Update versions for PHP 7.4.8

Revert "Partial fixed bug #79649 (Altering disable_functions from module init corrupts memory)"
This reverts commit a297c09da5.
2026-11-09 18:20:50 +00:00 · 2020-07-09 08:57:18 +00:00 · 2020-07-09 09:50:45 +01:00 · 2020-07-07 09:27:40 +00:00 · 2020-07-07 10:25:50 +01:00 · 2020-06-23 07:36:54 +00:00
411 changed files with 29044 additions and 31288 deletions
@@ -1,231 +1,16 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-15 Oct 2020, PHP 7.4.12RC1
-
- Core:
-  . Fixed bug #80061 (Copying large files may have suboptimal performance).
-    (cmb)
-  . Fixed bug #79423 (copy command is limited to size of file it can copy).
-    (cmb)
-  . Fixed bug #80126 (Covariant return types failing compilation). (Nikita)
-  . Fixed bug #80186 (Segfault when iterating over FFI object). (Nikita)
-
- Calendar:
-  . Fixed bug #80185 (jdtounix() fails after 2037). (cmb)
-
- IMAP:
-  . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
-  . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
-  . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
-  . Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
-    (cmb)
-  . Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
-    (cmb)
-  . Fixed bug #80226 (imap_sort() leaks sortpgm memory). (cmb)
-
- MySQLnd:
-  . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with
-    slashes). (cmb)
-  . Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when
-    compression is enabled). (Nikita)
-
- ODBC:
-  . Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable). (cmb)
-  . Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
-    (cmb)
-  . Fixed bug #80150 (Failure to fetch error message). (cmb)
-  . Fixed bug #80152 (odbc_execute() moves internal pointer of $params). (cmb)
-  . Fixed bug #46050 (odbc_next_result corrupts prepared resource). (cmb)
-
- OPcache:
-  . Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data
-    binding). (Nikita)
-  . Fixed bug #80194 (Assertion failure during block assembly of unreachable
-    free with leading nop). (Nikita)
-
- PCRE:
-  . Updated to PCRE 10.35. (cmb)
-  . Fixed bug #80118 (Erroneous whitespace match with JIT only). (cmb)
-
- PDO_ODBC:
-  . Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer). (cmb)
-
- Standard:
-  . Fixed bug #80114 (parse_url does not accept URLs with port 0). (cmb, twosee)
-  . Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors). (cmb)
-  . Fixed bug #76735 (Incorrect message in fopen on invalid mode). (cmb)
-
- Tidy:
-  . Fixed bug #77040 (tidyNode::isHtml() is completely broken). (cmb)
-
-01 Oct 2020, PHP 7.4.11
-
- Core:
-  . Fixed bug #79979 (passing value to by-ref param via CUFA crashes). (cmb,
-    Nikita)
-  . Fixed bug #80037 (Typed property must not be accessed before initialization
-    when __get() declared). (Nikita)
-  . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb)
-  . Fixed bug #80049 (Memleak when coercing integers to string via variadic
-    argument). (Nikita)
-  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` 
-    cookies can be sent). (CVE-2020-7070) (Stas)
-
- Calendar:
-  . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
-    (Andy Postnikov)
-
- COM:
-  . Fixed bug #64130 (COM obj parameters passed by reference are not updated).
-    (cmb)
-
- OPcache:
-  . Fixed bug #80002 (calc free space for new interned string is wrong).
-    (t-matsuno)
-  . Fixed bug #80046 (FREE for SWITCH_STRING optimized away). (Nikita)
-  . Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode
-    handlers changed). (SammyK)
-
- OpenSSL:
-  . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 
-    bytes IV). (CVE-2020-7069) (Jakub Zelenka)
-
- PDO:
-  . Fixed bug #80027 (Terrible performance using $query->fetch on queries with
-    many bind parameters). (Matteo)
-
- SOAP:
-  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
-    "Transfer-Encoding: chunked"). (Matteo)
-
- Standard:
-  . Fixed bug #79986 (str_ireplace bug with diacritics characters). (cmb)
-  . Fixed bug #80077 (getmxrr test bug). (Rainer Jung)
-  . Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
-    (cmb)
-  . Fixed bug #80067 (Omitting the port in bindto setting errors). (cmb)
-
-03 Sep 2020, PHP 7.4.10
-
- Core:
-  . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
-  . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
-  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
-  . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
-    (Santiago M. Mola)
-  . Fixed bug #79919 (Stack use-after-scope in define()). (cmb)
-  . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
-    (Pieter van den Ham)
-  . Fixed bug #79947 (Memory leak on invalid offset type in compound
-    assignment). (Nikita)
-
- COM:
-  . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
-    (cmb)
-
- Exif:
-  . Fixed bug #75785 (Many errors from exif_read_data).
-    (Níckolas Daniel da Silva)
-
- Gettext:
-  . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
-    gettext()). (Florian Engelhardt)
-
- LDAP:
-  . Fixed memory leaks. (ptomulik)
-
- OPcache:
-  . Fixed bug #73060 (php failed with error after temp folder cleaned up).
-    (cmb)
-  . Fixed bug #79917 (File cache segfault with a static variable in inherited
-    method). (Nikita)
-
- PDO:
-  . Fixed bug #64705 (errorInfo property of PDOException is null when
-    PDO::__construct() fails). (Ahmed Abdou)
-
- Session:
-  . Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
-    (Nikita)
-
- Standard:
-  . Fixed bug #79930 (array_merge_recursive() crashes when called with array
-    with single reference). (Nikita)
-  . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita)
-  . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita)
-
- XML:
-  . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb)
-
-06 Aug 2020, PHP 7.4.9
-
- Apache:
-  . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
-    to return usec). (Herbert256)
-
- COM:
-  . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb)
-  . Fixed bug #63527 (DCOM does not work with Username, Password parameter).
-    (cmb)
-
- Core:
-  . Fixed bug #79877 (getimagesize function silently truncates after a null 
-    byte) (cmb)
-  . Fixed bug #79740 (serialize() and unserialize() methods can not be called
-    statically). (Nikita)
-  . Fixed bug #79783 (Segfault in php_str_replace_common). (Nikita)
-  . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
-    static variable). (Nikita)
-  . Fixed bug #79779 (Assertion failure when assigning property of string
-    offset by reference). (Nikita)
-  . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
-    (Nikita)
-  . Fixed bug #78598 (Changing array during undef index RW error segfaults).
-    (Nikita)
-  . Fixed bug #79784 (Use after free if changing array during undef var during
-    array write fetch). (Nikita)
-  . Fixed bug #79793 (Use after free if string used in undefined index warning
-    is changed). (Nikita)
-  . Fixed bug #79862 (Public non-static property in child should take priority
-    over private static). (Nikita)
-
- Fileinfo:
-  . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)
-
- FTP:
-  . Fixed bug #55857 (ftp_size on large files). (cmb)
-
- Mbstring:
-  . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
-
- OpenSSL:
-  . Fixed bug #79881 (Memory leak in openssl_pkey_get_public()). (Nikita)
-
- Phar:
-  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
-    function). (CVE-2020-7068) (cmb)
-
- Reflection:
-  . Fixed bug #79487 (::getStaticProperties() ignores property modifications).
-    (cmb, Nikita)
-  . Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
-    (cmb, Nikita)
-  . Fixed bug #79820 (Use after free when type duplicated into
-    ReflectionProperty gets resolved). (Christopher Broadbent)
-
- Standard:
-  . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
-  . Fixed bug #78008 (dns_check_record() always return true on Alpine).
-    (Andy Postnikov)
-  . Fixed bug #79839 (array_walk() does not respect property types). (Nikita)
-
 09 Jul 2020, PHP 7.4.8

 - Core:
+  . Fixed bug #79649 (Altering disable_functions from module init corrupts
+    memory). (Laruence)
  . Fixed bug #79595 (zend_init_fpu() alters FPU precision). (cmb, Nikita)
  . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)
  . Fixed bug #79668 (get_defined_functions(true) may miss functions). (cmb,
    Nikita)
+  . Fixed bug #79657 ("yield from" hangs when invalid value encountered).
+    (Nikita)
  . Fixed bug #79683 (Fake reflection scope affects __toString()). (Nikita)
  . Fixed possibly unsupported timercmp() usage. (cmb)

@@ -274,8 +59,6 @@ PHP                                                                        NEWS
  . Fixed bug #79489 (.user.ini does not inherit). (cmb)
  . Fixed bug #79600 (Regression in 7.4.6 when yielding an array based
    generator). (Nikita)
-  . Fixed bug #79657 ("yield from" hangs when invalid value encountered).
-    (Nikita)

 - FFI:
  . Fixed bug #79571 (FFI: var_dumping unions may segfault). (cmb)
@@ -125,11 +125,6 @@ DOM:
        After: ReflectionMethod::getClosure($object = null)
    The new signature is also (LSP) compatible with older PHP versions.

- SAPI:
-  . Starting with 7.4.11, incoming cookie names are not url-decoded. This was never 
-    required by the standard, outgoing cookie names aren't encoded and this leads 
-    to security issues (CVE-2020-7070).
-
 - SPL:
  . Calling get_object_vars() on an ArrayObject instance will now always return
    the properties of the ArrayObject itself (or a subclass). Previously it
@@ -164,16 +164,16 @@ int main()
 		double d = (double) LONG_MIN * LONG_MIN + 2e9;

 		if ((long) d == 2e9 && (long) -d == -2e9) {
-			return 0;
+			exit(0);
 		}
 	} else if (sizeof(long) == 8) {
 		double correct = 18e18 - ((double) LONG_MIN * -2); /* Subtract ULONG_MAX + 1 */

 		if ((long) 18e18 == correct) { /* On 64-bit, only check between LONG_MAX and ULONG_MAX */
-			return 0;
+			exit(0);
 		}
 	}
-	return 1;
+	exit(1);
 }
 ]])], [
  AC_DEFINE([ZEND_DVAL_TO_LVAL_CAST_OK], 1, [Define if double cast to long preserves least significant bits])
@@ -284,7 +284,7 @@ int main()
  fprintf(fp, "%d %d\n", ZEND_MM_ALIGNMENT, zeros);
  fclose(fp);

