Fix clobering of operand by error handler in assignment to string offset

In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #

Fix clobering of operand by error handler in assignment to string offset

In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002

show more ...

Use interned string for calling count() in Zend VM

Similar to f0dd79a7e415d8b1d4a3868a27975d6578c87961

Copied from GH-7695

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/__set().

RFC: https://wiki.php.net/rfc/deprecate_dynamic_properties

show more ...

Merge branch 'PHP-8.1'

* PHP-8.1:
Fixed bug #81631

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fixed bug #81631

Fixed bug #81631

We need to save the opline before fetching the operand, as it may
throw an undef var warning.

Merge branch 'PHP-8.1'

* PHP-8.1:
Partially fix handling of exceptions thrown in interrupt handlers

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Partially fix handling of exceptions thrown in interrupt handlers

Partially fix handling of exceptions thrown in interrupt handlers

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.

show more ...

Merge branch 'PHP-8.1'

* PHP-8.1:
Fix finally exception chaining on recursion

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fix finally exception chaining on recursion

Fix finally exception chaining on recursion

In this case zend_exception_set_previous() would destroy the
fast_call exception and further accesses on ex would be invalid.
We should on

Fix finally exception chaining on recursion

In this case zend_exception_set_previous() would destroy the
fast_call exception and further accesses on ex would be invalid.
We should only update ex if we update EG(exception).

Fixes oss-fuzz #40464.

show more ...

Drop FREE_OP_VAR_PTR() distinction

FREE_OP_VAR_PTR() is like FREE_OP(), but only frees VAR, rather
than VARs and TMPs. I don't think this distinction makes sense
anymore, as opcodes

Drop FREE_OP_VAR_PTR() distinction

FREE_OP_VAR_PTR() is like FREE_OP(), but only frees VAR, rather
than VARs and TMPs. I don't think this distinction makes sense
anymore, as opcodes using FREE_OP_VAR_PTR() generally only accept
VAR or CV. For the cases where other op types are accepted and
only freeing VAR is desired we already have FREE_OP_IF_VAR().

This drops FREE_OP_VAR_PTR(), leaving only FREE_OP() and
FREE_OP_IF_VAR().

show more ...

Merge branch 'PHP-8.1'

* PHP-8.1:
Fix inc/dec of undef var with error handler

Fix inc/dec of undef var with error handler

Set the variable to null after emitting the undef var notice
rather than before. This avoids an assertion failure if the var
is unset by t

Fix inc/dec of undef var with error handler

Set the variable to null after emitting the undef var notice
rather than before. This avoids an assertion failure if the var
is unset by the error handler.

The flip side is that this may cause a leak instead, but that's
the more harmless outcome.

Fixes oss-fuzz #36604.

show more ...

Merge branch 'PHP-8.1'

* PHP-8.1:
Don't free FETCH_W operand if GLOBAL_LOCK

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Don't free FETCH_W operand if GLOBAL_LOCK

Don't free FETCH_W operand if GLOBAL_LOCK

The error path performed the free unconditionally, while we should
not do it for GLOBAL_LOCK.

Fixes oss-fuzz #39868.

Merge branch 'PHP-8.1'

* PHP-8.1:
Fix duplicate undef warning in assign_dim_op

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fix duplicate undef warning in assign_dim_op

Fix duplicate undef warning in assign_dim_op

In case of auto-vivification we were fetching dim twice and as
such also emitting the undef var warning twice.

Merge branch 'PHP-8.1'

* PHP-8.1:
Create reference wrappers in SEND_UNPACK if necessary

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Create reference wrappers in SEND_UNPACK if necessary

Create reference wrappers in SEND_UNPACK if necessary

Even if we can't actually pass by reference, we still need to
create the REFERENCE wrapper to satisfy the calling convention.
Th

Create reference wrappers in SEND_UNPACK if necessary

Even if we can't actually pass by reference, we still need to
create the REFERENCE wrapper to satisfy the calling convention.
The particular test case would crash with JIT, because the existence
of the reference was assumed.

Fixes oss-fuzz #39440.

show more ...