Backport fix for bug #70083 to PHP-5.6

Fixed bug #70083 (Use after free with assign by ref on overloaded objects)

Reverted useless cleanup code

Fixed bug #70215 (segfault when __invoke is static)

Improve the conditions(save one comparison)

Preserve return value in zend_vm_call_opcode_handler with global opline/ex registers enabled

Micro optimization

Resolve GOTO at compile time and replace it with sequnce of FREE/FE_FREE and JMP.

Exception thrown by "return" statement (from TMP destructors) shouldn't be caught in the same function

Squashed commit of the following:

commit 03cf871f1576f08b2348c141b209894a7bf17a86
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:31 2015 +0300

Revert "

Squashed commit of the following:

commit 03cf871f1576f08b2348c141b209894a7bf17a86
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:31 2015 +0300

Revert "Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient op_array->T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence)"

This reverts commit 5ee841325901a4b040cfea56292a24702fe224d9.

commit 285a68227ce3d380e821a24fa389aa5239bd3fe1
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:26 2015 +0300

Revert "Tuned off dubugging of live ranges"

This reverts commit 404dc93d35f7061fc4b1b41ad6cb0721b9b52bcc.

commit 93d9d11157301ee2ec99afb6f5744b126d17f637
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:17 2015 +0300

Revert "Remove loop_var_stack"

This reverts commit b3a4c05071c3786e27e1326fa1b4d5acad62fccd.

commit ede68ebbc284aec79e3f719f2c8dbf9da6907752
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:12 2015 +0300

Revert "ZEND_SEPARATE reuses temporaries"

This reverts commit 1852f538b9f8d5e7d67fe5a4f6080396d8b10034.

commit 96d8995dc1f517fb01b481736273767509f76c47
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:10 2015 +0300

Revert "Add assertion in liveliness computation"

This reverts commit ed14019e8c0c852480eebc6fc552d8c3d939dce1.

commit 0649d7bfef152e6cc8e67b922534e9946c634d9c
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:07 2015 +0300

Revert "Fixed invalid live-range detection"

This reverts commit 54f367ee2a2e4cb7c952b17915c226fdc56038ab.

commit dfe8f3851f6b04595eb089323e3492115a59363e
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:04 2015 +0300

Revert "Add test guaranteeing that loop vars are only freed after potential return type exceptions"

This reverts commit f5db5a558d550bf441373febebbb02f3884209d1.

commit 52a94aad6f48a199358cc07f7e4f56bb73050504
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:45:01 2015 +0300

Revert "Fixed exception habdling on "return" statement."

This reverts commit 17c5315bdf8f8087979aeb55f6d3a512ba197cf5.

commit 6e90ad7331901711e89c2ceb2bcab5023e5cee60
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:44:58 2015 +0300

Revert "Fix too early terminated temporary range with break/cont/goto"

This reverts commit cc876c04b420589cb1f62b650d0c0e24975dd4af.

commit 7b766e44b1970e4031f75109c302c07ead2c05cb
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 10 02:44:55 2015 +0300

Revert "Fixed exception catching on break/continue"

This reverts commit 8c3f701eebfa92d761bb368cfa8c2d1ccf821b9d.

show more ...

Fixed exception catching on break/continue
Fixed "finaly" handling on exception in "return" statement

Fix too early terminated temporary range with break/cont/goto
I have no crashing or leaking reproduce script, only valgrind invalid reads for that one; hence no phpt here

Fixed exception habdling on "return" statement.
Such exceptions shouldn't be caught in the same function.

Fixed situation, when CHECH_EXCEPTION() might change value of "opline" variable and the following "opline" useages would access elements of different opcode. That might lead to unpredictable behavior

Fixed situation, when CHECH_EXCEPTION() might change value of "opline" variable and the following "opline" useages would access elements of different opcode. That might lead to unpredictable behavior. (Only PHP-7 with GCC global register variables was affected).
CHECK_EXCEPTION() macro is removed. ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTIO() should be used instead. It's equivalent to old CHECK_EXCEPTION() + ZEND_VM_NEXT_OPCODE().
As a side effect, this also slightly improved performnce of builds with GCC >= 4.8.

show more ...