-  return 0;
+  exit(0);
 }
 ]])], [
  LIBZEND_MM_ALIGN=`cat conftest.zend | cut -d ' ' -f 1`
@@ -1,16 +0,0 @@
--TEST--
-Array addition should not add INDIRECT elements
--FILE--
-<?php
-
-$x = 1;
-$ary = ['y' => 1];
-$ary += $GLOBALS;
-var_dump($ary['x']);
-$x = 2;
-var_dump($ary['x']);
-
-?>
--EXPECT--
-int(1)
-int(1)
@@ -1,10 +0,0 @@
--TEST--
-Add $GLOBALS to itself
--FILE--
-<?php
-$GLOBALS += $GLOBALS;
-$x = $GLOBALS + $GLOBALS;
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,13 +0,0 @@
--TEST--
-Assign concat of array and empty string
--FILE--
-<?php
-
-$a = [0];
-$a .= '';
-var_dump($a);
-
-?>
--EXPECTF--
-Notice: Array to string conversion in %s on line %d
-string(5) "Array"
@@ -26,7 +26,7 @@ namespace N2 {
    echo $a->hello(), PHP_EOL;
    echo $a->foo(), PHP_EOL;
    try {
-    } catch(namespace\Foo $e)
+    } catch(namespace \Foo $e)
    {
    }
 }
@@ -14,5 +14,5 @@ var_dump($a);
 --EXPECT--
 array(1) {
  ["b"]=>
-  int(2)
+  int(1)
 }
@@ -1,31 +0,0 @@
--TEST--
-Bug #78598: Changing array during undef index RW error segfaults
--FILE--
-<?php
-
-$my_var = null;
-set_error_handler(function() use(&$my_var) {
-    $my_var = 0;
-});
-
-$my_var[0] .= "xyz";
-var_dump($my_var);
-
-$my_var = null;
-$my_var[0][0][0] .= "xyz";
-var_dump($my_var);
-
-$my_var = null;
-$my_var["foo"] .= "xyz";
-var_dump($my_var);
-
-$my_var = null;
-$my_var["foo"]["bar"]["baz"] .= "xyz";
-var_dump($my_var);
-
-?>
--EXPECT--
-int(0)
-int(0)
-int(0)
-int(0)
@@ -24,4 +24,4 @@ try{
 ?>
 --EXPECT--
 string(21) "Undefined variable: b"
-string(21) "Undefined variable: b"
+string(21) "Undefined variable: c"
@@ -1,22 +0,0 @@
--TEST--
-Bug #79740: serialize() and unserialize() methods can not be called statically
--FILE--
-<?php
-class A {
-    public function serialize() { }
-    public function unserialize() { }
-}
-
-var_dump(is_callable(['A', 'serialize']));
-var_dump(is_callable(['A', 'unserialize']));
-A::serialize();
-A::unserialize();
-
-?>
--EXPECTF--
-bool(true)
-bool(true)
-
-Deprecated: Non-static method A::serialize() should not be called statically in %s on line %d
-
-Deprecated: Non-static method A::unserialize() should not be called statically in %s on line %d
@@ -1,26 +0,0 @@
--TEST--
-Bug #79778: Assertion failure if dumping closure with unresolved static variable
--FILE--
-<?php
-$closure1 = function() {
-    static $var = CONST_REF;
-};
-var_dump($closure1);
-print_r($closure1);
-?>
--EXPECT--
-object(Closure)#1 (1) {
-  ["static"]=>
-  array(1) {
-    ["var"]=>
-    string(14) "<constant ast>"
-  }
-}
-Closure Object
-(
-    [static] => Array
-        (
-            [var] => <constant ast>
-        )
-
-)
@@ -1,12 +0,0 @@
--TEST--
-Bug #79779: Assertion failure when assigning property of string offset by reference
--FILE--
-<?php
-$str = "";
-$str[1]->a = &$b;
-?>
--EXPECTF--
-Fatal error: Uncaught Error: Cannot use string offset as an object in %s:%d
-Stack trace:
-#0 {main}
-  thrown in %s on line %d
@@ -1,11 +0,0 @@
--TEST--
-Bug #79783: Segfault in php_str_replace_common
--FILE--
-<?php
-str_replace("a", "b", "c", strlen("d"));
-?>
--EXPECTF--
-Fatal error: Uncaught Error: Cannot pass parameter 4 by reference in %s:%d
-Stack trace:
-#0 {main}
-  thrown in %s on line %d
@@ -1,20 +0,0 @@
--TEST--
-Bug #79784: Use after free if changing array during undef var during array write fetch
--FILE--
-<?php
-set_error_handler(function () {
-    $GLOBALS['a'] = null;
-});
-
-$a[$c] = 'x' ;
-var_dump($a);
-$a[$c] .= 'x' ;
-var_dump($a);
-$a[$c][$c] = 'x' ;
-var_dump($a);
-
-?>
--EXPECT--
-NULL
-NULL
-NULL
@@ -1,16 +0,0 @@
--TEST--
-Bug #79792: HT iterators not removed if empty array is destroyed
--FILE--
-<?php
-$a = [42];
-foreach ($a as &$c) {
-    // Make the array empty.
-    unset($a[0]);
-    // Destroy the array.
-    $a = null;
-}
-?>
-===DONE===
--EXPECTF--
-Warning: Invalid argument supplied for foreach() in %s on line %d
-===DONE===
@@ -1,32 +0,0 @@
--TEST--
-Bug #79793: Use after free if string used in undefined index warning is changed
--FILE--
-<?php
-
-$key = "foo";
-$key .= "bar";
-set_error_handler(function($_, $m) use (&$key) {
-    echo "$m\n";
-    $key .= "baz";
-});
-
-$ary = [];
-$ary[$key]++;
-var_dump($ary);
-$ary[$key] += 1;
-var_dump($ary);
-
-?>
--EXPECT--
-Undefined index: foobar
-array(1) {
-  ["foobar"]=>
-  int(1)
-}
-Undefined index: foobarbaz
-array(2) {
-  ["foobar"]=>
-  int(1)
-  ["foobarbaz"]=>
-  int(1)
-}
@@ -1,60 +0,0 @@
--TEST--
-Bug #79862: Public non-static property in child should take priority over private static
--FILE--
-<?php
-
-class a {
-    private static $prop1;
-    private static $prop2;
-    private $prop3;
-    private $prop4;
-    private static $prop5;
-    private static $prop6;
-    public function __construct() {
-        $this->prop1 = 1;
-        $this->prop2 = 2;
-        $this->prop3 = 3;
-        $this->prop4 = 4;
-        $this->prop5 = 5;
-        $this->prop6 = 6;
-        var_dump(self::$prop1);
-        var_dump(self::$prop2);
-        var_dump(self::$prop5);
-        var_dump(self::$prop6);
-        var_dump($this);
-    }
-}
-class c extends a {
-    public $prop1;
-    protected $prop2;
-    public static $prop3;
-    protected static $prop4;
-    public static $prop5;
-    protected static $prop6;
-}
-
-$c = new c;
-
-?>
--EXPECTF--
-Notice: Accessing static property c::$prop5 as non static in %s on line %d
-
-Notice: Accessing static property c::$prop6 as non static in %s on line %d
-NULL
-NULL
-NULL
-NULL
-object(c)#1 (6) {
-  ["prop1"]=>
-  int(1)
-  ["prop2":protected]=>
-  int(2)
-  ["prop3":"a":private]=>
-  int(3)
-  ["prop4":"a":private]=>
-  int(4)
-  ["prop5"]=>
-  int(5)
-  ["prop6"]=>
-  int(6)
-}
@@ -1,14 +0,0 @@
--TEST--
-Bug #79919 (Stack use-after-scope in define())
--SKIPIF--
-<?php
-if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
-?>
--FILE--
-<?php
-$b = error_log(0);
-$b = simplexml_load_string('<xml/>', null, $b);
-define(0, $b);
-?>
--EXPECT--
-0
@@ -1,29 +0,0 @@
--TEST--
-Bug #79934: CRLF-only line in heredoc causes parsing error
--DESCRIPTION--
-This test covers different variations of whitespace-only lines in heredoc strings.
-These whitespace-only lines should be ignored when stripping indentation.
--FILE--
-<?php
-// lines with only CRLF should not cause a parse error
-eval("\$s1 = <<<HEREDOC\r\n    a\r\n\r\n    b\r\n    HEREDOC;");
-var_dump(addcslashes($s1, "\r\n"));
-
-// lines with only a LF should not cause a parse error
-eval("\$s2 = <<<HEREDOC\n    a\n\n    b\n    HEREDOC;");
-var_dump(addcslashes($s2, "\n"));
-
-// lines with only a CR should not cause a parse error
-eval("\$s3 = <<<HEREDOC\r    a\r\r    b\r    HEREDOC;");
-var_dump(addcslashes($s3, "\r"));
-
-// lines with only whitespace should not cause a parse error
-eval("\$s4 = <<<HEREDOC\r    a\r\n  \r\n    b\r    HEREDOC;");
-var_dump(addcslashes($s4, "\n\r"));
-
-?>
--EXPECT--
-string(10) "a\r\n\r\nb"
-string(6) "a\n\nb"
-string(6) "a\r\rb"
-string(10) "a\r\n\r\nb"
@@ -1,13 +0,0 @@
--TEST--
-Bug #79947: Memory leak on invalid offset type in compound assignment
--FILE--
-<?php
-$array = [];
-$key = [];
-$array[$key] += [$key];
-var_dump($array);
-?>
--EXPECTF--
-Warning: Illegal offset type in %s on line %d
-array(0) {
-}
@@ -1,17 +0,0 @@
--TEST--
-Bug #79979 (passing value to by-ref param via CUF(A) crashes)
--FILE--
-<?php
-call_user_func_array("str_replace", ["a", "b", "c", 0]);
-
-$cufa = "call_user_func_array";
-$cufa("str_replace", ["a", "b", "c", 0]);
-
-call_user_func_array($cufa, ["str_replace", ["a", "b", "c", 0]]);
-?>
--EXPECTF--
-Warning: Parameter 4 to str_replace() expected to be a reference, value given in %s on line %d
-
-Warning: Parameter 4 to str_replace() expected to be a reference, value given in %s on line %d
-
-Warning: Parameter 4 to str_replace() expected to be a reference, value given in %s on line %d
@@ -1,32 +0,0 @@
--TEST--
-Bug #80037: Typed property must not be accessed before initialization when __get() declared
--FILE--
-<?php
-
-final class A
-{
-	public string $a;
-
-	public static function fromArray(array $props): self
-	{
-		$me = new static;
-		foreach ($props as $k => &$v) {
-			$me->{$k} = &$v;  # try to remove &
-		}
-		return $me;
-	}
-
-	public function __get($name)
-	{
-		throw new \LogicException("Property '$name' is not defined.");
-	}
-}
-
-var_dump(A::fromArray(['a' => 'foo']));
-
-?>
--EXPECT--
-object(A)#1 (1) {
-  ["a"]=>
-  string(3) "foo"
-}
@@ -1,22 +0,0 @@
--TEST--
-Bug #80046: FREE for SWITCH_STRING optimized away
--FILE--
-<?php
-
-function test($foo) {
-    switch ($foo . 'Bar') {
-        case 'A':
-            throw new Exception('A');
-        default:
-            throw new Exception('Default');
-    }
-}
-try {
-    test('Foo');
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Default
@@ -1,14 +0,0 @@
--TEST--
-Bug #80049: Memleak when coercing integers to string via variadic argument
--FILE--
-<?php
-function coerceToString(string ...$strings) {
-    var_dump($strings);
-}
-coerceToString(...[123]);
-?>
--EXPECT--
-array(1) {
-  [0]=>
-  string(3) "123"
-}
@@ -1,23 +0,0 @@
--TEST--
-Bug #80126: Covariant return types failing compilation
--FILE--
-<?php
-
-interface I {
-    public function method(): I;
-}
-
-abstract class A implements I {
-    public function method(): I { }
-}
-
-class C extends A { }
-
-class C2 extends C {
-    public function method(): C2 { }
-}
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,27 +0,0 @@
--TEST--
-Bug #80126: Covariant return types failing compilation (variation 2)
--FILE--
-<?php
-
-interface I {
-    public function method(): I;
-}
-
-abstract class A implements I {
-    public function method(): I {
-        return new static();
-    }
-}
-
-class C extends A { }
-
-interface I2 { }
-
-class C2 extends C implements I2 {
-    public function method(): C2 { }
-}
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,22 +0,0 @@
--TEST--
-Bug #80194: Assertion failure during block assembly of unreachable free with leading nop
--FILE--
-<?php
-
-function test($x) {
-    switch ($x->y) {
-        default:
-            throw new Exception;
-        case 'foobar':
-            return new stdClass();
-            break;
-    }
-}
-
-$x = (object)['y' => 'foobar'];
-var_dump(test($x));
-
-?>
--EXPECT--
-object(stdClass)#2 (0) {
-}
@@ -1,25 +0,0 @@
--TEST--
-EX(func) can be null during write_property in an edge case
--FILE--
-<?php
-class a {
-    public static $i = 0;
-    function __destruct() {
-        if (self::$i++ != 0) throw new Exception;
-        $b = new a;
-        echo $b;
-    }
-}
-new a;
-?>
--EXPECTF--
-Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d
-Stack trace:
-#0 %s(%d): a->__destruct()
-#1 {main}
-
-Next Exception in %s:%d
-Stack trace:
-#0 %s(%d): a->__destruct()
-#1 {main}
-  thrown in %s on line %d
@@ -1,23 +0,0 @@
--TEST--
-Exception thrown by __get() during =& assignment
--FILE--
-<?php
-
-class Test {
-    private $x;
-    public function &__get($name) {
-        throw new Exception("Foobar");
-    }
-}
-
-$test = new Test;
-$y = 5;
-try {
-    $test->x =& $y;
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Foobar
@@ -1,20 +0,0 @@
--TEST--
-Leak when setting recursive previous exception in finally handling
--FILE--
-<?php
-
-try {
-    try {
-        throw new Exception("Test");
-    } catch (Exception $e) {
-        throw $e;
-    } finally {
-        throw $e;
-    }
-} catch (Exception $e2) {
-    echo $e2->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Test
@@ -1,18 +0,0 @@
--TEST--
-Yield from non-iterable
--FILE--
-<?php
-
-function gen() {
-    yield from new stdClass;
-}
-
-try {
-    gen()->current();
-} catch (Error $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Can use "yield from" only with arrays and Traversables
@@ -1,30 +0,0 @@
--TEST--
-Exception from valid() during yield from
--FILE--
-<?php
-
-class FooBar implements Iterator {
-    function rewind() {}
-    function current() {}
-    function key() {}
-    function next() {}
-    function valid() {
-        throw new Exception("Exception from valid()");
-    }
-}
-
-function gen() {
-    try {
-        // the fact that the yield from result is used is relevant.
-        var_dump(yield from new FooBar);
-    } catch (Exception $e) {
-        echo $e->getMessage(), "\n";
-    }
-}
-
-$x = gen();
-$x->current();
-
-?>
--EXPECT--
-Exception from valid()
@@ -1,16 +0,0 @@
--TEST--
-String offset error during list() by-ref assignment
--FILE--
-<?php
-
-$a = [0];
-$v = 'b';
-$i = 0;
-list(&$a[$i++]) = $v;
-
-?>
--EXPECTF--
-Fatal error: Uncaught Error: Cannot create references to/from string offsets in %s:%d
-Stack trace:
-#0 {main}
-  thrown in %s on line %d
@@ -1,16 +0,0 @@
--TEST--
-Test property guard hash value assumption
--FILE--
-<?php
-class Test {
-    function __get($var) {
-        return $this->{$var.''};
-    }
-}
-
-$test = new Test;
-var_dump($test->x);
-?>
--EXPECTF--
-Notice: Undefined property: Test::$x in %s on line %d
-NULL
@@ -1,14 +0,0 @@
--TEST--
-Regression test for incorrect update of pi node users when removing a predecessor block
--FILE--
-<?php
-
-function test() {
-    for (; $n--; )
-        C;
-}
-test();
-
-?>
--EXPECTF--
-Notice: Undefined variable: n in %s on line %d
@@ -1,46 +0,0 @@
--TEST--
-Converting undefined index/offset notice to exception
--FILE--
-<?php
-
-set_error_handler(function($_, $msg) {
-    throw new Exception($msg);
-});
-
-$test = [];
-try {
-    $test[0] .= "xyz";
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-var_dump($test);
-
-try {
-    $test["key"] .= "xyz";
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-var_dump($test);
-
-unset($test);
-try {
-    $GLOBALS["test"] .= "xyz";
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-try {
-    var_dump($test);
-} catch (Exception $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Undefined offset: 0
-array(0) {
-}
-Undefined index: key
-array(0) {
-}
-Undefined index: test
-Undefined variable: test
@@ -6,7 +6,6 @@ No warnings should be thrown during heredoc scan-ahead
 <<<TEST
 ${x}
 \400
-${"\400"}
 ${/*}
 TEST;

