Set func pointer to null in Closure __invoke (#12275)

Fix freeing of incompletely initialized closures

Addref to relevant fields before allocating any memory. Also only set/remove the
ZEND_ACC_HEAP_RT_CACHE flag after allocating memory.

Fix freeing of incompletely initialized closures

Addref to relevant fields before allocating any memory. Also only set/remove the
ZEND_ACC_HEAP_RT_CACHE flag after allocating memory.

Fixes GH-12073
Closes GH-12074

show more ...

Fix GH-11406: segfault with unpacking and magic method closure

The magic method trampoline closure may be variadic. However, the
arg_info for the variadic argument was not set, resulting

Fix GH-11406: segfault with unpacking and magic method closure

The magic method trampoline closure may be variadic. However, the
arg_info for the variadic argument was not set, resulting in a crash
both in reflection and in the VM.

Fix it by creating an arg_info containing a single element in case of
the variadic case. The variadic argument is the last one (and in this
case only one) in the arg_info array.

We make sure the argument info is equivalent to the argument info of
`$closure` of the following code snippet:
```
function foo(...$arguments) {}
$closure = foo(...);
```

Closes GH-11417.

show more ...

Let closure created from magic method accept named parameters

Implements GH-11348.

Closes GH-11364.

Use known zend_string pointer to check for equality instead of C strings (#11370)

* Compare __invoke magic method name with known zend_string pointer

* Compare __sleep/__wakeup magi

Use known zend_string pointer to check for equality instead of C strings (#11370)

* Compare __invoke magic method name with known zend_string pointer

* Compare __sleep/__wakeup magic method name with known zend_string pointer

show more ...

Allow arbitrary expressions in static variable initializer

Closes GH-9301

Revert GH-10300

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit 68ada76f9a659745f572539b72afa06fa75a866f.
his reverts commit 45384c6

Revert GH-10300

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit 68ada76f9a659745f572539b72afa06fa75a866f.
his reverts commit 45384c6e201eda9963e2fcc18946a9446230a2d6.
This reverts commit ef7fbfd71025f034b0bfcb413efd181ce798fc1b.
This reverts commit 9b9ea0d7c696f2990a159b2a2dafbc04547dc10f.
This reverts commit f15747c26be4a2330dc0cf3ea442f53f30f84cac.
This reverts commit e883ba93c40827fafd7868517eb48e04569f76ab.
This reverts commit 7e87551c3775d26e20b06a4032a00053db6452cc.
This reverts commit 921274d2b8966641a00c0a767ae40ba7187bdffc.
This reverts commit fc1f528e5e3ee45ab17ae8dcfad6a6422ff2002d.
This reverts commit 0961715cdafb5d39124667ff94f3b56453ce71f1.
This reverts commit a93f264526e1cdade71d887800c1c448c411bfdc.
This reverts commit 72dd94e1c6d29203b8f6473317f626e6d6d6fbdc.
This reverts commit 29b2dc89645e741f91cc920964432dccd2aaef14.
This reverts commit 05c7653bba7571852f5ce6fc0d220a1a829bc4c0.
This reverts commit 5190e5c260ee05e3f3c3d1168263a1a6637441d0.
This reverts commit 6b55bf228cb2da8705737d414f394950a92d8aae.
This reverts commit 184b4a12d3215d105720d005b31e365249e2eb21.
This reverts commit 4c31b7888a561e920fd3889ba8d99368f3c2d9e6.
This reverts commit d44e9680f080b4918cfed268b96f90ea35975617.
This reverts commit 4069a5c43f419d76e1254c8e49b4cad9968a408f.

show more ...

Zend/zend_closures: include cleanup

Fix a memory leak in tracig JIT when the same closure is called through Closure::call() and natively.

Closure::call() makes a temporary copy of original closure function, modifies its
sc

Fix a memory leak in tracig JIT when the same closure is called through Closure::call() and natively.

Closure::call() makes a temporary copy of original closure function, modifies its
scope, resets ZEND_ACC_CLOSURE flag and call it through zend_call_function().
As result the same function may be called with and without
ZEND_ACC_CLOSURE flag, that confuses JIT and may lead to memory leak or
even worse memory errors.

The patch allocates "fake" closure object and keep ZEND_ACC_CLOSURE flag
to always behave in the same way.

show more ...

Delay releasing closures until after observer end

Don’t reset func in zend_closure_internal_handler

The pointer is used in _zend_observe_fcall_begin().

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addea

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addeae.

show more ...

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate:

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate: in fact, accessing object handlers usually requires not-so-safe hacks.
While it is possible to swap handlers in a custom installed create_object handler, this mostly is tedious, as well as it requires allocating the object handlers struct at runtime, possibly caching it etc..

This allows extensions, which intend to observe other classes to install their own class handlers.
The life cycle of internal classes may now be simply observed by swapping the class handlers in post_startup stage.
The life cycle of userland classes may be observed by iterating over the new classes in zend_compile_file and zend_compile_string and then swapping their handlers.

In general, this would also be a first step in directly tying the object handlers to classes. Especially given that I am not aware of any case where the object handlers would be different between various instances of a given class.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

show more ...

Show function name when dumping fake closure (#9306)

Fixes GH-8962

Avoid using a stack allocated zend_function in Closure::call, to avoid prevent crashes on bailout

Having a stack allocated zend_function may cause crashes if the stack is polluted between ba

Avoid using a stack allocated zend_function in Closure::call, to avoid prevent crashes on bailout

Having a stack allocated zend_function may cause crashes if the stack is polluted between bailout and the actual unwinding in zend_observer_fcall_end_all.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

show more ...

Convert return type of various object handlers from int to zend_result (#8755)

Fix null static_variable_ptr for uncalled fake closures

Closes GH-8083
Closes GH-8109

Fix emory leak

Fixes oss-fuzz #44408

Fixed bug #81626

Backport of a8926474cb2c68cde2a7c0d19bcd95cdbda55ad2 to 7.4.

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.

show more ...

Always use direct pointer (not map_ptr slot) to access run_time_cache of a closure instance

Avoid non-immutable map_ptr indirection

Fix Closure::call() on internal method closure

In this case we should use the original internal handler. Otherwise
the trampoline will attempt to free the closure, but the function
b

Fix Closure::call() on internal method closure

In this case we should use the original internal handler. Otherwise
the trampoline will attempt to free the closure, but the function
being used is not actually part of a closure anymore.

show more ...

Fix use after free when rebinding __call closure

We would end up freeing the function name twice here, once for
the original closure, and once for the rebound one.

Rather than f

Fix use after free when rebinding __call closure

We would end up freeing the function name twice here, once for
the original closure, and once for the rebound one.

Rather than further special casing the zend_closure_call_magic
case, always addref the function_name for internal functions,
the same we do for userland functions. To compensate, we need to
release the original function name when creating from callable
or call frame.

Fixes oss-fuzz #37695.

show more ...

Set called_scope in __callStatic closure trampoline