Make sure fast_call_var is initialized properly

Remove outdate comment

Fixed bug #70012 (Exception lost with nested finally block)

Fixed bug #70012 (Exception lost with nested finally block)

Use NULL where possible for exception class

Matches usage of zend_throw_exception()/zend_throw_exception_ex().

Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient

Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient op_array->T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence)

Squashed commit of the following:

commit 38e22106d4bdcc829dd2b64be1d3c6cdc089f3ed
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 15:12:19 2015 +0300

Added NEWS entry

commit 0a355935bfb10b5a4c893f4db9496ea8abbcf71b
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 15:06:32 2015 +0300

Inline function, to eliminate repeatable checks

commit d937584f3aef0baae6001377b61fd700b6f36e14
Merge: 0341626 32677f5
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 14:35:49 2015 +0300

Merge branch 'master' into temporary_cleaning

* master:
Fixed bug #70006 (cli - function with default arg = STDOUT crash output).
Fix x86 build
Fixed use after free on closure_call_leak_with_exception.phpt
Fixed test

commit 0341626ea94a5e474c660732d33884460847d5e7
Merge: 74869fa dec35de
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 12:00:53 2015 +0300

Merge branch 'temporary_cleaning' of https://github.com/laruence/php-src into temporary_cleaning

* 'temporary_cleaning' of https://github.com/laruence/php-src:
Fixed checkpoint get
Fixed crash of invalid pointer derefer
cleanup

commit 74869fa67375b8daf772ac30b6b936fd2a2132c6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 11:45:34 2015 +0300

Fixed wrong GOTO resolution

commit dec35ded3294e3022e88a623188c3d1d71381675
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 15:58:49 2015 +0800

Fixed checkpoint get

commit b0f419540ad24c44810c9b05da046965618ffc65
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:47:11 2015 +0300

Fixed crash of invalid pointer derefer (laruence)

commit 7a428d98ca2899c5933914caa0cd17b4126e952c
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:35:47 2015 +0300

Fixed identation

commit 9c3a4dce9ce02034d19d28182aa9c1298d528daf
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:33:52 2015 +0300

Fixed invalid size

commit 653abc670b2a1f453b0fc3fc4a9eca919ee870cc
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 11:29:14 2015 +0800

Fixed crash of invalid pointer derefer

commit e04500ceda606ac4f364d03bcd562327bdc74eee
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 11:28:26 2015 +0800

cleanup

commit 34183e1687681038e77b650078927b35ee84e933
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:49:46 2015 +0300

op_array->T_liveliness compression

commit 2f6ad845795a08c3d7ac219e9c42950565b20394
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:44:44 2015 +0300

White spaces

commit be83f115a3f82a548c8d377c66574de5e5187410
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:42:26 2015 +0300

Identation

commit 1f5084b99038c374ac012b017c4d1652bb5d4222
Merge: 91b620d 1adf3df
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:41:54 2015 +0300

Merge branch 'master' into temporary_cleaning

* master:
Throw TypeError for invalid callback
Fix crash when exception occurs during nested rope
Fix crash when exception is thrown during ROPE_END
Small cleanup in ternary compilation
move the define to the right place
fix ext/ldap build
Rectify information about invalid shift warning being now ArithmeticError

commit 91b620d684c5a2296774432d5d0ff8f5d14397d6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:32:04 2015 +0300

Replace GOTO by FREE/FE_FREE and JMP at compile time

commit 7052e5697918fab83d2975977c3392f7188fbc87
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 02:25:08 2015 +0300

Use zend_regenerate_var_liveliness_info() to regenerate information after pass two.

