */
 							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
 						}
@@ -1112,6 +1111,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -2340,6 +2340,7 @@ skip_escape_conversion:

 	if (is_heredoc && !SCNG(heredoc_scan_ahead)) {
 		zend_lex_state current_state;
+		zend_string *saved_doc_comment = CG(doc_comment);
 		int heredoc_nesting_level = 1;
 		int first_token = 0;
 		int error = 0;
@@ -2350,6 +2351,7 @@ skip_escape_conversion:
 		SCNG(heredoc_indentation) = 0;
 		SCNG(heredoc_indentation_uses_spaces) = 0;
 		LANG_SCNG(on_event) = NULL;
+		CG(doc_comment) = NULL;

 		zend_ptr_stack_reverse_apply(&current_state.heredoc_label_stack, copy_heredoc_label_stack);

@@ -2399,6 +2401,7 @@ skip_escape_conversion:
 		zend_restore_lexical_state(&current_state);
 		SCNG(heredoc_scan_ahead) = 0;
 		CG(increment_lineno) = 0;
+		CG(doc_comment) = saved_doc_comment;

 		if (PARSER_MODE() && error) {
 			RETURN_TOKEN(T_ERROR);
@@ -1,5 +1,4 @@
-/* Generated by re2c 1.0.1 */
-#line 3 "Zend/zend_language_scanner_defs.h"
+/* Generated by re2c 1.3 */

 enum YYCONDTYPE {
 	yycST_IN_SCRIPTING,
@@ -903,7 +903,7 @@ try_again:

 static zend_never_inline void ZEND_FASTCALL add_function_array(zval *result, zval *op1, zval *op2) /* {{{ */
 {
-	if ((result == op1) && (result == op2)) {
+	if (result == op1 && Z_ARR_P(op1) == Z_ARR_P(op2)) {
 		/* $a += $a */
 		return;
 	}
@@ -1836,6 +1836,9 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 		}
 	} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {
 		if (EXPECTED(result != op1)) {
+			if (result == orig_op1) {
+				i_zval_ptr_dtor(result ZEND_FILE_LINE_CC);
+			}
 			ZVAL_COPY(result, op1);
 		}
 	} else {
@@ -186,12 +186,13 @@ static zend_always_inline zend_string *zend_string_realloc(zend_string *s, size_
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN(len, ZSTR_LEN(s)) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -206,12 +207,13 @@ static zend_always_inline zend_string *zend_string_extend(zend_string *s, size_t
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), ZSTR_LEN(s) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -226,12 +228,13 @@ static zend_always_inline zend_string *zend_string_truncate(zend_string *s, size
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), len + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -245,12 +248,13 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s,
 			ZSTR_LEN(ret) = (n * m) + l;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_safe_alloc(n, m, l, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN((n * m) + l, ZSTR_LEN(s)) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -55,6 +55,14 @@
 #define IO_REPARSE_TAG_ONEDRIVE   (0x80000021L)
 #endif

+# ifndef IO_REPARSE_TAG_ACTIVISION_HSM
+#  define IO_REPARSE_TAG_ACTIVISION_HSM (0x00000047L)
+# endif
+
+# ifndef IO_REPARSE_TAG_PROJFS
+#  define IO_REPARSE_TAG_PROJFS (0x9000001CL)
+# endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -739,6 +747,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 	HANDLE hFind = INVALID_HANDLE_VALUE;
 	ALLOCA_FLAG(use_heap_large)
 	wchar_t *pathw = NULL;
+	int may_retry_reparse_point;
 #define FREE_PATHW() \
 	do { free(pathw); } while(0);

@@ -837,6 +846,8 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}

 #ifdef ZEND_WIN32
+retry_reparse_point:
+		may_retry_reparse_point = 0;
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -859,7 +870,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry:
+retry_reparse_tag_cloud:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -920,7 +931,7 @@ retry:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry;
+					goto retry_reparse_tag_cloud;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -931,6 +942,7 @@ retry:
 			CloseHandle(hLink);

 			if(pbuffer->ReparseTag == IO_REPARSE_TAG_SYMLINK) {
+				may_retry_reparse_point = 1;
 				reparsetarget = pbuffer->SymbolicLinkReparseBuffer.ReparseTarget;
 				isabsolute = (pbuffer->SymbolicLinkReparseBuffer.Flags == 0) ? 1 : 0;
 #if VIRTUAL_CWD_DEBUG
@@ -1002,7 +1014,9 @@ retry:
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
 					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
-					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
+					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_ACTIVISION_HSM == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_PROJFS == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));
 				if (!substitutename) {
@@ -1065,6 +1079,22 @@ retry:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);

+			if (may_retry_reparse_point) {
+				DWORD attrs;
+
+				FREE_PATHW()
+				pathw = php_win32_ioutil_any_to_w(path);
+				if (!pathw) {
+					return (size_t)-1;
+				}
+				attrs = GetFileAttributesW(pathw);
+				if (!isVolume && attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					free_alloca(tmp, use_heap);
+					FREE_PATHW()
+					goto retry_reparse_point;
+				}
+			}
+
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
@@ -741,8 +741,10 @@ ZEND_VM_COLD_CONST_HANDLER(13, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2396,9 +2398,9 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 	uint32_t call_info = EX_CALL_INFO();

 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2424,12 +2426,12 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);

 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -2479,6 +2481,7 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -2486,7 +2489,6 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}
@@ -3342,11 +3344,11 @@ ZEND_VM_C_LABEL(try_function_name):
 		call = NULL;
 	}

+	FREE_OP2();
 	if (UNEXPECTED(!call)) {
 		HANDLE_EXCEPTION();
 	}

-	FREE_OP2();
 	if (OP2_TYPE & (IS_VAR|IS_TMP_VAR)) {
 		if (UNEXPECTED(EG(exception))) {
 			if (call) {
@@ -3358,8 +3360,6 @@ ZEND_VM_C_LABEL(try_function_name):
 			}
 			HANDLE_EXCEPTION();
 		}
-	} else if (UNEXPECTED(!call)) {
-		HANDLE_EXCEPTION();
 	}

 	call->prev_execute_data = EX(call);
@@ -3860,6 +3860,10 @@ ZEND_VM_HOT_HANDLER(62, ZEND_RETURN, CONST|TMP|VAR|CV, ANY)
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -4815,6 +4819,7 @@ ZEND_VM_HANDLER(164, ZEND_RECV_VARIADIC, NUM, UNUSED|CACHE_SLOT)
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) {
 			param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T);
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
+				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
 				do {
 					zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num));
 					if (Z_OPT_REFCOUNTED_P(param)) Z_ADDREF_P(param);
@@ -4846,8 +4851,10 @@ ZEND_VM_COLD_CONST_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -7090,15 +7097,6 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 	zfunc = zend_hash_find_ex(EG(function_table), Z_STR_P(RT_CONSTANT(opline, opline->op1)), 1);
 	ZEND_ASSERT(zfunc != NULL && Z_FUNC_P(zfunc)->type == ZEND_USER_FUNCTION);