@@ -16,8 +15,6 @@ Warning: Unexpected character in input:  '' (ASCII=1) state=0 in %s on line %d

 Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d

-Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d
-
 Warning: Unterminated comment starting line %d in %s on line %d

 Parse error: syntax error, unexpected end of file in %s on line %d
@@ -1086,11 +1086,6 @@ void zend_shutdown(void) /* {{{ */
 		CG(map_ptr_base) = NULL;
 		CG(map_ptr_size) = 0;
 	}
-	if (CG(script_encoding_list)) {
-		free(CG(script_encoding_list));
-		CG(script_encoding_list) = NULL;
-		CG(script_encoding_list_size) = 0;
-	}
 #endif
 	zend_destroy_rsrc_list_dtors();
 }
@@ -1259,6 +1254,10 @@ ZEND_API zval *zend_get_configuration_directive(zend_string *name) /* {{{ */
 		} \
 	} while (0)

+static void arg_copy_ctor(zval *zv) {
+	zval_copy_ctor(zv);
+}
+
 static ZEND_COLD void zend_error_va_list(
 		int type, const char *error_filename, uint32_t error_lineno,
 		const char *format, va_list args)
@@ -1352,7 +1351,9 @@ static ZEND_COLD void zend_error_va_list(
 			if (!symbol_table) {
 				ZVAL_NULL(&params[4]);
 			} else {
-				ZVAL_ARR(&params[4], zend_array_dup(symbol_table));
+				array_init(&params[4]);
+				/* always try to do noninvasive duplication */
+				zend_hash_copy(Z_ARRVAL(params[4]), symbol_table, arg_copy_ctor);
 			}

 			ZVAL_COPY_VALUE(&orig_user_error_handler, &EG(user_error_handler));
@@ -4367,7 +4367,7 @@ ZEND_API void zend_save_error_handling(zend_error_handling *current) /* {{{ */
 {
 	current->handling = EG(error_handling);
 	current->exception = EG(exception_class);
-	ZVAL_UNDEF(&current->user_handler);
+	ZVAL_COPY(&current->user_handler, &EG(user_error_handler));
 }
 /* }}} */

@@ -4375,17 +4375,54 @@ ZEND_API void zend_replace_error_handling(zend_error_handling_t error_handling,
 {
 	if (current) {
 		zend_save_error_handling(current);
+		if (error_handling != EH_NORMAL && Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
+			zval_ptr_dtor(&EG(user_error_handler));
+			ZVAL_UNDEF(&EG(user_error_handler));
+		}
 	}
-	ZEND_ASSERT(error_handling == EH_THROW || exception_class == NULL);
 	EG(error_handling) = error_handling;
-	EG(exception_class) = exception_class;
+	EG(exception_class) = error_handling == EH_THROW ? exception_class : NULL;
+}
+/* }}} */
+
+static int same_zval(zval *zv1, zval *zv2)  /* {{{ */
+{
+	if (Z_TYPE_P(zv1) != Z_TYPE_P(zv2)) {
+		return 0;
+	}
+	switch (Z_TYPE_P(zv1)) {
+		case IS_UNDEF:
+		case IS_NULL:
+		case IS_FALSE:
+		case IS_TRUE:
+			return 1;
+		case IS_LONG:
+			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
+		case IS_DOUBLE:
+			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
+		case IS_STRING:
+		case IS_ARRAY:
+		case IS_OBJECT:
+		case IS_RESOURCE:
+			return Z_COUNTED_P(zv1) == Z_COUNTED_P(zv2);
+		default:
+			return 0;
+	}
 }
 /* }}} */

 ZEND_API void zend_restore_error_handling(zend_error_handling *saved) /* {{{ */
 {
 	EG(error_handling) = saved->handling;
-	EG(exception_class) = saved->exception;
+	EG(exception_class) = saved->handling == EH_THROW ? saved->exception : NULL;
+	if (Z_TYPE(saved->user_handler) != IS_UNDEF
+		&& !same_zval(&saved->user_handler, &EG(user_error_handler))) {
+		zval_ptr_dtor(&EG(user_error_handler));
+		ZVAL_COPY_VALUE(&EG(user_error_handler), &saved->user_handler);
+	} else if (Z_TYPE(saved->user_handler)) {
+		zval_ptr_dtor(&saved->user_handler);
+	}
+	ZVAL_UNDEF(&saved->user_handler);
 }
 /* }}} */

@@ -895,7 +895,9 @@ repeat:
 		case IS_OBJECT:
 			if (Z_TYPE(val_free) == IS_UNDEF) {
 				if (Z_OBJ_HT_P(val)->get) {
-					val = Z_OBJ_HT_P(val)->get(val, &val_free);
+					zval rv;
+					val = Z_OBJ_HT_P(val)->get(val, &rv);
+					ZVAL_COPY_VALUE(&val_free, val);
 					goto repeat;
 				} else if (Z_OBJ_HT_P(val)->cast_object) {
 					if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) {
@@ -531,17 +531,10 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	debug_info = zend_new_array(8);

 	if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
-		zval *var;
 		HashTable *static_variables =
 			ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr);
 		ZVAL_ARR(&val, zend_array_dup(static_variables));
 		zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
-		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(val), var) {
-			if (Z_TYPE_P(var) == IS_CONSTANT_AST) {
-				zval_ptr_dtor(var);
-				ZVAL_STRING(var, "<constant ast>");
-			}
-		} ZEND_HASH_FOREACH_END();
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -3009,11 +3009,7 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
 				zend_compile_var(&arg_node, arg, BP_VAR_R, 0);
 				if (arg_node.op_type & (IS_CONST|IS_TMP_VAR)) {
 					/* Function call was converted into builtin instruction */
-					if (!fbc || ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
-						opcode = ZEND_SEND_VAL_EX;
-					} else {
-						opcode = ZEND_SEND_VAL;
-					}
+					opcode = ZEND_SEND_VAL;
 				} else {
 					if (fbc) {
 						if (ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
@@ -5817,14 +5813,8 @@ void zend_begin_method_decl(zend_op_array *op_array, zend_string *name, zend_boo
 			}
 		} else if (zend_string_equals_literal(lcname, "serialize")) {
 			ce->serialize_func = (zend_function *) op_array;
-			if (!is_static) {
-				op_array->fn_flags |= ZEND_ACC_ALLOW_STATIC;
-			}
 		} else if (zend_string_equals_literal(lcname, "unserialize")) {
 			ce->unserialize_func = (zend_function *) op_array;
-			if (!is_static) {
-				op_array->fn_flags |= ZEND_ACC_ALLOW_STATIC;
-			}
 		} else if (ZSTR_VAL(lcname)[0] != '_' || ZSTR_VAL(lcname)[1] != '_') {
 			if (!is_static) {
 				op_array->fn_flags |= ZEND_ACC_ALLOW_STATIC;
@@ -76,15 +76,9 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 	zval  pv, zv, rv;
 	zend_class_entry *base_ce;

-	if (!exception || !add_previous) {
+	if (exception == add_previous || !add_previous || !exception) {
 		return;
 	}
-
-	if (exception == add_previous) {
-		OBJ_RELEASE(add_previous);
-		return;
-	}
-
 	ZVAL_OBJ(&pv, add_previous);
 	if (!instanceof_function(Z_OBJCE(pv), zend_ce_throwable)) {
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
@@ -1446,21 +1446,9 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
 			while (opline < end) {
 				if (opline->op1_type == IS_VAR && opline->op1.var == var) {
 					switch (opline->opcode) {
-						case ZEND_FETCH_OBJ_W:
-						case ZEND_FETCH_OBJ_RW:
-						case ZEND_FETCH_OBJ_FUNC_ARG:
-						case ZEND_FETCH_OBJ_UNSET:
-						case ZEND_ASSIGN_OBJ:
 						case ZEND_ASSIGN_OBJ_OP:
-						case ZEND_ASSIGN_OBJ_REF:
 							msg = "Cannot use string offset as an object";
 							break;
-						case ZEND_FETCH_DIM_W:
-						case ZEND_FETCH_DIM_RW:
-						case ZEND_FETCH_DIM_FUNC_ARG:
-						case ZEND_FETCH_DIM_UNSET:
-						case ZEND_FETCH_LIST_W:
-						case ZEND_ASSIGN_DIM:
 						case ZEND_ASSIGN_DIM_OP:
 							msg = "Cannot use string offset as an array";
 							break;
@@ -1478,6 +1466,21 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
 						case ZEND_POST_DEC:
 							msg = "Cannot increment/decrement string offsets";
 							break;
+						case ZEND_FETCH_DIM_W:
+						case ZEND_FETCH_DIM_RW:
+						case ZEND_FETCH_DIM_FUNC_ARG:
+						case ZEND_FETCH_DIM_UNSET:
+						case ZEND_FETCH_LIST_W:
+						case ZEND_ASSIGN_DIM:
+							msg = "Cannot use string offset as an array";
+							break;
+						case ZEND_FETCH_OBJ_W:
+						case ZEND_FETCH_OBJ_RW:
+						case ZEND_FETCH_OBJ_FUNC_ARG:
+						case ZEND_FETCH_OBJ_UNSET:
+						case ZEND_ASSIGN_OBJ:
+							msg = "Cannot use string offset as an object";
+							break;
 						case ZEND_ASSIGN_REF:
 						case ZEND_ADD_ARRAY_ELEMENT:
 						case ZEND_INIT_ARRAY:
@@ -1512,7 +1515,6 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
 					msg = "Cannot create references to/from string offsets";
 					break;
 				}
-				opline++;
 			}
 			break;
 		EMPTY_SWITCH_DEFAULT_CASE();
@@ -1959,44 +1961,6 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_index(const
 	zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset));
 }

-static zend_never_inline ZEND_COLD int ZEND_FASTCALL zend_undefined_offset_write(
-		HashTable *ht, zend_long lval)
-{
-	/* The array may be destroyed while throwing the notice.
-	 * Temporarily increase the refcount to detect this situation. */
-	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
-		GC_ADDREF(ht);
-	}
-	zend_undefined_offset(lval);
-	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
-		zend_array_destroy(ht);
-		return FAILURE;
-	}
-	if (EG(exception)) {
-		return FAILURE;
-	}
-	return SUCCESS;
-}
-
-static zend_never_inline ZEND_COLD int ZEND_FASTCALL zend_undefined_index_write(
-		HashTable *ht, zend_string *offset)
-{
-	/* The array may be destroyed while throwing the notice.
-	 * Temporarily increase the refcount to detect this situation. */
-	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
-		GC_ADDREF(ht);
-	}
-	zend_undefined_index(offset);
-	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
-		zend_array_destroy(ht);
-		return FAILURE;
-	}
-	if (EG(exception)) {
-		return FAILURE;
-	}
-	return SUCCESS;
-}
-
 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
 {
 	zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
@@ -2052,6 +2016,8 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_s

 static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
 {
+	zend_free_op free_op_data1;
+
 	if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
 		if (opline->op2_type == IS_UNUSED) {
 			zend_use_new_element_for_string();
@@ -2062,27 +2028,16 @@ static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim
 	} else if (EXPECTED(!Z_ISERROR_P(container))) {
 		zend_use_scalar_as_array();
 	}
+	get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1, &free_op_data1);
+	FREE_OP(free_op_data1);
 }

