Delay #[Attribute] arg validation until runtime

Fixes GH-13970
Closes GH-14105

We cannot validate at compile-time for multiple reasons:

* Evaluating the argument naivel

Delay #[Attribute] arg validation until runtime

Fixes GH-13970
Closes GH-14105

We cannot validate at compile-time for multiple reasons:

* Evaluating the argument naively with zend_get_attribute_value can lead to code
execution at compile time through the new expression, leading to possible
reentrance of the compiler.
* Even if the evaluation was possible, it would need to be restricted to the
current file, because constant values coming from other files can change
without affecting the current compilation unit. For this reason, validation
would need to be repeated at runtime anyway.
* Enums cannot be instantiated at compile-time (the actual bug report). This
could be allowed here, because the value is immediately destroyed. But given
the other issues, this won't be needed.

Instead, we just move it to runtime entirely. It's only needed for
ReflectionAttribute::newInstance(), which is not particularly a hot path. The
checks are also simple.

show more ...

RFC: Add #[Override] attribute (#9836)

* Add #[Override] attribute

* Move #[\Override] tests into Zend/tests/attributes/override/

* Check `check_only` before removing `ZEND

RFC: Add #[Override] attribute (#9836)

* Add #[Override] attribute

* Move #[\Override] tests into Zend/tests/attributes/override/

* Check `check_only` before removing `ZEND_ACC_OVERRIDE`

* NEWS/UPGRADING for #[\Override]

show more ...

More usage of known zend_str instead of C string (#11381)

Fix GH-8329 Print true/false instead of bool in error and debug messages (#8385)

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addea

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addeae.

show more ...

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate:

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate: in fact, accessing object handlers usually requires not-so-safe hacks.
While it is possible to swap handlers in a custom installed create_object handler, this mostly is tedious, as well as it requires allocating the object handlers struct at runtime, possibly caching it etc..

This allows extensions, which intend to observe other classes to install their own class handlers.
The life cycle of internal classes may now be simply observed by swapping the class handlers in post_startup stage.
The life cycle of userland classes may be observed by iterating over the new classes in zend_compile_file and zend_compile_string and then swapping their handlers.

In general, this would also be a first step in directly tying the object handlers to classes. Especially given that I am not aware of any case where the object handlers would be different between various instances of a given class.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

show more ...

Allow for arbitrary (class) attributes in stubs

This can be easily extended to other types of attributes.

Closes #8839.

Add support for readonly classes (#7305)

RFC: https://wiki.php.net/rfc/readonly_classes

Use `zend_update_property` to set `SensitiveParameterValue::$value` (#8365)

see https://github.com/php/php-src/issues/8351#issuecomment-1098284745

Implement the "Redacting parameters in back traces" RFC

https://wiki.php.net/rfc/redact_parameters_in_back_traces

Replace memcmp() with zend_string functions (#8216)

* ext/oci8: use zend_string_equals()

Eliminate duplicate code.

* main/php_variables: use zend_string_equals_literal()

Replace memcmp() with zend_string functions (#8216)

* ext/oci8: use zend_string_equals()

Eliminate duplicate code.

* main/php_variables: use zend_string_equals_literal()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_equals_cstr()

Allows eliminating duplicate code.

* Zend, ext/{opcache,standard}, main/output: use zend_string_equals_cstr()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_starts_with()

* ext/{opcache,phar,spl,standard}: use zend_string_starts_with()

This adds missing length checks to several callers, e.g. in
cache_script_in_shared_memory(). This is important when the
zend_string is shorter than the string parameter, when memcmp()
happens to check backwards; this can result in an out-of-bounds memory
access.

show more ...

Fix freeing of internal attribute arguments

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/__set().

RFC: https://wiki.php.net/rfc/deprecate_dynamic_properties

show more ...

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.

show more ...

Pass flags to #[Attribute] on internal attributes

While the specified restriction was checked, the #[Attribute]
attribute did not specify the flags parameter, so that Reflection
retu

Pass flags to #[Attribute] on internal attributes

While the specified restriction was checked, the #[Attribute]
attribute did not specify the flags parameter, so that Reflection
returned incorrect information.

In particular, Attribute itself has a CLASS target, not an ALL
target.

show more ...

Add support for tentative return types of internal methods

RFC: https://wiki.php.net/rfc/internal_method_return_types

Closses GH-6971

Fix the error message of attribute flag validation

Generate zend class entries based on stubs

Closes GH-6685

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.

show more ...

Don't use scope when validating Attribute

This is not safe to do at this point. Even if we made it safe,
we'd see inconsistencies due to a partially compiled class.

Fixes oss-fu

Don't use scope when validating Attribute

This is not safe to do at this point. Even if we made it safe,
we'd see inconsistencies due to a partially compiled class.

Fixes oss-fuzz #28129.

show more ...

Honor strict_types=1 for attributes, improve backtraces

Make ReflectionAttribute::newInstance() respect the strict_types=1
declaration at the attribute use-site. More generally, pretend

Honor strict_types=1 for attributes, improve backtraces

Make ReflectionAttribute::newInstance() respect the strict_types=1
declaration at the attribute use-site. More generally, pretend that
we are calling the attribute constructor from the place where the
attribute is used, which also means that the attribute location will
show up properly in backtraces and inside "called in" error information.

This requires us to store the attributes strict_types scope (as flags),
as well as the attribute line number. The attribute filename can be
recovered from the symbol it is used on. We might want to expose the
attribute line number via reflection as well.

See also https://externals.io/message/111915.

Closes GH-6201.

show more ...

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functio

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

show more ...

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument nam

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument name. For now, it is looked up by linear scan and
runtime cached.
* This may leave UNDEF arguments on the stack. To avoid having
to deal with them in other places, a CHECK_UNDEF_ARGS opcode
is used to either replace them with defaults, or error.
* For variadic functions, EX(extra_named_params) are collected
and need to be freed based on ZEND_CALL_HAS_EXTRA_NAMED_PARAMS.

RFC: https://wiki.php.net/rfc/named_params

Closes GH-5357.

show more ...

Implement Attribute Amendments.

RFC: https://wiki.php.net/rfc/attribute_amendments

Support for attribute grouping is left out, because the short
attribute syntax RFC will likely

Implement Attribute Amendments.

RFC: https://wiki.php.net/rfc/attribute_amendments

Support for attribute grouping is left out, because the short
attribute syntax RFC will likely make it obsolete.

Closes GH-5751.

show more ...

Fix free of uninitialized memory in attributes

Fixes OSS-Fuzz #23140.