-	fbc = Z_PTR_P(zfunc);
-	if (fbc->common.fn_flags & ZEND_ACC_IMMUTABLE) {
-		zend_function *new_func = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
-
-		memcpy(new_func, fbc, sizeof(zend_op_array));
-		new_func->common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
-		Z_PTR_P(zfunc) = fbc = new_func;
-	}
-
 	if (Z_TYPE(EX(This)) == IS_OBJECT) {
 		called_scope = Z_OBJCE(EX(This));
 		if (UNEXPECTED((Z_FUNC_P(zfunc)->common.fn_flags & ZEND_ACC_STATIC) ||
@@ -7365,6 +7363,7 @@ ZEND_VM_HANDLER(142, ZEND_YIELD_FROM, CONST|TMP|VAR|CV, ANY)
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		FREE_OP1();
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -8873,10 +8872,10 @@ ZEND_VM_DEFINE_OP(137, ZEND_OP_DATA);
 ZEND_VM_HELPER(zend_interrupt_helper, ANY, ANY)
 {
 	EG(vm_interrupt) = 0;
+	SAVE_OPLINE();
 	if (EG(timed_out)) {
 		zend_timeout(0);
 	} else if (zend_interrupt_function) {
-		SAVE_OPLINE();
 		zend_interrupt_function(execute_data);
 		ZEND_VM_ENTER();
 	}
@@ -507,9 +507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 	uint32_t call_info = EX_CALL_INFO();

 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -535,12 +535,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);

 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -590,6 +590,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -597,7 +598,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}
@@ -2054,10 +2054,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_JMP_FORWARD_SPEC_H
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_interrupt_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 {
 	EG(vm_interrupt) = 0;
+	SAVE_OPLINE();
 	if (EG(timed_out)) {
 		zend_timeout(0);
 	} else if (zend_interrupt_function) {
-		SAVE_OPLINE();
 		zend_interrupt_function(execute_data);
 		ZEND_VM_ENTER();
 	}
@@ -2137,8 +2137,6 @@ try_function_name:
 			}
 			HANDLE_EXCEPTION();
 		}
-	} else if (UNEXPECTED(!call)) {
-		HANDLE_EXCEPTION();
 	}

 	call->prev_execute_data = EX(call);
@@ -2313,11 +2311,11 @@ try_function_name:
 		call = NULL;
 	}

+	zval_ptr_dtor_nogc(free_op2);
 	if (UNEXPECTED(!call)) {
 		HANDLE_EXCEPTION();
 	}

-	zval_ptr_dtor_nogc(free_op2);
 	if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
 		if (UNEXPECTED(EG(exception))) {
 			if (call) {
@@ -2329,8 +2327,6 @@ try_function_name:
 			}
 			HANDLE_EXCEPTION();
 		}
-	} else if (UNEXPECTED(!call)) {
-		HANDLE_EXCEPTION();
 	}

 	call->prev_execute_data = EX(call);
@@ -2379,6 +2375,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RECV_VARIADIC_SPEC_UNUSED_HAND
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) {
 			param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T);
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
+				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
 				do {
 					zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num));
 					if (Z_OPT_REFCOUNTED_P(param)) Z_ADDREF_P(param);
@@ -2446,8 +2443,6 @@ try_function_name:
 			}
 			HANDLE_EXCEPTION();
 		}
-	} else if (UNEXPECTED(!call)) {
-		HANDLE_EXCEPTION();
 	}

 	call->prev_execute_data = EX(call);
@@ -2485,8 +2480,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CON
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2731,6 +2728,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_CONST_
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -3056,8 +3057,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CONST_H
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3705,6 +3708,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_CONST_HANDLER(
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -9205,15 +9209,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_C
 	zfunc = zend_hash_find_ex(EG(function_table), Z_STR_P(RT_CONSTANT(opline, opline->op1)), 1);
 	ZEND_ASSERT(zfunc != NULL && Z_FUNC_P(zfunc)->type == ZEND_USER_FUNCTION);

-	fbc = Z_PTR_P(zfunc);
-	if (fbc->common.fn_flags & ZEND_ACC_IMMUTABLE) {
-		zend_function *new_func = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
-
-		memcpy(new_func, fbc, sizeof(zend_op_array));
-		new_func->common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
-		Z_PTR_P(zfunc) = fbc = new_func;
-	}
-
 	if (Z_TYPE(EX(This)) == IS_OBJECT) {
 		called_scope = Z_OBJCE(EX(This));
 		if (UNEXPECTED((Z_FUNC_P(zfunc)->common.fn_flags & ZEND_ACC_STATIC) ||
@@ -12101,8 +12096,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_TMPVAR_HANDLER(Z
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -12363,8 +12360,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_TMPVAR_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17663,6 +17662,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_TMP_HA
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -18336,6 +18339,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_TMP_HANDLER(ZE
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		zval_ptr_dtor_nogc(free_op1);
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -20431,6 +20435,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_VAR_HA
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -21658,6 +21666,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_VAR_HANDLER(ZE
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		zval_ptr_dtor_nogc(free_op1);
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -36411,8 +36420,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36871,6 +36882,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_SPEC_CV_HAN
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -37234,8 +37249,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCO
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -37874,6 +37891,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_CV_HANDLER(ZEN
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -55357,9 +55375,9 @@ zend_leave_helper_SPEC_LABEL:
 	uint32_t call_info = EX_CALL_INFO();

 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -55385,12 +55403,12 @@ zend_leave_helper_SPEC_LABEL:
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);

 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);