commit ae72b0dc6797815a846b8f95abccb36367422d27
Merge: a81c4bb a919fe8
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 21:02:34 2015 +0300

Merge branch 'master' into temporary_cleaning

* master:
Do not display EXT_TYPE_UNUSED in phpdbg opcodes
Run debug build with opcache on travis

commit a81c4bb8c6f1ba8124a5a7636694480ff0f1328c
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 20:59:34 2015 +0300

Improved algorithm. It's actually the same algorithm with second loop removed and simpler temporary data structures. The only difference may be in "re-defined" vatriable handling. Now live-range in that case started from the seconnd definition (this must be more safe).

commit 9a16810f7a7c10373603c5250d985616acf45e97
Merge: bbfbe47 001ecd3
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 17:57:45 2015 +0300

Merge branch 'master' into temporary_cleaning

* master:
Simplify TMP var number decoding (without HashTable)

commit bbfbe470c865cb8b3cae8bf6518e6d06af525522
Merge: 0bda4ab 436b01e
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 17:02:01 2015 +0300

Merge branch 'master' into temporary_cleaning

* master:
Avoid dangerous optimization
Fixed JMPZNZ instruction printing
Attempt at falling back on ldap_find_control for Mac OS

commit 0bda4abea7ba0a51c2ec125edb547645d0329792
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 16:05:33 2015 +0300

Fixed live-range construction for OP_DATA opcode
Added comments about algorithm assumtions

commit 521ad9df98fdf1dd8b7c212799ddeb1a84483e6f
Merge: 4398dab a09dcb0
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 14:54:15 2015 +0200

Merge branch 'master' of https://github.com/php/php-src into temporary_cleaning

commit 4398dab82f9a5ce64df55b24988ce7d31e24074f
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 13:51:27 2015 +0200

Add a few phpt tests related to temporary cleaning

commit 739656f83ff5b570bb311d2c7cb2d72380a3c759
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 14:28:49 2015 +0300

Fixed Zend/tests/foreach_004.phpt failure (FE_FETCH shouldn't be included into TMP vatriablr live range)

commit 3df462a2bcf5fa8f9244ea299178152a5d436277
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 13:41:02 2015 +0300

Improve data layout (reduce the op_array structure size on 64-bit systems)

commit 883b73c56e6dab6489ae4cda2c1331b53a995586
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 13:28:45 2015 +0300

Removed op_array->brk_cont_array

commit ae5e58b59843513505e84e396c1446ac35cb1b94
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 04:22:58 2015 +0200

Fix bug with brk_cont variable free / free loop vars via temporary liveliness info

commit b4223ca62771e1003c9ab778a09a177ad71e6d57
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 04:07:07 2015 +0200

Fix bugs / cleanup fixes

commit ea33189d220c7fc0884848571635abe3cddd2f4d
Author: Xinchen Hui <laruence@gmail.com>
Date: Sun Jul 5 20:58:38 2015 +0800

Removed useless TsTop

commit 1dbb007e4addba9ac3bfc227db27a651cbcf5ede
Merge: 550bbf8 3a8af24
Author: Xinchen Hui <laruence@gmail.com>
Date: Sat Jul 4 15:06:44 2015 +0800

Merge branch 'temporary_cleaning' of https://github.com/dstogov/php-src into temporary_cleaning

commit 3a8af245290ceb507108340831254672f24022fa
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 16:15:36 2015 +0300

More exceptions from regular liveliness analyses (with explanation in comments).
Mark old "unexplained" exceptions with ???.

commit ba721efa2cbd2136668fec956ef3b034ac1a29d6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 14:16:09 2015 +0300

Print list of live temp variables (at least for internal debugging)

commit 8d1f88fe91e62b4333703c58b871d85b66fb7b70
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 13:31:56 2015 +0300

Use op_array->T_liveliness to free incomplete ropes and restore error_reporting level on exception

commit 80c1d0d779e6e9609a211907838f3727aa7b301a
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 11:05:39 2015 +0300