-static zend_never_inline zend_uchar slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
+static zend_never_inline zend_uchar slow_index_convert(const zval *dim, zend_value *value EXECUTE_DATA_DC)
 {
 	switch (Z_TYPE_P(dim)) {
-		case IS_UNDEF: {
-			/* The array may be destroyed while throwing the notice.
-			 * Temporarily increase the refcount to detect this situation. */
-			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
-				GC_ADDREF(ht);
-			}
+		case IS_UNDEF:
 			ZVAL_UNDEFINED_OP2();
-			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
-				zend_array_destroy(ht);
-				return IS_NULL;
-			}
-			if (EG(exception)) {
-				return IS_NULL;
-			}
 			/* break missing intentionally */
-		}
 		case IS_NULL:
 			value->str = ZSTR_EMPTY_ALLOC();
 			return IS_STRING;
@@ -2127,10 +2082,9 @@ num_undef:
 				retval = &EG(uninitialized_zval);
 				break;
 			case BP_VAR_RW:
-				if (UNEXPECTED(zend_undefined_offset_write(ht, hval) == FAILURE)) {
-					return NULL;
-				}
-				/* break missing intentionally */
+				zend_undefined_offset(hval);
+				retval = zend_hash_index_update(ht, hval, &EG(uninitialized_zval));
+				break;
 			case BP_VAR_W:
 				retval = zend_hash_index_add_new(ht, hval, &EG(uninitialized_zval));
 				break;
@@ -2158,9 +2112,7 @@ str_index:
 							retval = &EG(uninitialized_zval);
 							break;
 						case BP_VAR_RW:
-							if (UNEXPECTED(zend_undefined_index_write(ht, offset_key))) {
-								return NULL;
-							}
+							zend_undefined_index(offset_key);
 							/* break missing intentionally */
 						case BP_VAR_W:
 							ZVAL_NULL(retval);
@@ -2178,14 +2130,8 @@ str_index:
 					retval = &EG(uninitialized_zval);
 					break;
 				case BP_VAR_RW:
-					/* Key may be released while throwing the undefined index warning. */
-					zend_string_addref(offset_key);
-					if (UNEXPECTED(zend_undefined_index_write(ht, offset_key) == FAILURE)) {
-						zend_string_release(offset_key);
-						return NULL;
-					}
-					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
-					zend_string_release(offset_key);
+					zend_undefined_index(offset_key);
+					retval = zend_hash_update(ht, offset_key, &EG(uninitialized_zval));
 					break;
 				case BP_VAR_W:
 					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
@@ -2197,7 +2143,7 @@ str_index:
 		goto try_again;
 	} else {
 		zend_value val;
-		zend_uchar t = slow_index_convert(ht, dim, &val EXECUTE_DATA_CC);
+		zend_uchar t = slow_index_convert(dim, &val EXECUTE_DATA_CC);

 		if (t == IS_STRING) {
 			offset_key = val.str;
@@ -2873,10 +2819,6 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 			}
 			return;
 		}
-		if (UNEXPECTED(EG(exception))) {
-			ZVAL_ERROR(result);
-			return;
-		}
 	} else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
 		ZVAL_ERROR(result);
 		return;
@@ -757,7 +757,6 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 	for (i=0; i<fci->param_count; i++) {
 		zval *param;
 		zval *arg = &fci->params[i];
-		zend_bool must_wrap = 0;

 		if (ARG_SHOULD_BE_SENT_BY_REF(func, i + 1)) {
 			if (UNEXPECTED(!Z_ISREF_P(arg))) {
@@ -766,13 +765,12 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 					ZVAL_NEW_REF(arg, arg);
 				} else if (!ARG_MAY_BE_SENT_BY_REF(func, i + 1)) {
 					/* By-value send is not allowed -- emit a warning,
-					 * and perform the call with the value wrapped in a reference. */
+					 * but still perform the call with a by-value send. */
 					zend_error(E_WARNING,
 						"Parameter %d to %s%s%s() expected to be a reference, value given", i+1,
 						func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
 						func->common.scope ? "::" : "",
 						ZSTR_VAL(func->common.function_name));
-					must_wrap = 1;
 					if (UNEXPECTED(EG(exception))) {
 						ZEND_CALL_NUM_ARGS(call) = i;
 						zend_vm_stack_free_args(call);
@@ -793,12 +791,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 		}

 		param = ZEND_CALL_ARG(call, i+1);
-		if (EXPECTED(!must_wrap)) {
-			ZVAL_COPY(param, arg);
-		} else {
-			Z_TRY_ADDREF_P(arg);
-			ZVAL_NEW_REF(param, arg);
-		}
+		ZVAL_COPY(param, arg);
 	}

 	if (UNEXPECTED(func->op_array.fn_flags & ZEND_ACC_CLOSURE)) {
@@ -271,6 +271,10 @@ static void zend_generator_free_storage(zend_object *object) /* {{{ */
 	}

 	zend_object_std_dtor(&generator->std);
+
+	if (generator->iterator) {
+		zend_iterator_dtor(generator->iterator);
+	}
 }
 /* }}} */

@@ -728,9 +732,6 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 		}

 		if (iter->funcs->valid(iter) == FAILURE) {
-			if (UNEXPECTED(EG(exception) != NULL)) {
-				goto exception;
-			}
 			/* reached end of iteration */
 			goto failure;
 		}
@@ -759,7 +760,7 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 	return SUCCESS;

 exception:
-	zend_generator_throw_exception(generator, NULL);
+	zend_rethrow_exception(generator->execute_data);

 failure:
 	zval_ptr_dtor(&generator->values);
@@ -1627,11 +1627,11 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 				}
 			} while (++p != end);
 		}
+		zend_hash_iterators_remove(ht);
+		SET_INCONSISTENT(HT_DESTROYED);
 	} else if (EXPECTED(HT_FLAGS(ht) & HASH_FLAG_UNINITIALIZED)) {
 		goto free_ht;
 	}
-	zend_hash_iterators_remove(ht);
-	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
 	FREE_HASHTABLE(ht);
@@ -2124,7 +2124,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 {
    uint32_t idx;
 	Bucket *p;
-	zval *t, *s;
+	zval *t;

 	IS_CONSISTENT(source);
 	IS_CONSISTENT(target);
@@ -2133,20 +2133,18 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	if (overwrite) {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			s = &p->val;
-			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
-				s = Z_INDIRECT_P(s);
-			}
-			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
-				continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
+			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
+			    continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_UPDATE | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_UPDATE | HASH_UPDATE_INDIRECT);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_update(target, p->h, s);
+				t = zend_hash_index_update(target, p->h, &p->val);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -2155,20 +2153,18 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	} else {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			s = &p->val;
-			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
-				s = Z_INDIRECT_P(s);
-			}
-			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
-				continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
+			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
+			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
+			    continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_ADD | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_ADD | HASH_UPDATE_INDIRECT);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_add(target, p->h, s);
+				t = zend_hash_index_add(target, p->h, &p->val);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -259,6 +259,8 @@ static zend_class_entry *lookup_class(zend_class_entry *scope, zend_string *name

 /* Instanceof that's safe to use on unlinked classes. */
 static zend_bool unlinked_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) {
+	zend_class_entry *ce;
+
 	if (ce1 == ce2) {
 		return 1;
 	}
@@ -267,18 +269,18 @@ static zend_bool unlinked_instanceof(zend_class_entry *ce1, zend_class_entry *ce
 		return instanceof_function(ce1, ce2);
 	}

-	if (ce1->parent) {
-		zend_class_entry *parent_ce;
-		if (ce1->ce_flags & ZEND_ACC_RESOLVED_PARENT) {
-			parent_ce = ce1->parent;
+	ce = ce1;
+	while (ce->parent) {
+		if (ce->ce_flags & ZEND_ACC_RESOLVED_PARENT) {
+			ce = ce->parent;
 		} else {
-			parent_ce = zend_lookup_class_ex(ce1->parent_name, NULL,
+			ce = zend_lookup_class_ex(ce->parent_name, NULL,
 				ZEND_FETCH_CLASS_ALLOW_UNLINKED | ZEND_FETCH_CLASS_NO_AUTOLOAD);
+			if (!ce) {
+				break;
+			}
 		}
-
-		/* It's not sufficient to only check the parent chain itself, as need to do a full
-		 * recursive instanceof in case the parent interfaces haven't been copied yet. */
-		if (parent_ce && unlinked_instanceof(parent_ce, ce2)) {
+		if (ce == ce2) {
 			return 1;
 		}
 	}
@@ -295,7 +297,7 @@ static zend_bool unlinked_instanceof(zend_class_entry *ce1, zend_class_entry *ce
 			}
 		} else {
 			for (i = 0; i < ce1->num_interfaces; i++) {
-				zend_class_entry *ce = zend_lookup_class_ex(
+				ce = zend_lookup_class_ex(
 					ce1->interface_names[i].name, ce1->interface_names[i].lc_name,
 					ZEND_FETCH_CLASS_ALLOW_UNLINKED | ZEND_FETCH_CLASS_NO_AUTOLOAD);
 				if (ce && unlinked_instanceof(ce, ce2)) {
@@ -321,7 +321,7 @@ ZEND_API int zend_alter_ini_entry_ex(zend_string *name, zend_string *new_value,
 {
 	zend_ini_entry *ini_entry;
 	zend_string *duplicate;
-	uint8_t modifiable;
+	zend_bool modifiable;
 	zend_bool modified;

 	if ((ini_entry = zend_hash_find_ptr(EG(ini_directives), name)) == NULL) {
@@ -1072,7 +1072,8 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								octal_buf[2] = *(++s);
 							}
 						}
-						if (octal_buf[2] && (octal_buf[0] > '3') && !SCNG(heredoc_scan_ahead)) {
+						if (octal_buf[2] &&
+						    (octal_buf[0] > '3')) {
 							/* 3 octit values must not overflow 0xFF (\377) */
 							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
 						}
@@ -1117,7 +1118,6 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
-			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -421,11 +421,7 @@ dynamic:
 			if (flags & ZEND_ACC_CHANGED) {
 				zend_property_info *p = zend_get_parent_private_property(scope, ce, member);

-				/* If there is a public/protected instance property on ce, don't try to use a
-				 * private static property on scope. If both are static, prefer the static
-				 * property on scope. This will throw a static property notice, rather than
-				 * a visibility error. */
-				if (p && (!(p->flags & ZEND_ACC_STATIC) || (flags & ZEND_ACC_STATIC))) {
+				if (p) {
 					property_info = p;
 					flags = property_info->flags;
 					goto found;
@@ -619,8 +615,8 @@ ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *membe
 	if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
 		zend_string *str = Z_STR_P(zv);
 		if (EXPECTED(str == member) ||
-		     /* "str" always has a pre-calculated hash value here */
-		    (EXPECTED(ZSTR_H(str) == zend_string_hash_val(member)) &&
+		     /* hash values are always pred-calculated here */
+		    (EXPECTED(ZSTR_H(str) == ZSTR_H(member)) &&
 		     EXPECTED(zend_string_equal_content(str, member)))) {
 			return &Z_PROPERTY_GUARD_P(zv);
 		} else if (EXPECTED(Z_PROPERTY_GUARD_P(zv) == 0)) {
@@ -809,13 +805,6 @@ exit:
 }
 /* }}} */

-static zend_always_inline zend_bool property_uses_strict_types() {
-	zend_execute_data *execute_data = EG(current_execute_data);
-	return execute_data
-		&& execute_data->func
-		&& ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
-}
-
 ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
 {
 	zend_object *zobj;
@@ -840,7 +829,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,

 			if (UNEXPECTED(prop_info)) {
 				ZVAL_COPY_VALUE(&tmp, value);
-				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
+				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
 					Z_TRY_DELREF_P(value);
 					variable_ptr = &EG(error_zval);
 					goto exit;
@@ -849,7 +838,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
 			}

 found:
-			zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
+			zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
 			goto exit;
 		}
 		if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {
@@ -905,7 +894,7 @@ write_std_property:

 			if (UNEXPECTED(prop_info)) {
 				ZVAL_COPY_VALUE(&tmp, value);
-				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
+				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
 					zval_ptr_dtor(value);
 					goto exit;
 				}
@@ -1058,8 +1047,7 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zval *object, zval *member, int typ
 		retval = OBJ_PROP(zobj, property_offset);
 		if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
 			if (EXPECTED(!zobj->ce->__get) ||
-			    UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
-			    UNEXPECTED(prop_info && Z_PROP_FLAG_P(retval) == IS_PROP_UNINIT)) {
+			    UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
 				if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
 					if (UNEXPECTED(prop_info)) {
 						zend_throw_error(NULL,
@@ -934,7 +934,7 @@ ZEND_API zend_string* ZEND_FASTCALL zval_try_get_string_func(zval *op) /* {{{ */

 static zend_never_inline void ZEND_FASTCALL add_function_array(zval *result, zval *op1, zval *op2) /* {{{ */
 {
-	if (result == op1 && Z_ARR_P(op1) == Z_ARR_P(op2)) {
+	if ((result == op1) && (result == op2)) {
 		/* $a += $a */
 		return;
 	}
@@ -1871,9 +1871,6 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 		}
 	} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {
 		if (EXPECTED(result != op1)) {
-			if (result == orig_op1) {
-				i_zval_ptr_dtor(result);
-			}
 			ZVAL_COPY(result, op1);
 		}
 	} else {
@@ -186,13 +186,12 @@ static zend_always_inline zend_string *zend_string_realloc(zend_string *s, size_
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
+		} else {
+			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN(len, ZSTR_LEN(s)) + 1);
-	if (!ZSTR_IS_INTERNED(s)) {
-		GC_DELREF(s);
-	}
 	return ret;
 }

@@ -207,13 +206,12 @@ static zend_always_inline zend_string *zend_string_extend(zend_string *s, size_t
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
+		} else {
+			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), ZSTR_LEN(s) + 1);
-	if (!ZSTR_IS_INTERNED(s)) {
-		GC_DELREF(s);
-	}
 	return ret;
 }

@@ -228,13 +226,12 @@ static zend_always_inline zend_string *zend_string_truncate(zend_string *s, size
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
+		} else {
+			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), len + 1);
-	if (!ZSTR_IS_INTERNED(s)) {
-		GC_DELREF(s);
-	}
 	return ret;
 }

@@ -248,13 +245,12 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s,
 			ZSTR_LEN(ret) = (n * m) + l;
 			zend_string_forget_hash_val(ret);
 			return ret;
+		} else {
+			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_safe_alloc(n, m, l, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN((n * m) + l, ZSTR_LEN(s)) + 1);
-	if (!ZSTR_IS_INTERNED(s)) {
-		GC_DELREF(s);
-	}
 	return ret;
 }

@@ -596,7 +596,6 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}

 #ifdef ZEND_WIN32
-retry_reparse_point:
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -619,7 +618,7 @@ retry_reparse_point:
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry_reparse_tag_cloud:
+retry:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -680,7 +679,7 @@ retry_reparse_tag_cloud:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry_reparse_tag_cloud;
+					goto retry;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -827,22 +826,6 @@ retry_reparse_tag_cloud:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);