 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -55440,6 +55458,7 @@ zend_leave_helper_SPEC_LABEL:
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -55447,7 +55466,6 @@ zend_leave_helper_SPEC_LABEL:
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}
@@ -55708,6 +55726,10 @@ zend_leave_helper_SPEC_LABEL:
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -57322,6 +57344,10 @@ zend_leave_helper_SPEC_LABEL:
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -57608,6 +57634,10 @@ zend_leave_helper_SPEC_LABEL:
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -59250,6 +59280,10 @@ zend_leave_helper_SPEC_LABEL:
 				if (EXPECTED(!Z_OPT_ISREF_P(retval_ptr))) {
 					ZVAL_COPY_VALUE(return_value, retval_ptr);
 					if (EXPECTED(!(EX_CALL_INFO() & ZEND_CALL_CODE))) {
+						zend_refcounted *ref = Z_COUNTED_P(retval_ptr);
+						if (GC_MAY_LEAK(ref)) {
+							gc_possible_root(ref);
+						}
 						ZVAL_NULL(retval_ptr);
 					} else {
 						Z_ADDREF_P(return_value);
@@ -329,8 +329,8 @@ dnl
 dnl PHP_CHECK_GCC_ARG(arg, action-if-found, action-if-not-found)
 dnl
 AC_DEFUN([PHP_CHECK_GCC_ARG],[
-  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z-,a-z_)
-  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z-,a-z_), [
+  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z=-,a-z__)
+  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z=-,a-z__), [
  echo 'void somefunc() { };' > conftest.c
  cmd='$CC $1 -c conftest.c'
  if eval $cmd 2>&1 | $EGREP -e $1 >/dev/null ; then
@@ -1209,14 +1209,14 @@ AC_DEFUN([PHP_DOES_PWRITE_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    main() {
+    int main() {
    int fd = open("conftest_in", O_WRONLY|O_CREAT, 0600);

-    if (fd < 0) exit(1);
-    if (pwrite(fd, "text", 4, 0) != 4) exit(1);
+    if (fd < 0) return 1;
+    if (pwrite(fd, "text", 4, 0) != 4) return 1;
    /* Linux glibc breakage until 2.2.5 */
-    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) exit(1);
-    exit(0);
+    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) return 1;
+    return 0;
    }

  ]])],[
@@ -1239,14 +1239,14 @@ AC_DEFUN([PHP_DOES_PREAD_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    main() {
+    int main() {
    char buf[3];
    int fd = open("conftest_in", O_RDONLY);
-    if (fd < 0) exit(1);
-    if (pread(fd, buf, 2, 0) != 2) exit(1);
+    if (fd < 0) return 1;
+    if (pread(fd, buf, 2, 0) != 2) return 1;
    /* Linux glibc breakage until 2.2.5 */
-    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) exit(1);
-    exit(0);
+    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) return 1;
+    return 0;
    }
  ]])],[
    ac_cv_pread=yes
@@ -1347,25 +1347,26 @@ AC_DEFUN([PHP_READDIR_R_TYPE],[
 #define _REENTRANT
 #include <sys/types.h>
 #include <dirent.h>
+#include <unistd.h>

 #ifndef PATH_MAX
 #define PATH_MAX 1024
 #endif

-main() {
+int main() {
  DIR *dir;
  char entry[sizeof(struct dirent)+PATH_MAX];
  struct dirent *pentry = (struct dirent *) &entry;

  dir = opendir("/");
  if (!dir)
-    exit(1);
+    return 1;
  if (readdir_r(dir, (struct dirent *) entry, &pentry) == 0) {
    close(dir);
-    exit(0);
+    return 0;
  }
  close(dir);
-  exit(1);
+  return 1;
 }
    ]])],[
      ac_cv_what_readdir_r=POSIX
@@ -1693,6 +1694,7 @@ AC_DEFUN([PHP_BROKEN_GLIBC_FOPEN_APPEND], [
  AC_CACHE_VAL(_cv_have_broken_glibc_fopen_append,[
  AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <stdio.h>
+#include <unistd.h>
 int main(int argc, char *argv[])
 {
  FILE *fp;
@@ -1702,7 +1704,7 @@ int main(int argc, char *argv[])
  fp = fopen(filename, "w");
  if (fp == NULL) {
    perror("fopen");
-    exit(2);
+    return 2;
  }
  fputs("foobar", fp);
  fclose(fp);
@@ -1812,13 +1814,13 @@ int seeker(void *cookie, __off64_t *position, int whence)

 cookie_io_functions_t funcs = {reader, writer, seeker, closer};

-main() {
+int main() {
  struct cookiedata g = { 0 };
  FILE *fp = fopencookie(&g, "r", funcs);

  if (fp && fseek(fp, 8192, SEEK_SET) == 0 && g.pos == 8192)
-    exit(0);
-  exit(1);
+    return 0;
+  return 1;
 }

 ]])], [
@@ -2084,7 +2086,7 @@ dnl Search for the sendmail binary
 dnl
 AC_DEFUN([PHP_PROG_SENDMAIL], [
  PHP_ALT_PATH=/usr/bin:/usr/sbin:/usr/etc:/etc:/usr/ucblib:/usr/lib
-  AC_PATH_PROG(PROG_SENDMAIL, sendmail,[], $PATH:$PHP_ALT_PATH)
+  AC_PATH_PROG(PROG_SENDMAIL, sendmail, /usr/sbin/sendmail, $PATH:$PHP_ALT_PATH)
  PHP_SUBST(PROG_SENDMAIL)
 ])

@@ -2252,6 +2254,8 @@ AC_DEFUN([PHP_SETUP_ICU],[
      fi
    fi
  fi
+
+  ICU_CFLAGS="$ICU_CFLAGS -DU_DEFINE_FALSE_AND_TRUE=1"
 ])

 dnl
@@ -978,10 +978,6 @@ else
 #  endif
 #endif

-#ifdef __cplusplus
-extern "C" void exit (int);
-#endif
-
 void fnord() { int i=42;}
 int main ()
 {
@@ -997,7 +993,7 @@ int main ()
  else
    puts (dlerror ());

-    exit (status);
+    return (status);
 }]
 EOF
  if AC_TRY_EVAL(ac_link) && test -s conftest${ac_exeext} 2>/dev/null; then
@@ -1,5 +1,5 @@
@echo off
-cscript /nologo win32\build\buildconf.js %*
+cscript /nologo /e:jscript win32\build\buildconf.js %*
 SET PHP_BUILDCONF_PATH=%~dp0
 copy %PHP_BUILDCONF_PATH%\win32\build\configure.bat %PHP_BUILDCONF_PATH% > nul
 SET PHP_SDK_SCRIPT_PATH=
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=13
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=27
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -716,6 +716,7 @@ dnl Also check for working getaddrinfo
 AC_CACHE_CHECK([for getaddrinfo], ac_cv_func_getaddrinfo,
 [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <netdb.h>]],
  [[struct addrinfo *g,h;g=&h;getaddrinfo("","",g,&g);]])],[AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <string.h>
 #include <netdb.h>
 #include <sys/types.h>
 #ifndef AF_INET
@@ -728,11 +729,11 @@ int main(void) {
  hints.ai_flags = AI_NUMERICHOST;

  if (getaddrinfo("127.0.0.1", 0, &hints, &ai) < 0) {
-    exit(1);
+    return 1;
  }

