Improve error messages mentioning parameters instead of arguments

Closes GH-5999

Don't handle missing value in zend_verify_arg_error()

This error condition is handled separately, never reaches this
function.

Accept zend_string instead of zval in zend_compile_string

Fix by-ref list assign LIST_W+MAKE_REF separation

Shift the responsibility for emitting MAKE_REF to the list assignment
code, to make sure that LIST_W and MAKE_REF are directly adjacent,

Fix by-ref list assign LIST_W+MAKE_REF separation

Shift the responsibility for emitting MAKE_REF to the list assignment
code, to make sure that LIST_W and MAKE_REF are directly adjacent,
and there are no opcodes in between that could modify the LIST_W
result.

Additionally, adjust the zend_wrong_string_offset() code to not
perform a loop over opcodes and assert that the next opcode is
a relevant one. The VM write-safety model requires this.

This is a followup to a07c1f56aac1c0f6c8334760009b678cbf9d6138
and the full fix for oss-fuzz #25352.

show more ...

Fix infinite loop on string offset during by-ref list assign

There is a deeper underlying issue here, in that the opcodes violate
VM write-fetch safety, but let's fix the infinite loop f

Fix infinite loop on string offset during by-ref list assign

There is a deeper underlying issue here, in that the opcodes violate
VM write-fetch safety, but let's fix the infinite loop first.

This fixes oss-fuzz #25352.

show more ...

Add zend_observer API

Closes GH-5857.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
Co-authored-by: Sammy Powers <sammyk@datadoghq.com>

Correctly report failure in zend_handle_undef_args()

And do the check before increfing the closure object, otherwise
we'd have to release it as well.

Fixes oss-fuzz #25313.

Remove unnecessary cache_slot arguments

zend_verify_type_error_common() no longer needs the cache_slot,
so drop it there and from all users.

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functio

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

show more ...

Fix leak in typed reference assignment

We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.

Property handle read_property exception in fetch_property_address

Otherwise we leak (and corrupt uninitialized_zval).

Fixed bug #79947

Move the FREE_OP for op_data out of the zend_binary_assign_op_dim_slow()
slow path, so it can be used by the other error path as well. This
makes ASSIGN_DIM_OP struc

Fixed bug #79947

Move the FREE_OP for op_data out of the zend_binary_assign_op_dim_slow()
slow path, so it can be used by the other error path as well. This
makes ASSIGN_DIM_OP structurally more similar to ASSIGN_DIM.

show more ...

Promote "undefined array key" notice to warning

This implements the last remaining part of the
https://wiki.php.net/rfc/engine_warnings RFC.

Closes GH-5927.

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument nam

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument name. For now, it is looked up by linear scan and
runtime cached.
* This may leave UNDEF arguments on the stack. To avoid having
to deal with them in other places, a CHECK_UNDEF_ARGS opcode
is used to either replace them with defaults, or error.
* For variadic functions, EX(extra_named_params) are collected
and need to be freed based on ZEND_CALL_HAS_EXTRA_NAMED_PARAMS.

RFC: https://wiki.php.net/rfc/named_params

Closes GH-5357.

show more ...

Make check in RECV_VARIADIC more precise

Fetch arg_info only once (it's always the same one...) and check
ZEND_TYPE_IS_SET on it, rather than checking if *any* parameter
has a type.

Implement 'Saner Numeric Strings' RFC:

RFC: https://wiki.php.net/rfc/saner-numeric-strings

This removes the -1 allow_error mode from is_numeric_string functions and replaces it by

Implement 'Saner Numeric Strings' RFC:

RFC: https://wiki.php.net/rfc/saner-numeric-strings

This removes the -1 allow_error mode from is_numeric_string functions and replaces it by
a trailing boolean out argument to preserve BC in a couple of places.

Most of the changes can be resumed to "numeric" strings which emitted a E_NOTICE now emit
a E_WARNING and "numeric" strings which emitted a E_WARNING now throw a TypeError.

This mostly affects:
- String offsets
- Arithmetic operations
- Bitwise operations

Closes GH-5762

show more ...

Give zend_pass_function an arginfo

Now that the ZEND_ACC_VARIADIC flag is set, we should also make
sure there is a variadic arg that can be looked up.

Check for missing arginfo arguments

Internal functions error when too many arguments are passed. Make
this part of the verification we do in debug builds. This will
help avoid cases

Check for missing arginfo arguments

Internal functions error when too many arguments are passed. Make
this part of the verification we do in debug builds. This will
help avoid cases where an argument is missing in the stubs,
as recently encountered in 6d96f0f.

show more ...

Remove type argument from zend_get_zval_ptr

As pointed out by Levi, this is unused, and we already changed
the signature of this function for PHP 8.

Review the usage of apostrophes in error messages

Closes GH-5590

Use dedicated function for illegal offset type error

Remove FREE_UNFETCHED concept

In master normal FREE_OPs work like FREE_UNFETCHED_OP used to, so
there is no point in keeping this distinction anymore, it's just
confusing.

Fixed bug #79793

Make sure the string key is not released while throwing the
undefined index warning.

Fixed bug #79791

First throw the undefined variable warning, and then set the
variable to null. Otherwise we're not guaranteed that it's
actually null afterwards.

JIT support for undefined index/offset handling