-			{
-				DWORD attrs;
-
-				FREE_PATHW()
-				pathw = php_win32_ioutil_any_to_w(path);
-				if (!pathw) {
-					return (size_t)-1;
-				}
-				attrs = GetFileAttributesW(pathw);
-				if (!isVolume && attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
-					free_alloca(tmp, use_heap);
-					FREE_PATHW()
-					goto retry_reparse_point;
-				}
-			}
-
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
@@ -1272,7 +1272,6 @@ ZEND_VM_C_LABEL(assign_dim_op_new_array):
 		} else {
 			zend_binary_assign_op_dim_slow(container, dim OPLINE_CC EXECUTE_DATA_CC);
 ZEND_VM_C_LABEL(assign_dim_op_ret_null):
-			FREE_UNFETCHED_OP_DATA();
 			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
 				ZVAL_NULL(EX_VAR(opline->result.var));
 			}
@@ -2620,14 +2619,15 @@ ZEND_VM_HANDLER(23, ZEND_ASSIGN_DIM, VAR|CV, CONST|TMPVAR|UNUSED|NEXT|CV, SPEC(O

 	if (EXPECTED(Z_TYPE_P(object_ptr) == IS_ARRAY)) {
 ZEND_VM_C_LABEL(try_assign_dim_array):
-		value = GET_OP_DATA_ZVAL_PTR(BP_VAR_R);
 		SEPARATE_ARRAY(object_ptr);
 		if (OP2_TYPE == IS_UNUSED) {
+			value = GET_OP_DATA_ZVAL_PTR(BP_VAR_R);
 			if (OP_DATA_TYPE == IS_CV || OP_DATA_TYPE == IS_VAR) {
 				ZVAL_DEREF(value);
 			}
 			variable_ptr = zend_hash_next_index_insert(Z_ARRVAL_P(object_ptr), value);
 			if (UNEXPECTED(variable_ptr == NULL)) {
+				FREE_OP_DATA();
 				zend_cannot_add_element();
 				ZEND_VM_C_GOTO(assign_dim_error);
 			} else if (OP_DATA_TYPE == IS_CV) {
@@ -2656,6 +2656,7 @@ ZEND_VM_C_LABEL(try_assign_dim_array):
 			if (UNEXPECTED(variable_ptr == NULL)) {
 				ZEND_VM_C_GOTO(assign_dim_error);
 			}
+			value = GET_OP_DATA_ZVAL_PTR(BP_VAR_R);
 			value = zend_assign_to_variable(variable_ptr, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
 		}
 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
@@ -5128,7 +5129,6 @@ ZEND_VM_C_LABEL(send_array):
 				arg_num = 1;
 				param = ZEND_CALL_ARG(EX(call), 1);
 				ZEND_HASH_FOREACH_VAL(ht, arg) {
-					zend_bool must_wrap = 0;
 					if (skip > 0) {
 						skip--;
 						continue;
@@ -5140,7 +5140,6 @@ ZEND_VM_C_LABEL(send_array):
 								/* By-value send is not allowed -- emit a warning,
 								 * but still perform the call. */
 								zend_param_must_be_ref(EX(call)->func, arg_num);
-								must_wrap = 1;
 							}
 						}
 					} else {
@@ -5150,12 +5149,7 @@ ZEND_VM_C_LABEL(send_array):
 							arg = Z_REFVAL_P(arg);
 						}
 					}
-					if (EXPECTED(!must_wrap)) {
-						ZVAL_COPY(param, arg);
-					} else {
-						Z_TRY_ADDREF_P(arg);
-						ZVAL_NEW_REF(param, arg);
-					}
+					ZVAL_COPY(param, arg);
 					ZEND_CALL_NUM_ARGS(EX(call))++;
 					arg_num++;
 					param++;
@@ -5167,14 +5161,12 @@ ZEND_VM_C_LABEL(send_array):
 			arg_num = 1;
 			param = ZEND_CALL_ARG(EX(call), 1);
 			ZEND_HASH_FOREACH_VAL(ht, arg) {
-				zend_bool must_wrap = 0;
 				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
 					if (UNEXPECTED(!Z_ISREF_P(arg))) {
 						if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
 							/* By-value send is not allowed -- emit a warning,
 							 * but still perform the call. */
 							zend_param_must_be_ref(EX(call)->func, arg_num);
-							must_wrap = 1;
 						}
 					}
 				} else {
@@ -5184,12 +5176,7 @@ ZEND_VM_C_LABEL(send_array):
 						arg = Z_REFVAL_P(arg);
 					}
 				}
-				if (EXPECTED(!must_wrap)) {
-					ZVAL_COPY(param, arg);
-				} else {
-					Z_TRY_ADDREF_P(arg);
-					ZVAL_NEW_REF(param, arg);
-				}
+				ZVAL_COPY(param, arg);
 				ZEND_CALL_NUM_ARGS(EX(call))++;
 				arg_num++;
 				param++;
@@ -5310,7 +5297,6 @@ ZEND_VM_HANDLER(164, ZEND_RECV_VARIADIC, NUM, UNUSED|CACHE_SLOT)
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) {
 			param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T);
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
-				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
 				do {
 					zend_verify_variadic_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num));
 					if (Z_OPT_REFCOUNTED_P(param)) Z_ADDREF_P(param);
@@ -6317,7 +6303,11 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET_R, CONST|TMP|VAR|CV, JMP_ADDR)
 		ZEND_VM_NEXT_OPCODE();
 	} else if (OP1_TYPE != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
 		if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-			HashTable *properties;
+			result = EX_VAR(opline->result.var);
+			ZVAL_COPY_VALUE(result, array_ptr);
+			if (OP1_TYPE != IS_TMP_VAR) {
+				Z_ADDREF_P(array_ptr);
+			}
 			if (Z_OBJ_P(array_ptr)->properties
 			 && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
 				if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -6325,21 +6315,8 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET_R, CONST|TMP|VAR|CV, JMP_ADDR)
 				}
 				Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
 			}
+			Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);

-			properties = Z_OBJPROP_P(array_ptr);
-			result = EX_VAR(opline->result.var);
-			ZVAL_COPY_VALUE(result, array_ptr);
-			if (OP1_TYPE != IS_TMP_VAR) {
-				Z_ADDREF_P(array_ptr);
-			}
-
-			if (zend_hash_num_elements(properties) == 0) {
-				Z_FE_ITER_P(result) = (uint32_t) -1;
-				FREE_OP1_IF_VAR();
-				ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
-			}
-
-			Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
 			FREE_OP1_IF_VAR();
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 		} else {
@@ -6406,7 +6383,6 @@ ZEND_VM_COLD_CONST_HANDLER(125, ZEND_FE_RESET_RW, CONST|TMP|VAR|CV, JMP_ADDR)
 		ZEND_VM_NEXT_OPCODE();
 	} else if (OP1_TYPE != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
 		if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-			HashTable *properties;
 			if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
 				if (array_ptr == array_ref) {
 					ZVAL_NEW_REF(array_ref, array_ref);
@@ -6425,15 +6401,8 @@ ZEND_VM_COLD_CONST_HANDLER(125, ZEND_FE_RESET_RW, CONST|TMP|VAR|CV, JMP_ADDR)
 				}
 				Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
 			}
+			Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);

-			properties = Z_OBJPROP_P(array_ptr);
-			if (zend_hash_num_elements(properties) == 0) {
-				Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
-				FREE_OP1_VAR_PTR();
-				ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
-			}
-
-			Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
 			FREE_OP1_VAR_PTR();
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 		} else {
@@ -7924,7 +7893,6 @@ ZEND_VM_HANDLER(166, ZEND_YIELD_FROM, CONST|TMP|VAR|CV, ANY)
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
-		FREE_OP1();
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -11,14 +11,6 @@ trigger:
      - UPGRADING
      - UPGRADING.INTERNALS

-schedules:
-  - cron: "0 1 * * *"
-    displayName: Nightly build
-    branches:
-      include:
-        - PHP-7.4
-        - master
-
 jobs:
  - template: azure/job.yml
    parameters:
@@ -7,9 +7,6 @@ steps:
      sudo apt install bison \
                       re2c \
                       locales \
-                       ldap-utils \
-                       openssl \
-                       slapd \
                       language-pack-de \
                       re2c \
                       libgmp-dev \
@@ -32,9 +29,9 @@ steps:
                       libpq-dev \
                       libreadline-dev \
                       libldap2-dev \
+                       libsasl2-dev \
                       libsodium-dev \
                       libargon2-0-dev \
-                       libmm-dev \
                       postgresql \
                       postgresql-contrib \
                       llvm \
@@ -59,7 +59,7 @@ jobs:
        php vendor/bin/phpunit
      displayName: 'Test Laravel'
    - script: |
-        git clone https://github.com/symfony/symfony.git --depth=1
+        git clone https://github.com/symfony/symfony.git --branch=master --depth=1
        cd symfony
        php7.3 /usr/bin/composer install --no-progress
        php7.3 ./phpunit install
@@ -9,8 +9,6 @@ steps:
      sudo apt-get install -y g++-multilib
      sudo apt-get purge -y libxml2
      # TODO: Reenable postgresql + postgresql-contrib packages once they work again.
-      sudo apt-get purge -y libpq5
-      sudo apt-get install -y libc6:i386
      sudo apt-get install -y bison \
                              re2c \
                              locales \
@@ -42,7 +40,6 @@ steps:
                              libpq-dev:i386 \
                              libreadline-dev:i386 \
                              libffi-dev:i386 \
-                              libfreetype6-dev:i386 \
                              libsodium-dev:i386 \
                              ${{ parameters.packages }}
    displayName: 'APT'
@@ -29,7 +29,6 @@ jobs:
            --enable-gd \
            --with-jpeg \
            --with-webp \
-            --with-freetype \
            --with-xpm \
            --enable-exif \
            --with-zip \
@@ -2,6 +2,8 @@ parameters:
  packages: ''