  if (ai == 0) {
-    exit(1);
+    return 1;
  }

  pai = ai;
@@ -740,16 +741,16 @@ int main(void) {
  while (pai) {
    if (pai->ai_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      exit(1);
+      return 1;
    }
    if (pai->ai_addr->sa_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      exit(1);
+      return 1;
    }
    pai = pai->ai_next;
  }
  freeaddrinfo(ai);
-  exit(0);
+  return 0;
 }
  ]])],[ac_cv_func_getaddrinfo=yes], [ac_cv_func_getaddrinfo=no], [ac_cv_func_getaddrinfo=no])],
 [ac_cv_func_getaddrinfo=no])])
@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale)
  zero_int = FALSE;
  if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
  while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
  if (*ptr == '.') ptr++;			/* decimal point */
-  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
  if ((*ptr != '\0') || (digits+strscale == 0))
    {
      *num = bc_copy_num (BCG(_zero_));
@@ -0,0 +1,12 @@
+--TEST--
+Bug #78878 (Buffer underflow in bc_shift_addsub)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
+?>
+--EXPECT--
+0
@@ -83,12 +83,12 @@ bool(false)
 resource(%d) of type (stream)
 resource(%d) of type (stream)

-Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)

-Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)
@@ -23,20 +23,25 @@
 #include "sdncal.h"
 #include <time.h>

+#define SECS_PER_DAY (24 * 3600)
+
 /* {{{ proto int unixtojd([int timestamp])
   Convert UNIX timestamp to Julian Day */
 PHP_FUNCTION(unixtojd)
 {
 	time_t ts = 0;
+	zend_long tl = 0;
 	struct tm *ta, tmbuf;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &ts) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &tl) == FAILURE) {
 		return;
 	}

-	if (!ts) {
+	if (!tl) {
 		ts = time(NULL);
-	} else if (ts < 0) {
+	} else if (tl >= 0) {
+		ts = (time_t) tl;
+	} else {
 		RETURN_FALSE;
 	}

@@ -59,11 +64,11 @@ PHP_FUNCTION(jdtounix)
 	}
 	uday -= 2440588 /* J.D. of 1.1.1970 */;

-	if (uday < 0 || uday > 24755) { /* before beginning of unix epoch or behind end of unix epoch */
+	if (uday < 0 || uday > ZEND_LONG_MAX / SECS_PER_DAY) { /* before beginning of unix epoch or greater than representable */
 		RETURN_FALSE;
 	}

-	RETURN_LONG(uday * 24 * 3600);
+	RETURN_LONG(uday * SECS_PER_DAY);
 }
 /* }}} */

@@ -0,0 +1,17 @@
+--TEST--
+Bug #80185 (jdtounix() fails after 2037)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 8) die("skip for 64bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(jdtounix(2465712));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
+?>
+--EXPECT--
+int(2170713600)
+int(9223372036854720000)
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #80185 (jdtounix() fails after 2037)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 4) die("skip for 32bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(jdtounix(2465712));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
+?>
+--EXPECT--
+bool(false)
+int(2147472000)
+bool(false)
@@ -2,6 +2,8 @@
 easter_date()
 --INI--
 date.timezone=UTC
+--ENV--
+TZ=UTC
 --SKIPIF--
 <?php include 'skipif.inc'; ?>
 --FILE--
@@ -61,7 +61,7 @@ PHP_FUNCTION(com_create_instance)
 			&module_name, &module_name_len, &server_name, &server_name_len,
 			&cp, &typelib_name, &typelib_name_len) &&
 		FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET,
-			ZEND_NUM_ARGS(), "sa|ls",
+			ZEND_NUM_ARGS(), "sa/|ls",
 			&module_name, &module_name_len, &server_params, &cp,
 			&typelib_name, &typelib_name_len)) {

@@ -133,7 +133,7 @@ PHP_FUNCTION(com_create_instance)
 		info.pwszName = php_com_string_to_olestring(server_name, server_name_len, obj->code_page);

 		if (user_name) {
-			authid.User = php_com_string_to_olestring(user_name, -1, obj->code_page);
+			authid.User = (OLECHAR*)user_name;
 			authid.UserLength = (ULONG)user_name_len;

 			if (password) {
@@ -221,7 +221,6 @@ PHP_FUNCTION(com_create_instance)

 	if (server_name) {
 		if (info.pwszName) efree(info.pwszName);
-		if (authid.User) efree(authid.User);
 	}

 	efree(moniker);
@@ -248,7 +247,7 @@ PHP_FUNCTION(com_create_instance)
 		TL = php_com_load_typelib_via_cache(typelib_name, obj->code_page, &cached);

 		if (TL) {
-			if (COMG(autoreg_on) && !cached) {
+			if (COMG(autoreg_on)) {
 				php_com_import_typelib(TL, mode, obj->code_page);
 			}

@@ -440,8 +439,9 @@ HRESULT php_com_get_id_of_name(php_com_dotnet_object *obj, char *name,
 	if (obj->typeinfo) {
 		hr = ITypeInfo_GetIDsOfNames(obj->typeinfo, &olename, 1, dispid);
 		if (FAILED(hr)) {
+			HRESULT hr1 = hr;
 			hr = IDispatch_GetIDsOfNames(V_DISPATCH(&obj->v), &IID_NULL, &olename, 1, LOCALE_SYSTEM_DEFAULT, dispid);
-			if (SUCCEEDED(hr)) {
+			if (SUCCEEDED(hr) && hr1 != E_NOTIMPL) {
 				/* fall back on IDispatch direct */
 				ITypeInfo_Release(obj->typeinfo);
 				obj->typeinfo = NULL;
@@ -589,6 +589,7 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			}
 		}
 		efree(vargs);
+		if (byref_vals) efree(byref_vals);
 	}

 	return SUCCEEDED(hr) ? SUCCESS : FAILURE;
@@ -838,9 +839,7 @@ PHP_FUNCTION(com_load_typelib)
 	php_com_initialize();
 	pTL = php_com_load_typelib_via_cache(name, codepage, &cached);
 	if (pTL) {
-		if (cached) {
-			RETVAL_TRUE;
-		} else if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
+		if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
 			RETVAL_TRUE;
 		}

@@ -252,9 +252,7 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}

 		if ((pTL = php_com_load_typelib_via_cache(typelib_name, COMG(code_page), &cached)) != NULL) {
-			if (!cached) {
-				php_com_import_typelib(pTL, mode, COMG(code_page));
-			}
+			php_com_import_typelib(pTL, mode, COMG(code_page));
 			ITypeLib_Release(pTL);
 		}
 	}
@@ -336,11 +334,15 @@ PHP_MINIT_FUNCTION(com_dotnet)