Don't keep empty T_liveliness

commit 501ae8aaac0a92368b50e9f342b04d7334d263f6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Thu Jul 2 22:31:48 2015 +0300

Reverted changes to Zend/zend_arena.h.
Reuse CG(arena) instead of creating a new one.

commit a4fce36907147df5ac1af78b44135e3f07c1844c
Merge: 6ff7246 fd0fcce
Author: Dmitry Stogov <dmitry@zend.com>
Date: Thu Jul 2 22:01:42 2015 +0300

Merge branch 'temporary_cleaning' of github.com:bwoebi/php-src into temporary_cleaning

* 'temporary_cleaning' of github.com:bwoebi/php-src:
Fix remaining issues with compacted temporaries
Fix regression from last commit (+1 ?!)
Fix off-by-one (opcache may remove last ZEND_RETURN)
Speed algorithm up, more fail safety when reusing temporaries
Dumb bug in opcode.c (forgot to update Ts[i])
Fix opcache support
Exempt ROPE temporaries from freeing
Hmm, we need temporary info for all the opcodes
Add opcache support for cleaning in optimization step (Opcache seems to have a few unrelated issues which blow up together with that patch)
Add proper temporary cleaning upon frame abortion
Fix arena on small sizes (size < sizeof(zend_arena))

commit fd0fcce81177717f3a05ac87192b5ed05eead0a1
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Thu Jul 2 20:00:33 2015 +0200

Fix remaining issues with compacted temporaries

commit 427dc58bbb93022d1c2077f874afcdb9dd82d5c5
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 22:49:12 2015 +0200

Fix regression from last commit (+1 ?!)

commit 1adcf56a6e9f09e7ad06331d4d6280035b17a7d1
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 22:17:07 2015 +0200

Fix off-by-one (opcache may remove last ZEND_RETURN)

commit 25b231b7841fa4078c65976cabdd843845a6cbe6
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 20:59:24 2015 +0200

Speed algorithm up, more fail safety when reusing temporaries

commit 22d9d05350e35d180018d0bccbad6f173cb4797d
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 16:48:46 2015 +0200

Dumb bug in opcode.c (forgot to update Ts[i])

commit 6538269bfa5bcbad34fc2f051b0fd5e4ebf2ff00
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 13:05:52 2015 +0200

Fix opcache support

commit 333a7c4a8813a45dc79ce55b8e9c0a0b98671e13
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Sat Jun 27 22:40:21 2015 +0200

Exempt ROPE temporaries from freeing

commit 02585f77085427baea48448c134a96c542af3337
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 16:20:55 2015 +0200

Hmm, we need temporary info for all the opcodes

commit cbcaedbd78199897e5cacffd700b706f21590abf
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 01:04:09 2015 +0200

Add opcache support for cleaning in optimization step
(Opcache seems to have a few unrelated issues which blow up together with that patch)

commit fef649f4067823a1f96f85340cf715e5877310bc
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 01:02:27 2015 +0200

Add proper temporary cleaning upon frame abortion

commit 1cec2e7271b789b84601f8acf385950af1bb0c7c
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Thu Jun 25 23:33:21 2015 +0200

Fix arena on small sizes (size < sizeof(zend_arena))

show more ...

Fix crash when exception is thrown during ROPE_END

The CHECK_EXCEPTION() was done at a point where the old opline is
still used, thus redirecting the write to the result var into
EX(

Fix crash when exception is thrown during ROPE_END

The CHECK_EXCEPTION() was done at a point where the old opline is
still used, thus redirecting the write to the result var into
EX(call) instead.

Handling the exception in-place to avoid leaking result.

show more ...

Fixed segfault while with generating ext info

Remove need to pass error level

Enable throwing custom exceptions from errors

Use DivisionByZeroError instead of exception for %/intdiv()