 steps:
+  - script: brew update
+    displayName: 'Update Homebrew'
  - script: |
      brew install pkg-config \
                   autoconf \
@@ -23,11 +25,12 @@ steps:
                   zlib \
                   t1lib \
                   gd \
-                   libzip \
                   gmp \
                   tidyp \
                   libxml2 \
                   libxslt \
                   postgresql
+      # Make sure we don't get broken libzip 1.7.0
+      brew upgrade libzip
      brew link icu4c gettext --force
    displayName: 'Install Build Dependencies'
@@ -1,169 +0,0 @@
-#!/bin/sh
-set -ev
-
-# Create TLS certificate
-sudo mkdir -p /etc/ldap/ssl
-
-alt_names() {
-  (
-      (
-        (hostname && hostname -a && hostname -A && hostname -f) |
-        xargs -n 1 |
-        sort -u |
-        sed -e 's/\(\S\+\)/DNS:\1/g'
-      ) && (
-        (hostname -i && hostname -I && echo "127.0.0.1 ::1") |
-        xargs -n 1 |
-        sort -u |
-        sed -e 's/\(\S\+\)/IP:\1/g'
-      )
-  ) | paste -d, -s
-}
-
-sudo openssl req -newkey rsa:4096 -x509 -nodes -days 3650 \
-  -out /etc/ldap/ssl/server.crt -keyout /etc/ldap/ssl/server.key \
-  -subj "/C=US/ST=Arizona/L=Localhost/O=localhost/CN=localhost" \
-  -addext "subjectAltName = `alt_names`"
-
-sudo chown -R openldap:openldap /etc/ldap/ssl
-
-# Display the TLS certificate (should be world readable)
-openssl x509 -noout -text -in /etc/ldap/ssl/server.crt
-
-# Point to the certificate generated
-if ! grep -q 'TLS_CACERT \/etc\/ldap\/ssl\/server.crt' /etc/ldap/ldap.conf; then
-  sudo sed -e 's|^\s*TLS_CACERT|# TLS_CACERT|' -i /etc/ldap/ldap.conf
-  echo 'TLS_CACERT /etc/ldap/ssl/server.crt' | sudo tee -a /etc/ldap/ldap.conf
-fi
-
-# Configure LDAP protocols to serve.
-sudo sed -e 's|^\s*SLAPD_SERVICES\s*=.*$|SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"|' -i /etc/default/slapd
-
-# Configure LDAP database.
-DBDN=`sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(&(olcRootDN=*)(olcSuffix=*))' dn | grep -i '^dn:' | sed -e 's/^dn:\s*//'`;
-
-sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
-
-sudo service slapd restart
-
-sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
-dn: $DBDN
-changetype: modify
-replace: olcSuffix
-olcSuffix: dc=my-domain,dc=com
-
-replace: olcRootDN
-olcRootDN: cn=Manager,dc=my-domain,dc=com
-
-replace: olcRootPW
-olcRootPW: secret
-
-dn: cn=config
-changetype: modify
-add: olcTLSCACertificateFile
-olcTLSCACertificateFile: /etc/ldap/ssl/server.crt
-
-add: olcTLSCertificateFile
-olcTLSCertificateFile: /etc/ldap/ssl/server.crt
-
-add: olcTLSCertificateKeyFile
-olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
-
-add: olcTLSVerifyClient
-olcTLSVerifyClient: never
-
-add: olcAuthzRegexp
-olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
-
-replace: olcLogLevel
-olcLogLevel: -1
-
-dn: cn=module{0},cn=config
-changetype: modify
-add: olcModuleLoad
-olcModuleLoad: sssvlv
-
-add: olcModuleLoad
-olcModuleLoad: ppolicy
-
-add: olcModuleLoad
-olcModuleLoad: dds
-EOF
-
-sudo service slapd restart
-
-sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// << EOF
-dn: olcOverlay=sssvlv,$DBDN
-objectClass: olcOverlayConfig
-objectClass: olcSssVlvConfig
-olcOverlay: sssvlv
-olcSssVlvMax: 10
-olcSssVlvMaxKeys: 5
-
-dn: olcOverlay=ppolicy,$DBDN
-objectClass: olcOverlayConfig
-objectClass: olcPPolicyConfig
-olcOverlay: ppolicy
-### This would clutter our DIT and make tests to fail, while ppolicy does not
-### seem to work as we expect (it does not seem to provide expected controls)
-## olcPPolicyDefault: cn=default,ou=pwpolicies,dc=my-domain,dc=com
-## olcPPolicyHashCleartext: FALSE
-## olcPPolicyUseLockout: TRUE
-
-dn: olcOverlay=dds,$DBDN
-objectClass: olcOverlayConfig
-objectClass: olcDdsConfig
-olcOverlay: dds
-EOF
-
-sudo service slapd restart
-
-sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
-dn: $DBDN
-changetype: modify
-add: olcDbIndex
-olcDbIndex: entryExpireTimestamp eq
-EOF
-
-sudo service slapd restart
-
-ldapadd -H ldapi:/// -D cn=Manager,dc=my-domain,dc=com -w secret <<EOF
-dn: dc=my-domain,dc=com
-objectClass: top
-objectClass: organization
-objectClass: dcObject
-dc: my-domain
-o: php ldap tests
-
-### This would clutter our DIT and make tests to fail, while ppolicy does not
-### seem to work as we expect (it does not seem to provide expected controls)
-## dn: ou=pwpolicies,dc=my-domain,dc=com
-## objectClass: top
-## objectClass: organizationalUnit
-## ou: pwpolicies
-##
-## dn: cn=default,ou=pwpolicies,dc=my-domain,dc=com
-## objectClass: top
-## objectClass: person
-## objectClass: pwdPolicy
-## cn: default
-## sn: default
-## pwdAttribute: userPassword
-## pwdMaxAge: 2592000
-## pwdExpireWarning: 3600
-## #pwdInHistory: 0
-## pwdCheckQuality: 0
-## pwdMaxFailure: 5
-## pwdLockout: TRUE
-## #pwdLockoutDuration: 0
-## #pwdGraceAuthNLimit: 0
-## #pwdFailureCountInterval: 0
-## pwdMustChange: FALSE
-## pwdMinLength: 3
-## pwdAllowUserChange: TRUE
-## pwdSafeModify: FALSE
-EOF
-
-# Verify TLS connection
-
-ldapsearch -d 255 -H ldaps://localhost -D cn=Manager,dc=my-domain,dc=com -w secret -s base -b dc=my-domain,dc=com 'objectclass=*'
@@ -3,11 +3,7 @@ steps:
      set -e
      sudo service mysql start
      sudo service postgresql start
-      sudo service slapd start
      mysql -uroot -proot -e "CREATE DATABASE IF NOT EXISTS test"
      sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'postgres';"
      sudo -u postgres psql -c "CREATE DATABASE test;"
    displayName: 'Setup'
-  - script: ./azure/setup-slapd.sh
-    displayName: 'Configure slapd'
-
@@ -308,8 +308,8 @@ dnl
 dnl PHP_CHECK_GCC_ARG(arg, action-if-found, action-if-not-found)
 dnl
 AC_DEFUN([PHP_CHECK_GCC_ARG],[
-  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z=-,a-z__)
-  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z=-,a-z__), [
+  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z-,a-z_)
+  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z-,a-z_), [
  echo 'void somefunc() { };' > conftest.c
  cmd='$CC $1 -c conftest.c'
  if eval $cmd 2>&1 | $EGREP -e $1 >/dev/null ; then
@@ -1176,14 +1176,14 @@ AC_DEFUN([PHP_DOES_PWRITE_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    int main() {
+    main() {
    int fd = open("conftest_in", O_WRONLY|O_CREAT, 0600);

-    if (fd < 0) return 1;
-    if (pwrite(fd, "text", 4, 0) != 4) return 1;
+    if (fd < 0) exit(1);
+    if (pwrite(fd, "text", 4, 0) != 4) exit(1);
    /* Linux glibc breakage until 2.2.5 */
-    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) return 1;
-    return 0;
+    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) exit(1);
+    exit(0);
    }

  ]])],[
@@ -1209,14 +1209,14 @@ AC_DEFUN([PHP_DOES_PREAD_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    int main() {
+    main() {
    char buf[3];
    int fd = open("conftest_in", O_RDONLY);
-    if (fd < 0) return 1;
-    if (pread(fd, buf, 2, 0) != 2) return 1;
+    if (fd < 0) exit(1);
+    if (pread(fd, buf, 2, 0) != 2) exit(1);
    /* Linux glibc breakage until 2.2.5 */
-    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) return 1;
-    return 0;
+    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) exit(1);
+    exit(0);
    }
  ]])],[
    ac_cv_pread=yes
@@ -1464,27 +1464,27 @@ AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <stdio.h>

 struct cookiedata {
-  off64_t pos;
+  __off64_t pos;
 };

-ssize_t reader(void *cookie, char *buffer, size_t size)
+__ssize_t reader(void *cookie, char *buffer, size_t size)
 { return size; }
-ssize_t writer(void *cookie, const char *buffer, size_t size)
+__ssize_t writer(void *cookie, const char *buffer, size_t size)
 { return size; }
 int closer(void *cookie)
 { return 0; }
-int seeker(void *cookie, off64_t *position, int whence)
+int seeker(void *cookie, __off64_t *position, int whence)
 { ((struct cookiedata*)cookie)->pos = *position; return 0; }

 cookie_io_functions_t funcs = {reader, writer, seeker, closer};

-int main() {
+main() {
  struct cookiedata g = { 0 };
  FILE *fp = fopencookie(&g, "r", funcs);

  if (fp && fseek(fp, 8192, SEEK_SET) == 0 && g.pos == 8192)
-    return 0;
-  return 1;
+    exit(0);
+  exit(1);
 }

 ]])], [
@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
 dnl ----------------------------------------------------------------------------

 AC_PREREQ([2.68])
-AC_INIT([PHP],[7.4.12RC1],[https://bugs.php.net],[php],[https://www.php.net])
+AC_INIT([PHP],[7.4.8],[https://bugs.php.net],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER
@@ -662,7 +662,6 @@ dnl getaddrinfo.
 AC_CACHE_CHECK([for getaddrinfo], ac_cv_func_getaddrinfo,
 [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <netdb.h>]],
  [[struct addrinfo *g,h;g=&h;getaddrinfo("","",g,&g);]])],[AC_RUN_IFELSE([AC_LANG_SOURCE([[
-#include <string.h>
 #include <netdb.h>
 #include <sys/types.h>
 #ifndef AF_INET
@@ -675,11 +674,11 @@ int main(void) {
  hints.ai_flags = AI_NUMERICHOST;

  if (getaddrinfo("127.0.0.1", 0, &hints, &ai) < 0) {
-    return 1;
+    exit(1);
  }

  if (ai == 0) {
-    return 1;
+    exit(1);
  }

  pai = ai;
@@ -687,16 +686,16 @@ int main(void) {
  while (pai) {
    if (pai->ai_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      return 1;
+      exit(1);
    }
    if (pai->ai_addr->sa_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      return 1;
+      exit(1);
    }
    pai = pai->ai_next;
  }
  freeaddrinfo(ai);
-  return 0;
+  exit(0);
 }
  ]])],[ac_cv_func_getaddrinfo=yes], [ac_cv_func_getaddrinfo=no], [ac_cv_func_getaddrinfo=no])],
 [ac_cv_func_getaddrinfo=no])])
@@ -83,12 +83,12 @@ bool(false)
 resource(%d) of type (stream)
 resource(%d) of type (stream)

-Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)

-Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)
@@ -23,25 +23,20 @@
 #include "sdncal.h"
 #include <time.h>

-#define SECS_PER_DAY (24 * 3600)
-
 /* {{{ proto int unixtojd([int timestamp])
   Convert UNIX timestamp to Julian Day */
 PHP_FUNCTION(unixtojd)
 {
 	time_t ts = 0;
-	zend_long tl = 0;
 	struct tm *ta, tmbuf;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &tl) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &ts) == FAILURE) {
 		return;
 	}

-	if (!tl) {
+	if (!ts) {
 		ts = time(NULL);
-	} else if (tl >= 0) {
-		ts = (time_t) tl;
-	} else {
+	} else if (ts < 0) {
 		RETURN_FALSE;
 	}

@@ -64,10 +59,10 @@ PHP_FUNCTION(jdtounix)
 	}
 	uday -= 2440588 /* J.D. of 1.1.1970 */;

-	if (uday < 0 || uday > ZEND_LONG_MAX / SECS_PER_DAY) { /* before beginning of unix epoch or greater than representable */
+	if (uday < 0 || uday > 24755) { /* before beginning of unix epoch or behind end of unix epoch */
 		RETURN_FALSE;
 	}

-	RETURN_LONG(uday * SECS_PER_DAY);
+	RETURN_LONG(uday * 24 * 3600);
 }
 /* }}} */
@@ -1,17 +0,0 @@
--TEST--
-Bug #80185 (jdtounix() fails after 2037)
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-if (PHP_INT_SIZE != 8) die("skip for 64bit platforms only");
-?>
--FILE--
-<?php
-var_dump(jdtounix(2465712));
-var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
-var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
-?>
--EXPECT--
-int(2170713600)
-int(9223372036854720000)
-bool(false)
@@ -1,17 +0,0 @@
--TEST--
-Bug #80185 (jdtounix() fails after 2037)
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-if (PHP_INT_SIZE != 4) die("skip for 32bit platforms only");
-?>
--FILE--
-<?php
-var_dump(jdtounix(2465712));
-var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
-var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
-?>
--EXPECT--
-bool(false)
-int(2147472000)
-bool(false)
@@ -61,7 +61,7 @@ PHP_FUNCTION(com_create_instance)
 			&module_name, &module_name_len, &server_name, &server_name_len,
 			&cp, &typelib_name, &typelib_name_len) &&
 		FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET,
-			ZEND_NUM_ARGS(), "sa/|ls",
+			ZEND_NUM_ARGS(), "sa|ls",
 			&module_name, &module_name_len, &server_params, &cp,
 			&typelib_name, &typelib_name_len)) {

@@ -85,9 +85,7 @@ PHP_FUNCTION(com_create_instance)

 		if (NULL != (tmp = zend_hash_str_find(Z_ARRVAL_P(server_params),
 				"Server", sizeof("Server")-1))) {
-			if (!try_convert_to_string(tmp)) {
-				return;
-			}
+			convert_to_string_ex(tmp);
 			server_name = Z_STRVAL_P(tmp);
 			server_name_len = Z_STRLEN_P(tmp);
 			ctx = CLSCTX_REMOTE_SERVER;
@@ -95,27 +93,21 @@ PHP_FUNCTION(com_create_instance)

 		if (NULL != (tmp = zend_hash_str_find(Z_ARRVAL_P(server_params),
 				"Username", sizeof("Username")-1))) {
-			if (!try_convert_to_string(tmp)) {
-				return;
-			}
+			convert_to_string_ex(tmp);
 			user_name = Z_STRVAL_P(tmp);
 			user_name_len = Z_STRLEN_P(tmp);
 		}

 		if (NULL != (tmp = zend_hash_str_find(Z_ARRVAL_P(server_params),
 				"Password", sizeof("Password")-1))) {
-			if (!try_convert_to_string(tmp)) {
-				return;
-			}
+			convert_to_string_ex(tmp);
 			password = Z_STRVAL_P(tmp);
 			password_len = Z_STRLEN_P(tmp);
 		}

 		if (NULL != (tmp = zend_hash_str_find(Z_ARRVAL_P(server_params),
 				"Domain", sizeof("Domain")-1))) {
-			if (!try_convert_to_string(tmp)) {
-				return;
-			}
+			convert_to_string_ex(tmp);
 			domain_name = Z_STRVAL_P(tmp);
 			domain_name_len = Z_STRLEN_P(tmp);
 		}
@@ -141,7 +133,7 @@ PHP_FUNCTION(com_create_instance)
 		info.pwszName = php_com_string_to_olestring(server_name, server_name_len, obj->code_page);

 		if (user_name) {
-			authid.User = (OLECHAR*)user_name;
+			authid.User = php_com_string_to_olestring(user_name, -1, obj->code_page);
 			authid.UserLength = (ULONG)user_name_len;

 			if (password) {
@@ -229,6 +221,7 @@ PHP_FUNCTION(com_create_instance)

 	if (server_name) {
 		if (info.pwszName) efree(info.pwszName);
+		if (authid.User) efree(authid.User);
 	}

 	efree(moniker);
@@ -255,7 +248,7 @@ PHP_FUNCTION(com_create_instance)
 		TL = php_com_load_typelib_via_cache(typelib_name, obj->code_page, &cached);

 		if (TL) {
-			if (COMG(autoreg_on)) {
+			if (COMG(autoreg_on) && !cached) {
 				php_com_import_typelib(TL, mode, obj->code_page);
 			}