 #define COM_CONST(x) REGISTER_LONG_CONSTANT(#x, x, CONST_CS|CONST_PERSISTENT)

-#define COM_ERR_CONST(x) { \
+#if SIZEOF_ZEND_LONG == 8
+# define COM_ERR_CONST(x) { \
 	zend_long __tmp; \
 	ULongToIntPtr(x, &__tmp); \
 	REGISTER_LONG_CONSTANT(#x, __tmp, CONST_CS|CONST_PERSISTENT); \
 }
+#else
+# define COM_ERR_CONST COM_CONST
+#endif

 	COM_CONST(CLSCTX_INPROC_SERVER);
 	COM_CONST(CLSCTX_INPROC_HANDLER);
@@ -187,7 +187,7 @@ zend_object_iterator *php_com_iter_get(zend_class_entry *ce, zval *object, int b
 		SafeArrayGetUBound(V_ARRAY(&I->safe_array), 1, &I->sa_max);

 		/* pre-fetch the element */
-		if (php_com_safearray_get_elem(&I->safe_array, &I->v, bound)) {
+		if (I->sa_max >= bound && php_com_safearray_get_elem(&I->safe_array, &I->v, bound)) {
 			I->key = bound;
 			ZVAL_NULL(&ptr);
 			php_com_zval_from_variant(&ptr, &I->v, I->code_page);
@@ -103,3 +103,58 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t

 	return string;
 }
+
+BSTR php_com_string_to_bstr(zend_string *string, int codepage)
+{
+	BSTR bstr = NULL;
+	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
+	size_t mb_len = ZSTR_LEN(string);
+	int wc_len;
+
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, NULL, 0)) <= 0) {
+		goto fail;
+	}
+	if ((bstr = SysAllocStringLen(NULL, (UINT)(wc_len - 1))) == NULL) {
+		goto fail;
+	}
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, bstr, wc_len)) <= 0) {
+		goto fail;
+	}
+	return bstr;
+
+fail:
+	char *msg = php_win32_error_to_msg(GetLastError());
+	php_error_docref(NULL, E_WARNING,
+		"Could not convert string to unicode: `%s'", msg);
+	LocalFree(msg);
+	SysFreeString(bstr);
+	return SysAllocString(L"");
+}
+
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage)
+{
+	zend_string *string = NULL;
+	UINT wc_len = SysStringLen(bstr);
+	int mb_len;
+
+	mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, NULL, 0, NULL, NULL);
+	if (mb_len > 0) {
+		string = zend_string_alloc(mb_len - 1, 0);
+		mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, ZSTR_VAL(string), mb_len, NULL, NULL);
+	}
+
+	if (mb_len <= 0) {
+		char *msg = php_win32_error_to_msg(GetLastError());
+
+		php_error_docref(NULL, E_WARNING,
+			"Could not convert string from unicode: `%s'", msg);
+		LocalFree(msg);
+
+		if (string != NULL) {
+			zend_string_release(string);
+		}
+		string = ZSTR_EMPTY_ALLOC();
+	}
+
+	return string;
+}
@@ -248,13 +248,6 @@ static struct IStreamVtbl php_istream_vtbl = {

 static void istream_destructor(php_istream *stm)
 {
-	if (stm->res) {
-		zend_resource *res = stm->res;
-		stm->res = NULL;
-		zend_list_delete(res);
-		return;
-	}
-
 	if (stm->refcount > 0) {
 		CoDisconnectObject((IUnknown*)stm, 0);
 	}
@@ -268,7 +261,6 @@ static void istream_destructor(php_istream *stm)
 PHP_COM_DOTNET_API IStream *php_com_wrapper_export_stream(php_stream *stream)
 {
 	php_istream *stm = (php_istream*)CoTaskMemAlloc(sizeof(*stm));
-	zval *tmp;

 	if (stm == NULL)
 		return NULL;
@@ -280,8 +272,7 @@ PHP_COM_DOTNET_API IStream *php_com_wrapper_export_stream(php_stream *stream)
 	stm->stream = stream;

 	GC_ADDREF(stream->res);
-	tmp = zend_list_insert(stm, le_istream);
-	stm->res = Z_RES_P(tmp);
+	stm->res = zend_register_resource(stm, le_istream);

 	return (IStream*)stm;
 }
@@ -398,7 +389,7 @@ CPH_METHOD(SaveToFile)
 				RETURN_FALSE;
 			}

-			olefilename = php_com_string_to_olestring(filename, strlen(fullpath), helper->codepage);
+			olefilename = php_com_string_to_olestring(fullpath, strlen(fullpath), helper->codepage);
 			efree(fullpath);
 		}
 		res = IPersistFile_Save(helper->ipf, olefilename, remember);
@@ -114,6 +114,8 @@ static zval *saproxy_read_dimension(zval *object, zval *offset, int type, zval *
 			   	Z_STRLEN(proxy->indices[0]), DISPATCH_METHOD|DISPATCH_PROPERTYGET, &v,
 			   	proxy->dimensions, args, 0);

+		efree(args);
+
 		if (res == SUCCESS) {
 			php_com_zval_from_variant(rv, &v, proxy->obj->code_page);
 			VariantClear(&v);
@@ -387,7 +389,7 @@ static zend_object* saproxy_clone(zval *object)
 	memcpy(cloneproxy, proxy, sizeof(*cloneproxy));

 	Z_ADDREF_P(cloneproxy->zobj);
-	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval *), 0);
+	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval), 0);
 	clone_indices(cloneproxy, proxy, proxy->dimensions);

 	return &cloneproxy->std;
@@ -437,7 +439,7 @@ int php_com_saproxy_create(zval *com_object, zval *proxy_out, zval *index)
 	}

 	Z_ADDREF_P(proxy->zobj);
-	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval *), 0);
+	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval), 0);

 	if (rel) {
 		clone_indices(proxy, rel, rel->dimensions);
@@ -267,18 +267,20 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj

 	if (obj) {
 		if (dispname == NULL && sink) {
-			IProvideClassInfo2 *pci2;
-			IProvideClassInfo *pci;
+			if (V_VT(&obj->v) == VT_DISPATCH) {
+				IProvideClassInfo2 *pci2;
+				IProvideClassInfo *pci;