@@ -447,9 +440,8 @@ HRESULT php_com_get_id_of_name(php_com_dotnet_object *obj, char *name,
 	if (obj->typeinfo) {
 		hr = ITypeInfo_GetIDsOfNames(obj->typeinfo, &olename, 1, dispid);
 		if (FAILED(hr)) {
-			HRESULT hr1 = hr;
 			hr = IDispatch_GetIDsOfNames(V_DISPATCH(&obj->v), &IID_NULL, &olename, 1, LOCALE_SYSTEM_DEFAULT, dispid);
-			if (SUCCEEDED(hr) && hr1 != E_NOTIMPL) {
+			if (SUCCEEDED(hr)) {
 				/* fall back on IDispatch direct */
 				ITypeInfo_Release(obj->typeinfo);
 				obj->typeinfo = NULL;
@@ -596,7 +588,6 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			}
 		}
 		efree(vargs);
-		if (byref_vals) efree(byref_vals);
 	}

 	return SUCCEEDED(hr) ? SUCCESS : FAILURE;
@@ -728,9 +719,7 @@ PHP_FUNCTION(com_event_sink)
 		if ((tmp = zend_hash_index_find(Z_ARRVAL_P(sink), 1)) != NULL && Z_TYPE_P(tmp) == IS_STRING)
 			dispname = Z_STRVAL_P(tmp);
 	} else if (sink != NULL) {
-		if (!try_convert_to_string(sink)) {
-			return;
-		}
+		convert_to_string(sink);
 		dispname = Z_STRVAL_P(sink);
 	}

@@ -851,7 +840,9 @@ PHP_FUNCTION(com_load_typelib)
 	php_com_initialize();
 	pTL = php_com_load_typelib_via_cache(name, codepage, &cached);
 	if (pTL) {
-		if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
+		if (cached) {
+			RETVAL_TRUE;
+		} else if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
 			RETVAL_TRUE;
 		}

@@ -251,7 +251,9 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}

 		if ((pTL = php_com_load_typelib_via_cache(typelib_name, COMG(code_page), &cached)) != NULL) {
-			php_com_import_typelib(pTL, mode, COMG(code_page));
+			if (!cached) {
+				php_com_import_typelib(pTL, mode, COMG(code_page));
+			}
 			ITypeLib_Release(pTL);
 		}
 	}
@@ -38,12 +38,10 @@ static zval *com_property_read(zval *object, zval *member, int type, void **cahc
 	obj = CDNO_FETCH(object);

 	if (V_VT(&obj->v) == VT_DISPATCH) {
-		if (!try_convert_to_string(member)) {
-			return rv;
-		}
-
 		VariantInit(&v);

+		convert_to_string_ex(member);
+
 		res = php_com_do_invoke(obj, Z_STRVAL_P(member), Z_STRLEN_P(member),
 				DISPATCH_METHOD|DISPATCH_PROPERTYGET, &v, 0, NULL, 1);

@@ -68,12 +66,9 @@ static zval *com_property_write(zval *object, zval *member, zval *value, void **
 	obj = CDNO_FETCH(object);

 	if (V_VT(&obj->v) == VT_DISPATCH) {
-		if (!try_convert_to_string(member)) {
-			return value;
-		}
-
 		VariantInit(&v);

+		convert_to_string_ex(member);
 		if (SUCCESS == php_com_do_invoke(obj, Z_STRVAL_P(member), Z_STRLEN_P(member),
 				DISPATCH_PROPERTYPUT|DISPATCH_PROPERTYPUTREF, &v, 1, value, 0)) {
 			VariantClear(&v);
@@ -210,9 +205,7 @@ static int com_property_exists(zval *object, zval *member, int check_empty, void
 	obj = CDNO_FETCH(object);

 	if (V_VT(&obj->v) == VT_DISPATCH) {
-		if (!try_convert_to_string(member)) {
-			return 0;
-		}
+		convert_to_string_ex(member);
 		if (SUCCEEDED(php_com_get_id_of_name(obj, Z_STRVAL_P(member), Z_STRLEN_P(member), &dispid))) {
 			/* TODO: distinguish between property and method! */
 			return 1;
@@ -103,58 +103,3 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t

 	return string;
 }
-
-BSTR php_com_string_to_bstr(zend_string *string, int codepage)
-{
-	BSTR bstr = NULL;
-	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
-	size_t mb_len = ZSTR_LEN(string);
-	int wc_len;
-
-	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, NULL, 0)) <= 0) {
-		goto fail;
-	}
-	if ((bstr = SysAllocStringLen(NULL, (UINT)(wc_len - 1))) == NULL) {
-		goto fail;
-	}
-	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, bstr, wc_len)) <= 0) {
-		goto fail;
-	}
-	return bstr;
-
-fail:
-	char *msg = php_win32_error_to_msg(GetLastError());
-	php_error_docref(NULL, E_WARNING,
-		"Could not convert string to unicode: `%s'", msg);
-	LocalFree(msg);
-	SysFreeString(bstr);
-	return SysAllocString(L"");
-}
-
-zend_string *php_com_bstr_to_string(BSTR bstr, int codepage)
-{
-	zend_string *string = NULL;
-	UINT wc_len = SysStringLen(bstr);
-	int mb_len;
-
-	mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, NULL, 0, NULL, NULL);
-	if (mb_len > 0) {
-		string = zend_string_alloc(mb_len - 1, 0);
-		mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, ZSTR_VAL(string), mb_len, NULL, NULL);
-	}
-
-	if (mb_len <= 0) {
-		char *msg = php_win32_error_to_msg(GetLastError());
-
-		php_error_docref(NULL, E_WARNING,
-			"Could not convert string from unicode: `%s'", msg);
-		LocalFree(msg);
-
-		if (string != NULL) {
-			zend_string_release(string);
-		}
-		string = ZSTR_EMPTY_ALLOC();
-	}
-
-	return string;
-}
@@ -108,18 +108,13 @@ static zval *saproxy_read_dimension(zval *object, zval *offset, int type, zval *
 		}
 		ZVAL_COPY_VALUE(&args[i-1], offset);

-		if (!try_convert_to_string(&proxy->indices[0])) {
-			efree(args);
-			return rv;
-		}
+		convert_to_string(&proxy->indices[0]);
 		VariantInit(&v);

 		res = php_com_do_invoke(proxy->obj, Z_STRVAL(proxy->indices[0]),
 			   	Z_STRLEN(proxy->indices[0]), DISPATCH_METHOD|DISPATCH_PROPERTYGET, &v,
 			   	proxy->dimensions, args, 0);

-		efree(args);
-
 		if (res == SUCCESS) {
 			php_com_zval_from_variant(rv, &v, proxy->obj->code_page);
 			VariantClear(&v);
@@ -226,10 +221,7 @@ static void saproxy_write_dimension(zval *object, zval *offset, zval *value)
 		ZVAL_COPY_VALUE(&args[i-1], offset);
 		ZVAL_COPY_VALUE(&args[i], value);

-		if (!try_convert_to_string(&proxy->indices[0])) {
-			efree(args);
-			return;
-		}
+		convert_to_string(&proxy->indices[0]);
 		VariantInit(&v);
 		if (SUCCESS == php_com_do_invoke(proxy->obj, Z_STRVAL(proxy->indices[0]),
 					Z_STRLEN(proxy->indices[0]), DISPATCH_PROPERTYPUT, &v, proxy->dimensions + 1,
@@ -398,7 +390,7 @@ static zend_object* saproxy_clone(zval *object)
 	memcpy(cloneproxy, proxy, sizeof(*cloneproxy));

 	Z_ADDREF_P(cloneproxy->zobj);
-	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval), 0);
+	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval *), 0);
 	clone_indices(cloneproxy, proxy, proxy->dimensions);

 	return &cloneproxy->std;
@@ -448,7 +440,7 @@ int php_com_saproxy_create(zval *com_object, zval *proxy_out, zval *index)
 	}

 	Z_ADDREF_P(proxy->zobj);
-	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval), 0);
+	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval *), 0);

 	if (rel) {
 		clone_indices(proxy, rel, rel->dimensions);
@@ -96,6 +96,7 @@ bogus:

 PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage)
 {
+	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
 	zend_uchar ztype = IS_NULL;

@@ -163,7 +164,13 @@ PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codep

 		case IS_STRING:
 			V_VT(v) = VT_BSTR;
-			V_BSTR(v) = php_com_string_to_bstr(Z_STR_P(z), codepage);
+			olestring = php_com_string_to_olestring(Z_STRVAL_P(z), Z_STRLEN_P(z), codepage);
+			if (CP_UTF8 == codepage) {
+				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(wcslen(olestring) * sizeof(OLECHAR)));
+			} else {
+				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(Z_STRLEN_P(z) * sizeof(OLECHAR)));
+			}
+			efree(olestring);
 			break;

 		case IS_RESOURCE:
@@ -229,8 +236,12 @@ PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepa
 		case VT_BSTR:
 			olestring = V_BSTR(v);
 			if (olestring) {
-				zend_string *str = php_com_bstr_to_string(olestring, codepage);
-				ZVAL_STR(z, str);
+				size_t len;
+				char *str = php_com_olestring_to_string(olestring,
+					&len, codepage);
+				ZVAL_STRINGL(z, str, len);
+				// TODO: avoid reallocation???
+				efree(str);
 				olestring = NULL;
 			}
 			break;
@@ -86,8 +86,6 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		size_t *string_len, int codepage);
 PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		size_t string_len, int codepage);
-BSTR php_com_string_to_bstr(zend_string *string, int codepage);
-zend_string *php_com_bstr_to_string(BSTR bstr, int codepage);


 /* com_com.c */
@@ -1,17 +0,0 @@
--TEST--
-Bug #63208 (BSTR to PHP string conversion not binary safe)
--SKIPIF--
-<?php
-if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
-?>
--FILE--
-<?php
-$string = "\u{0905}b\0cd";
-$variant = new VARIANT($string, VT_ARRAY | VT_UI1, CP_UTF8); // Array of bytes
-$converted = (string) $variant;
-var_dump(bin2hex($string));
-var_dump(bin2hex($converted));
-?>
--EXPECT--
-string(14) "e0a48562006364"
-string(14) "e0a48562006364"
@@ -1,27 +0,0 @@
--TEST--
-Bug #64130 (COM obj parameters passed by reference are not updated)
--SKIPIF--
-<?php
-if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
-if (PHP_INT_SIZE != 4) die('skip for 32bit platforms only');
-try {
-    $ie = new com('InternetExplorer.Application');
-} catch (com_exception $ex) {
-    die("skip {$ex->getMessage()}");
-}
-$ie->quit();
-?>
--FILE--
-<?php
-$ie = new com('InternetExplorer.Application');
-$x = 0;
-$y = 0;
-try {
-    $ie->clientToWindow($x, $y);
-} catch (com_exception $ex) {}
-var_dump($x > 0, $y > 0);
-$ie->quit();
-?>
--EXPECT--
-bool(true)
-bool(true)
@@ -2183,7 +2183,7 @@ static inline int build_mime_structure_from_hash(php_curl *ch, zval *zpostfields
 	}
 #endif

-	ZEND_HASH_FOREACH_KEY_VAL_IND(postfields, num_key, string_key, current) {
+	ZEND_HASH_FOREACH_KEY_VAL(postfields, num_key, string_key, current) {
 		zend_string *postval, *tmp_postval;
 		/* Pretend we have a string_key here */
 		if (!string_key) {
@@ -2919,7 +2919,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				return FAILURE;
 			}

-			ZEND_HASH_FOREACH_VAL_IND(ph, current) {
+			ZEND_HASH_FOREACH_VAL(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
 				slist = curl_slist_append(slist, ZSTR_VAL(val));
@@ -1,16 +0,0 @@
--TEST--
-Bug #79741: curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties
--FILE--
-<?php
-
-class Test {
-	public $prop = "value";
-}
-
-$ch = curl_init();
-curl_setopt($ch, CURLOPT_POSTFIELDS, new Test);
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -7,7 +7,7 @@ TestFest 2009 - AFUP - Perrick Penet <perrick@noparking.net>
 --FILE--
 <?php

-$url = substr(uniqid(),0,7)."://www.".uniqid().".".uniqid();
+$url = uniqid()."://www.".uniqid().".".uniqid();
 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $url);

@@ -18,6 +18,6 @@ curl_close($ch);


 ?>
--EXPECTF--
-string(%d) "%Srotocol%s"
-int(1)
+--EXPECTREGEX--
+string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
+int\(\d\)
@@ -1001,7 +1001,7 @@ reltextnumber = 'first'|'second'|'third'|'fourth'|'fifth'|'sixth'|'seventh'|'eig
 reltexttext = 'next'|'last'|'previous'|'this';
 reltextunit = 'ms' | 'µs' | (('msec'|'millisecond'|'µsec'|'microsecond'|'usec'|'sec'|'second'|'min'|'minute'|'hour'|'day'|'fortnight'|'forthnight'|'month'|'year') 's'?) | 'weeks' | daytext;

-relnumber = ([+-]*[ \t]*[0-9]{1,13});
+relnumber = ([+-]*[ \t]*[0-9]+);
 relative = relnumber space? (reltextunit | 'week' );
 relativetext = (reltextnumber|reltexttext) space reltextunit;
 relativetextweek = reltexttext space 'week';
@@ -322,9 +322,9 @@ typedef struct _timelib_tzdb {
 # define timelib_free    free
 #endif