-			if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) {
-				gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid));
-				IProvideClassInfo2_Release(pci2);
-			}
-			if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) {
-				/* examine the available interfaces */
-				/* TODO: write some code here */
-				php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!");
-				IProvideClassInfo_Release(pci);
+				if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) {
+					gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid));
+					IProvideClassInfo2_Release(pci2);
+				}
+				if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) {
+					/* examine the available interfaces */
+					/* TODO: write some code here */
+					php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!");
+					IProvideClassInfo_Release(pci);
+				}
 			}
 		} else if (dispname == NULL) {
 			if (obj->typeinfo) {
@@ -295,15 +297,17 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj
 			/* get the library from the object; the rest will be dealt with later */
 			ITypeInfo_GetContainingTypeLib(obj->typeinfo, &typelib, &idx);
 		} else if (typelibname == NULL) {
-			IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo);
-			if (dispname) {
-				unsigned int idx;
-				/* get the library from the object; the rest will be dealt with later */
-				ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx);
+			if (V_VT(&obj->v) == VT_DISPATCH) {
+				IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo);
+				if (dispname) {
+					unsigned int idx;
+					/* get the library from the object; the rest will be dealt with later */
+					ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx);

-				if (typelib) {
-					ITypeInfo_Release(typeinfo);
-					typeinfo = NULL;
+					if (typelib) {
+						ITypeInfo_Release(typeinfo);
+						typeinfo = NULL;
+					}
 				}
 			}
 		}
@@ -436,6 +440,7 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 	char *ansiname = NULL;
 	size_t ansinamelen;
 	int ret = 0;
+	DISPID lastid = 0;	/* for props */

 	if (FAILED(ITypeInfo_GetTypeAttr(typeinfo, &attr))) {
 		return 0;
@@ -469,7 +474,6 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 		/* So we've got the dispatch interface; lets list the event methods */
 		for (i = 0; i < attr->cFuncs; i++) {
 			zval tmp;
-			DISPID lastid = 0;	/* for props */
 			int isprop;

 			if (FAILED(ITypeInfo_GetFuncDesc(typeinfo, i, &func)))
@@ -582,8 +586,8 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 					ZVAL_STRINGL(&tmp, ansiname, ansinamelen);
 					zend_hash_index_update(id_to_name, func->memid, &tmp);
 					// TODO: avoid reallocation???
-					efree(ansiname);
 				}
+				efree(ansiname);
 			}
 			ITypeInfo_ReleaseFuncDesc(typeinfo, func);
 		}
@@ -96,7 +96,6 @@ bogus:

 PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage)
 {
-	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
 	zend_uchar ztype = IS_NULL;

@@ -164,13 +163,7 @@ PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codep

 		case IS_STRING:
 			V_VT(v) = VT_BSTR;
-			olestring = php_com_string_to_olestring(Z_STRVAL_P(z), Z_STRLEN_P(z), codepage);
-			if (CP_UTF8 == codepage) {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(wcslen(olestring) * sizeof(OLECHAR)));
-			} else {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(Z_STRLEN_P(z) * sizeof(OLECHAR)));
-			}
-			efree(olestring);
+			V_BSTR(v) = php_com_string_to_bstr(Z_STR_P(z), codepage);
 			break;

 		case IS_RESOURCE:
@@ -236,12 +229,8 @@ PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepa
 		case VT_BSTR:
 			olestring = V_BSTR(v);
 			if (olestring) {
-				size_t len;
-				char *str = php_com_olestring_to_string(olestring,
-					&len, codepage);
-				ZVAL_STRINGL(z, str, len);
-				// TODO: avoid reallocation???
-				efree(str);
+				zend_string *str = php_com_bstr_to_string(olestring, codepage);
+				ZVAL_STR(z, str);
 				olestring = NULL;
 			}
 			break;
@@ -89,6 +89,8 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		size_t *string_len, int codepage);
 PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		size_t string_len, int codepage);
+BSTR php_com_string_to_bstr(zend_string *string, int codepage);
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage);


 /* com_com.c */
@@ -0,0 +1,14 @@
+--TEST--
+Bug #62474 (com_event_sink crashes on certain arguments)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+var_dump(com_event_sink(new variant, function() {}, array()));
+var_dump(com_event_sink(new variant, new variant, 'a'));
+?>
+--EXPECT--
+bool(false)
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #63208 (BSTR to PHP string conversion not binary safe)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$string = "\u{0905}b\0cd";
+$variant = new VARIANT($string, VT_ARRAY | VT_UI1, CP_UTF8); // Array of bytes
+$converted = (string) $variant;
+var_dump(bin2hex($string));
+var_dump(bin2hex($converted));
+?>
+--EXPECT--
+string(14) "e0a48562006364"
+string(14) "e0a48562006364"
@@ -0,0 +1,27 @@
+--TEST--
+Bug #64130 (COM obj parameters passed by reference are not updated)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+if (PHP_INT_SIZE != 4) die('skip for 32bit platforms only');
+try {
+    $ie = new com('InternetExplorer.Application');
+} catch (com_exception $ex) {
+    die("skip {$ex->getMessage()}");
+}
+$ie->quit();
+?>
+--FILE--
+<?php
+$ie = new com('InternetExplorer.Application');
+$x = 0;
+$y = 0;
+try {
+    $ie->clientToWindow($x, $y);
+} catch (com_exception $ex) {}
+var_dump($x > 0, $y > 0);
+$ie->quit();
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -0,0 +1,24 @@
+--TEST--
+Bug #66322 (COMPersistHelper::SaveToFile can save to wrong location)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+try {
+    new COM('Word.Application');
+} catch (com_exception $ex) {
+    die('skip MS Word not available');
+}
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--FILE--
+<?php
+$w = new COM('Word.Application');
+$doc = $w->Documents->Add();
+$ph = new COMPersistHelper($doc);
+$filename = __DIR__ . '\\..\\' . basename(__DIR__) . '\\66322.docx';
+$ph->SaveToFile($filename);
+var_dump(file_exists($filename));
+$w->Quit();
+?>
+--EXPECT--
+bool(true)
@@ -2,7 +2,9 @@
 Bug #73679 DOTNET read access violation using invalid codepage
 --SKIPIF--
 <?php # vim:ft=php
-if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present"; ?>
+if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present";
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only");
+?>
 --FILE--
 <?php

@@ -0,0 +1,22 @@
+--TEST--
+Bug #79242 (COM error constants don't match com_exception codes)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(
+    DISP_E_DIVBYZERO,
+    DISP_E_OVERFLOW,
+    DISP_E_BADINDEX,
+    MK_E_UNAVAILABLE
+);
+?>
+--EXPECT--
+int(-2147352558)
+int(-2147352566)
+int(-2147352565)
+int(-2147221021)
+
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79248 (Traversing empty VT_ARRAY throws com_exception)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$v = new variant([], VT_ARRAY);
+foreach ($v as $el) {
+    var_dump($el);
+}
+echo "done\n";
+?>
+--EXPECT--
+done
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79299 (com_print_typeinfo prints duplicate variables)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$dict = new COM("Scripting.Dictionary");
+ob_start();
+com_print_typeinfo($dict);
+$typeinfo = ob_get_clean();
+preg_match_all('/\/\* DISPID=9 \*\//', $typeinfo, $matches);
+var_dump($matches[0]);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(14) "/* DISPID=9 */"
+}
@@ -0,0 +1,18 @@
+--TEST--
+Bug #79332 (php_istreams are never freed)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$ph = new COMPersistHelper(null);
+try {
+    $ph->LoadFromStream(fopen(__FILE__, 'r'));
+} catch (com_exception $ex) {
+    // use hard-coded message to avoid localization issues
+    echo "A com_exception has been thrown\n";
+}
+?>
+--EXPECT--
+A com_exception has been thrown
@@ -1452,6 +1452,10 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLOPT_TLS13_CIPHERS);
 #endif

+#if LIBCURL_VERSION_NUM >= 0x074000 /* Available since 7.64.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_HTTP09_ALLOWED);
+#endif
+
 #if LIBCURL_VERSION_NUM >= 0x074001 /* Available since 7.64.1 */
 	REGISTER_CURL_CONSTANT(CURL_VERSION_ALTSVC);
 #endif
@@ -1844,7 +1848,11 @@ static void curl_free_string(void **string)
 */
 static void curl_free_post(void **post)
 {
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+	curl_mime_free((curl_mime *)*post);
+#else
 	curl_formfree((struct HttpPost *)*post);
+#endif
 }
 /* }}} */

@@ -2159,8 +2167,6 @@ PHP_FUNCTION(curl_copy_handle)

 	_php_setup_easy_copy_handlers(dupch, ch);

-	Z_ADDREF_P(zid);
-
 	ZVAL_RES(return_value, zend_register_resource(dupch, le_curl));
 	dupch->res = Z_RES_P(return_value);
 }
@@ -2361,6 +2367,9 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 #endif
 #if LIBCURL_VERSION_NUM >= 0x073d00 /* Available since 7.61.0 */
 		case CURLOPT_DISALLOW_USERNAME_IN_URL:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x074000 /* Available since 7.64.0 */
+		case CURLOPT_HTTP09_ALLOWED:
 #endif
 			lval = zval_get_long(zvalue);
 #if LIBCURL_VERSION_NUM >= 0x071304
@@ -2710,7 +2719,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				return FAILURE;
 			}

-			ZEND_HASH_FOREACH_VAL(ph, current) {
+			ZEND_HASH_FOREACH_VAL_IND(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
 				slist = curl_slist_append(slist, ZSTR_VAL(val));
@@ -2764,17 +2773,31 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				HashTable *postfields;
 				zend_string *string_key;
 				zend_ulong  num_key;
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+				curl_mime *mime = NULL;
+				curl_mimepart *part;
+				CURLcode form_error;
+#else
 				struct HttpPost *first = NULL;
 				struct HttpPost *last  = NULL;
 				CURLFORMcode form_error;
-
+#endif
 				postfields = HASH_OF(zvalue);
 				if (!postfields) {
 					php_error_docref(NULL, E_WARNING, "Couldn't get HashTable in CURLOPT_POSTFIELDS");
 					return FAILURE;
 				}

-				ZEND_HASH_FOREACH_KEY_VAL(postfields, num_key, string_key, current) {
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+				if (zend_hash_num_elements(postfields) > 0) {
+					mime = curl_mime_init(ch->cp);
+					if (mime == NULL) {
+						return FAILURE;
+					}
+				}
+#endif
+
+				ZEND_HASH_FOREACH_KEY_VAL_IND(postfields, num_key, string_key, current) {
 					zend_string *postval, *tmp_postval;
 					/* Pretend we have a string_key here */
 					if (!string_key) {
@@ -2808,6 +2831,20 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 							if (Z_TYPE_P(prop) == IS_STRING && Z_STRLEN_P(prop) > 0) {
 								filename = Z_STRVAL_P(prop);
 							}
+
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+							part = curl_mime_addpart(mime);
+							if (part == NULL) {
+								zend_string_release_ex(string_key, 0);
+								return FAILURE;
+							}
+							if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK
+								|| (form_error = curl_mime_filedata(part, ZSTR_VAL(postval))) != CURLE_OK
+								|| (form_error = curl_mime_filename(part, filename ? filename : ZSTR_VAL(postval))) != CURLE_OK
+								|| (form_error = curl_mime_type(part, type ? type : "application/octet-stream")) != CURLE_OK) {
+								error = form_error;
+							}
+#else
 							form_error = curl_formadd(&first, &last,
 											CURLFORM_COPYNAME, ZSTR_VAL(string_key),
 											CURLFORM_NAMELENGTH, ZSTR_LEN(string_key),
@@ -2819,6 +2856,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 								/* Not nice to convert between enums but we only have place for one error type */
 								error = (CURLcode)form_error;
 							}
+#endif
 						}

 						zend_string_release_ex(string_key, 0);
@@ -2827,6 +2865,18 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{

 					postval = zval_get_tmp_string(current, &tmp_postval);

+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+					part = curl_mime_addpart(mime);
+					if (part == NULL) {
+						zend_tmp_string_release(tmp_postval);
+						zend_string_release_ex(string_key, 0);
+						return FAILURE;
+					}
+					if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK
+						|| (form_error = curl_mime_data(part, ZSTR_VAL(postval), ZSTR_LEN(postval))) != CURLE_OK) {
+						error = form_error;
+					}
+#else
 					/* The arguments after _NAMELENGTH and _CONTENTSLENGTH
 					 * must be explicitly cast to long in curl_formadd
 					 * use since curl needs a long not an int. */
@@ -2841,6 +2891,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 						/* Not nice to convert between enums but we only have place for one error type */
 						error = (CURLcode)form_error;
 					}
+#endif
 					zend_tmp_string_release(tmp_postval);
 					zend_string_release_ex(string_key, 0);
 				} ZEND_HASH_FOREACH_END();
@@ -2853,8 +2904,13 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				if ((*ch->clone) == 1) {
 					zend_llist_clean(&ch->to_free->post);
 				}
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
+				zend_llist_add_element(&ch->to_free->post, &mime);
+				error = curl_easy_setopt(ch->cp, CURLOPT_MIMEPOST, mime);
+#else
 				zend_llist_add_element(&ch->to_free->post, &first);
 				error = curl_easy_setopt(ch->cp, CURLOPT_HTTPPOST, first);
+#endif
 			} else {
 #if LIBCURL_VERSION_NUM >= 0x071101
 				zend_string *tmp_str;
@@ -92,6 +92,8 @@ PHP_FUNCTION(curl_multi_add_handle)
 		RETURN_FALSE;
 	}