-#define TIMELIB_VERSION 201804
-#define TIMELIB_EXTENDED_VERSION 20180401
-#define TIMELIB_ASCII_VERSION "2018.04"
+#define TIMELIB_VERSION 201803
+#define TIMELIB_EXTENDED_VERSION 20180301
+#define TIMELIB_ASCII_VERSION "2018.03"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01
@@ -367,14 +367,6 @@ static timelib_sll do_years(timelib_sll year)
 	timelib_sll eras;

 	eras = (year - 1970) / 40000;
-
-	/* Hack to make sure we don't overflow. Right now, we can't easily thrown a
-	 * warning in this case, so we'll just return some rubbish. Sucks, but at
-	 * least it doesn't show UBSAN warnings anymore */
-	if (eras < -1000000 || eras > 1000000) {
-		return eras > 0 ? LLONG_MAX/10 : LLONG_MIN/10;
-	}
-
 	if (eras != 0) {
 		year = year - (eras * 40000);
 		res += (SECS_PER_ERA * eras * 100);
@@ -2390,10 +2390,7 @@ static int date_object_compare_timezone(zval *tz1, zval *tz2) /* {{{ */
 	o1 = Z_PHPTIMEZONE_P(tz1);
 	o2 = Z_PHPTIMEZONE_P(tz2);

-	if (!o1->initialized || !o2->initialized) {
-		php_error_docref(NULL, E_WARNING, "Trying to compare uninitialized DateTimeZone objects");
-		return 1;
-	}
+	ZEND_ASSERT(o1->initialized && o2->initialized);

 	if (o1->type != o2->type) {
 		php_error_docref(NULL, E_WARNING, "Trying to compare different kinds of DateTimeZone objects");
@@ -29,17 +29,6 @@ function compare_timezones($timezone1, $timezone2)
    var_dump($tz1 > $tz2);
 }

-// Test comparison of uninitialized DateTimeZone objects.
-class MyDateTimeZone extends DateTimeZone {
-    function __construct() {
-         // parent ctor not called
-    }
-}
-
-$tz1 = new MyDateTimeZone();
-$tz2 = new MyDateTimeZone();
-var_dump($tz1 == $tz2);
-
 ?>
 --EXPECTF--
 compare +0200 with +0200
@@ -69,6 +58,3 @@ compare Europe/Amsterdam with Europe/Berlin

 Warning: main(): Trying to compare different kinds of DateTimeZone objects in %s on line %d
 bool(false)
-
-Warning: main(): Trying to compare uninitialized DateTimeZone objects in %s on line %d
-bool(false)
@@ -6,12 +6,12 @@ Handling of large year values
 <?php
 date_default_timezone_set("America/Toronto");

-$t = mktime(0,0,0,1,1,2922770265);
+$t = mktime(0,0,0,1,1,292277026596);

 var_dump(date("r", $t));

 echo "OK\n";
 ?>
--EXPECTF--
-string(%d) "%s, 01 Jan 2922770265 00:00:00 -0500"
+--EXPECT--
+string(39) "Fri, 01 Jan 292277026596 00:00:00 -0500"
 OK
@@ -4,7 +4,7 @@ Bug #48097 (date_timezone_set function produces wrong datetime result)
 date.timezone=UTC
 --FILE--
 <?php
-$d = date_create( "Sun, 22 May 1955 02:00:00 +0200" );
+$d = date_create( "Mon, 23 May 1955 00:00:00 +0200" );
 var_dump( $d );
 echo $d->format( DATE_ISO8601 ), "\n";
 echo $d->format( 'U' ), "\n\n";
@@ -16,23 +16,23 @@ echo $d->format( 'U' ), "\n\n";
 --EXPECT--
 object(DateTime)#1 (3) {
  ["date"]=>
-  string(26) "1955-05-22 02:00:00.000000"
+  string(26) "1955-05-23 00:00:00.000000"
  ["timezone_type"]=>
  int(1)
  ["timezone"]=>
  string(6) "+02:00"
 }
-1955-05-22T02:00:00+0200
-461203200
+1955-05-23T00:00:00+0200
+-461124000

 object(DateTime)#1 (3) {
  ["date"]=>
-  string(26) "1955-05-22 01:00:00.000000"
+  string(26) "1955-05-22 23:00:00.000000"
  ["timezone_type"]=>
  int(3)
  ["timezone"]=>
  string(15) "Europe/Budapest"
 }
-1955-05-22T01:00:00+0100
+1955-05-22T23:00:00+0100

-461203200
+-461124000
@@ -64,8 +64,7 @@ typedef unsigned char uchar;

 #define EFREE_IF(ptr)	if (ptr) efree(ptr)

-#define MAX_IFD_NESTING_LEVEL 10
-#define MAX_IFD_TAGS 1000
+#define MAX_IFD_NESTING_LEVEL 150

 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
@@ -2023,7 +2022,6 @@ typedef struct {
 	int             read_thumbnail;
 	int             read_all;
 	int             ifd_nesting_level;
-	int             ifd_count;
 	int             num_errors;
 	/* internal */
 	file_section_list 	file;
@@ -2714,7 +2712,6 @@ static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
 /* forward declarations */
 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int tag);
 static int exif_process_IFD_TAG(    image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table);
-static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index);

 /* {{{ exif_get_markername
 	Get name of marker */
@@ -3213,23 +3210,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

-	/* It can be that motorola_intel is wrongly mapped, let's try inverting it */
-	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");
-
-		ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
-		NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
-	}
-
-	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
-		return FALSE;
-	}
-	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-		return FALSE;
-	}
-
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
@@ -3260,6 +3240,15 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			break;
 	}

+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		return FALSE;
+	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
+
 	for (de=0;de<NumDirEntries;de++) {
 		size_t offset = 2 + 12 * de;
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
@@ -3286,7 +3275,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
-static int exif_process_IFD_TAG_impl(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
+static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
 {
 	size_t length;
 	unsigned int tag, format, components;
@@ -3299,6 +3288,13 @@ static int exif_process_IFD_TAG_impl(image_info_type *ImageInfo, char *dir_entry
 	int dump_free;
 #endif /* EXIF_DEBUG */

+	/* Protect against corrupt headers */
+	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
+		return FALSE;
+	}
+	ImageInfo->ifd_nesting_level++;
+
 	tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
 	format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
 	components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
@@ -3618,24 +3614,6 @@ static int exif_process_IFD_TAG_impl(image_info_type *ImageInfo, char *dir_entry
 }
 /* }}} */

-static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
-{
-	int result;
-	/* Protect against corrupt headers */
-	if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum IFD tag count reached");
-		return FALSE;
-	}
-	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
-		return FALSE;
-	}
-	ImageInfo->ifd_nesting_level++;
-	result = exif_process_IFD_TAG_impl(ImageInfo, dir_entry, offset_base, IFDlength, displacement, section_index, ReadNextIFD, tag_table);
-	ImageInfo->ifd_nesting_level--;
-	return result;
-}
-
 /* {{{ exif_process_IFD_in_JPEG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int tag)
@@ -4069,7 +4047,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)

 /* {{{ exif_process_IFD_in_TIFF
 * Parse the TIFF header; */
-static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_offset, int section_index)
+static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
 {
 	int i, sn, num_entries, sub_section_index = 0;
 	unsigned char *dir_entry;
@@ -4077,6 +4055,10 @@ static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_
 	int entry_tag , entry_type;
 	tag_table_type tag_table = exif_get_tag_table(section_index);

+	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+		return FALSE;
+	}
+
 	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
@@ -4220,6 +4202,7 @@ static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_
 #ifdef EXIF_DEBUG
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s @x%04X", exif_get_sectionname(sub_section_index), entry_offset);
 #endif
+						ImageInfo->ifd_nesting_level++;
 						exif_process_IFD_in_TIFF(ImageInfo, entry_offset, sub_section_index);
 						if (section_index!=SECTION_THUMBNAIL && entry_tag==TAG_SUB_IFD) {
 							if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
@@ -4263,6 +4246,7 @@ static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) at x%04X", next_offset);
 #endif
+					ImageInfo->ifd_nesting_level++;
 					exif_process_IFD_in_TIFF(ImageInfo, next_offset, SECTION_THUMBNAIL);
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
@@ -4299,21 +4283,6 @@ static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_
 }
 /* }}} */

-static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
-{
-	int result;
-	if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
-		return FALSE;
-	}
-	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-		return FALSE;
-	}
-	ImageInfo->ifd_nesting_level++;
-	result = exif_process_IFD_in_TIFF_impl(ImageInfo, dir_offset, section_index);
-	ImageInfo->ifd_nesting_level--;
-	return result;
-}
-
 /* {{{ exif_scan_FILE_header
 * Parse the marker stream until SOS or EOI is seen; */
 static int exif_scan_FILE_header(image_info_type *ImageInfo)
@@ -4469,7 +4438,6 @@ static int exif_read_from_impl(image_info_type *ImageInfo, php_stream *stream, i


 	ImageInfo->ifd_nesting_level = 0;
-	ImageInfo->ifd_count = 0;
 	ImageInfo->num_errors = 0;

 	/* Scan the headers */
@@ -1,17 +0,0 @@
--TEST--
-Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
-$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);
-
-echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
-echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
-?>
-===DONE===
--EXPECTF--
-38/1
-122/1
-===DONE===
@@ -1,10 +0,0 @@
--TEST--
-Should not cause OOM
--FILE--
-<?php
-
-var_dump(@exif_read_data(__DIR__ . '/nesting_level_oom.tiff'));
-
-?>
--EXPECT--
-bool(false)
@@ -7427,11 +7427,11 @@ void zend_ffi_val_character(zend_ffi_val *val, const char *str, size_t str_len)
 				val->ch = '\t';
 			} else if (str[2] == 'v' && str_len == 4) {
 				val->ch = '\v';
-			} else if (str[2] >= '0' && str[2] <= '7') {
+			} else if (str[2] >= '0' || str[2] <= '7') {
 				n = str[2] - '0';
-				if (str[3] >= '0' && str[3] <= '7') {
+				if (str[3] >= '0' || str[3] <= '7') {
 					n = n * 8 + (str[3] - '0');
-					if ((str[4] >= '0' && str[4] <= '7') && str_len == 6) {
+					if ((str[4] >= '0' || str[4] <= '7') && str_len == 6) {
 						n = n * 8 + (str[4] - '0');
 					} else if (str_len != 5) {
 						val->kind = ZEND_FFI_VAL_ERROR;
@@ -7445,25 +7445,23 @@ void zend_ffi_val_character(zend_ffi_val *val, const char *str, size_t str_len)
 					val->kind = ZEND_FFI_VAL_ERROR;
 				}
 			} else if (str[2] == 'x') {
-				if (str[3] >= '0' && str[3] <= '9') {
+				if (str[3] >= '0' || str[3] <= '7') {
 					n = str[3] - '0';
-				} else if (str[3] >= 'A' && str[3] <= 'F') {
+				} else if (str[3] >= 'A' || str[3] <= 'F') {
 					n = str[3] - 'A';
-				} else if (str[3] >= 'a' && str[3] <= 'f') {
+				} else if (str[3] >= 'a' || str[3] <= 'f') {
 					n = str[3] - 'a';
 				} else {
 					val->kind = ZEND_FFI_VAL_ERROR;
-					return;
 				}
-				if ((str[4] >= '0' && str[4] <= '9') && str_len == 6) {
+				if ((str[4] >= '0' || str[4] <= '7') && str_len == 6) {
 					n = n * 16 + (str[4] - '0');
-				} else if ((str[4] >= 'A' && str[4] <= 'F') && str_len == 6) {
+				} else if ((str[4] >= 'A' || str[4] <= 'F') && str_len == 6) {
 					n = n * 16 + (str[4] - 'A');
-				} else if ((str[4] >= 'a' && str[4] <= 'f') && str_len == 6) {
+				} else if ((str[4] >= 'a' || str[4] <= 'f') && str_len == 6) {
 					n = n * 16 + (str[4] - 'a');
 				} else if (str_len != 5) {
 					val->kind = ZEND_FFI_VAL_ERROR;
-					return;
 				}
 				val->ch = n;
 			} else if (str_len == 4) {
@@ -1,15 +0,0 @@
--TEST--
-Bug #80186 (Segfault when iterating over FFI object)
--SKIPIF--
-<?php
-if (!extension_loaded('ffi')) die('skip ffi extension not available');
-?>
--FILE--
-<?php
-$ffi = FFI::cdef('typedef int dummy;');
-foreach ($ffi as $_) { }
-foreach ($ffi as &$_) { }
-?>
-===DONE===
--EXPECT--
-===DONE===
Author	SHA1	Message	Date
Derick Rethans	da4a40646a	Update versions for PHP 7.4.8	2020-07-09 08:57:18 +00:00
Derick Rethans	66996b2df0	Revert "Partial fixed bug #79649 (Altering disable_functions from module init corrupts memory)" This reverts commit `a297c09da5`.	2020-07-09 09:50:45 +01:00
Derick Rethans	31821e5456	Update NEWS for PHP 7.4.8	2020-07-07 09:27:40 +00:00
Derick Rethans	8e939fd055	Turn into marker	2020-07-07 10:25:50 +01:00
Derick Rethans	14cbf81902	Update NEWS for PHP 7.4.8RC1	2020-06-23 07:36:54 +00:00