+	_php_curl_verify_handlers(ch, 1);
+
 	_php_curl_cleanup_handle(ch);

 	GC_ADDREF(Z_RES_P(z_ch));
@@ -2,12 +2,7 @@
 Bug #45161 (Reusing a curl handle leaks memory)
 --SKIPIF--
 <?php
-if (substr(PHP_OS, 0, 3) == 'WIN') {
-	exit("skip not for Windows");
-}
-if (!extension_loaded("curl")) {
-	exit("skip curl extension not loaded");
-}
+include 'skipif.inc';
 $curl_version = curl_version();
 if ($curl_version['version_number'] < 0x071100) {
 	exit("skip: test works only with curl >= 7.17.0");
@@ -15,10 +10,12 @@ if ($curl_version['version_number'] < 0x071100) {
 ?>
 --FILE--
 <?php
+include 'server.inc';
+$host = curl_cli_server_start();

 // Fill memory for test
 $ch = curl_init();
-$fp = fopen('/dev/null', 'w');
+$fp = fopen(PHP_OS_FAMILY === 'Windows' ? 'nul' : '/dev/null', 'w');

 /*
 $i = $start = $end = 100000.00;
@@ -32,7 +29,7 @@ for ($i = 0; $i < 100; $i++) {
 // Start actual test
 $start = memory_get_usage() + 1024;
 for($i = 0; $i < 1024; $i++) {
-	curl_setopt($ch, CURLOPT_URL, 'http://127.0.0.1:9/');
+	curl_setopt($ch, CURLOPT_URL, "{$host}/get.inc");
 	curl_setopt($ch, CURLOPT_FILE, $fp);
 	curl_exec($ch);
 }
@@ -2,13 +2,14 @@
 Bug #46739 (array returned by curl_getinfo should contain content_type key)
 --SKIPIF--
 <?php
-if (!extension_loaded("curl")) {
-	exit("skip curl extension not loaded");
-}
+include 'skipif.inc';
 ?>
 --FILE--
 <?php
-$ch = curl_init('http://127.0.0.1:9/');
+include 'server.inc';
+$host = curl_cli_server_start();
+$ch = curl_init("{$host}/get.inc");
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

 curl_exec($ch);
 $info = curl_getinfo($ch);
@@ -67,25 +67,25 @@ foreach($options_to_check as $option) {
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?>
 --EXPECTF--
-Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
-
-Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+%A
+Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
 %A
 Ok for CURLOPT_STDERR

-Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d

-Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
 Ok for CURLOPT_WRITEHEADER

-Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d

-Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
 Hello World!
 Hello World!Hello World!
 Hello World!Ok for CURLOPT_FILE

-Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d

-Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
 Ok for CURLOPT_INFILE
@@ -3,6 +3,7 @@ Bug #78775: TLS issues from HTTP request affecting other encrypted connections
 --SKIPIF--
 <?php
 if (!extension_loaded('curl')) die('skip Requires curl');
+if (!extension_loaded('openssl')) die('skip Requires openssl');
 if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
 ?>
 --FILE--
@@ -0,0 +1,29 @@
+--TEST--
+Bug #79033 (Curl timeout error with specific url and post)
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+include 'server.inc';
+$host = curl_cli_server_start();
+$ch = curl_init();
+curl_setopt_array($ch, [
+	CURLOPT_URL => "{$host}/get.inc?test=post",
+	CURLOPT_POST => true,
+    CURLOPT_POSTFIELDS => [],
+    CURLINFO_HEADER_OUT => true,
+	CURLOPT_RETURNTRANSFER => true,
+]);
+var_dump(curl_exec($ch));
+var_dump(curl_getinfo($ch)["request_header"]);
+?>
+--EXPECTF--
+string(%d) "array(0) {
+}
+"
+string(90) "POST /get.inc?test=post HTTP/1.1
+Host: localhost:%d
+Accept: */*
+Content-Length: 0
+
+"
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79199 (curl_copy_handle() memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip curl extension not available');
+?>
+--FILE--
+<?php
+$mem_old = 0;
+for($i = 0; $i < 50; ++$i) {
+    $c1 = curl_init();
+    $c2 = curl_copy_handle($c1);
+    curl_close($c2);
+    curl_close($c1);
+    $mem_new = memory_get_usage();
+    if ($mem_new <= $mem_old) {
+        break;
+    }
+    $mem_old = $mem_new;
+}
+echo $i < 50 ? "okay" : "leak", PHP_EOL;
+?>
+--EXPECT--
+okay
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79741: curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties
+--FILE--
+<?php
+
+class Test {
+	public $prop = "value";
+}
+
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_POSTFIELDS, new Test);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -7,7 +7,7 @@ TestFest 2009 - AFUP - Perrick Penet <perrick@noparking.net>
 --FILE--
 <?php

-$url = uniqid()."://www.".uniqid().".".uniqid();
+$url = substr(uniqid(),0,7)."://www.".uniqid().".".uniqid();
 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $url);

@@ -18,6 +18,6 @@ curl_close($ch);


 ?>
--EXPECTREGEX--
-string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
-int\(\d\)
+--EXPECTF--
+string(%d) "%Srotocol%s"
+int(1)
@@ -1,6 +1,7 @@
 // vim:ft=javascript

 EXTENSION("date", "php_date.c", false, "/Iext/date/lib /DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 /DHAVE_TIMELIB_CONFIG_H=1");
+PHP_DATE = "yes";
 ADD_SOURCES("ext/date/lib", "astro.c timelib.c dow.c parse_date.c parse_tz.c tm2unixtime.c unixtime2tm.c parse_iso_intervals.c interval.c", "date");
 AC_DEFINE('HAVE_DATE', 1, 'Have date/time support');

@@ -1001,7 +1001,7 @@ reltextnumber = 'first'|'second'|'third'|'fourth'|'fifth'|'sixth'|'seventh'|'eig
 reltexttext = 'next'|'last'|'previous'|'this';
 reltextunit = 'ms' | 'µs' | (('msec'|'millisecond'|'µsec'|'microsecond'|'usec'|'sec'|'second'|'min'|'minute'|'hour'|'day'|'fortnight'|'forthnight'|'month'|'year') 's'?) | 'weeks' | daytext;

-relnumber = ([+-]*[ \t]*[0-9]+);
+relnumber = ([+-]*[ \t]*[0-9]{1,13});
 relative = relnumber space? (reltextunit | 'week' );
 relativetext = (reltextnumber|reltexttext) space reltextunit;
 relativetextweek = reltexttext space 'week';