xref: /PHP-5.4/Zend/zend_vm_execute.h (revision e030efa4)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@zend.com>                                |
16    |          Zeev Suraski <zeev@zend.com>                                |
17    |          Dmitry Stogov <dmitry@zend.com>                             |
18    +----------------------------------------------------------------------+
19 */
20 
21 #ifdef ZEND_WIN32
22 # pragma warning(once : 4101)
23 #endif
24 static user_opcode_handler_t zend_user_opcode_handlers[256] = {
25 	(user_opcode_handler_t)NULL,
26 	(user_opcode_handler_t)NULL,
27 	(user_opcode_handler_t)NULL,
28 	(user_opcode_handler_t)NULL,
29 	(user_opcode_handler_t)NULL,
30 	(user_opcode_handler_t)NULL,
31 	(user_opcode_handler_t)NULL,
32 	(user_opcode_handler_t)NULL,
33 	(user_opcode_handler_t)NULL,
34 	(user_opcode_handler_t)NULL,
35 	(user_opcode_handler_t)NULL,
36 	(user_opcode_handler_t)NULL,
37 	(user_opcode_handler_t)NULL,
38 	(user_opcode_handler_t)NULL,
39 	(user_opcode_handler_t)NULL,
40 	(user_opcode_handler_t)NULL,
41 	(user_opcode_handler_t)NULL,
42 	(user_opcode_handler_t)NULL,
43 	(user_opcode_handler_t)NULL,
44 	(user_opcode_handler_t)NULL,
45 	(user_opcode_handler_t)NULL,
46 	(user_opcode_handler_t)NULL,
47 	(user_opcode_handler_t)NULL,
48 	(user_opcode_handler_t)NULL,
49 	(user_opcode_handler_t)NULL,
50 	(user_opcode_handler_t)NULL,
51 	(user_opcode_handler_t)NULL,
52 	(user_opcode_handler_t)NULL,
53 	(user_opcode_handler_t)NULL,
54 	(user_opcode_handler_t)NULL,
55 	(user_opcode_handler_t)NULL,
56 	(user_opcode_handler_t)NULL,
57 	(user_opcode_handler_t)NULL,
58 	(user_opcode_handler_t)NULL,
59 	(user_opcode_handler_t)NULL,
60 	(user_opcode_handler_t)NULL,
61 	(user_opcode_handler_t)NULL,
62 	(user_opcode_handler_t)NULL,
63 	(user_opcode_handler_t)NULL,
64 	(user_opcode_handler_t)NULL,
65 	(user_opcode_handler_t)NULL,
66 	(user_opcode_handler_t)NULL,
67 	(user_opcode_handler_t)NULL,
68 	(user_opcode_handler_t)NULL,
69 	(user_opcode_handler_t)NULL,
70 	(user_opcode_handler_t)NULL,
71 	(user_opcode_handler_t)NULL,
72 	(user_opcode_handler_t)NULL,
73 	(user_opcode_handler_t)NULL,
74 	(user_opcode_handler_t)NULL,
75 	(user_opcode_handler_t)NULL,
76 	(user_opcode_handler_t)NULL,
77 	(user_opcode_handler_t)NULL,
78 	(user_opcode_handler_t)NULL,
79 	(user_opcode_handler_t)NULL,
80 	(user_opcode_handler_t)NULL,
81 	(user_opcode_handler_t)NULL,
82 	(user_opcode_handler_t)NULL,
83 	(user_opcode_handler_t)NULL,
84 	(user_opcode_handler_t)NULL,
85 	(user_opcode_handler_t)NULL,
86 	(user_opcode_handler_t)NULL,
87 	(user_opcode_handler_t)NULL,
88 	(user_opcode_handler_t)NULL,
89 	(user_opcode_handler_t)NULL,
90 	(user_opcode_handler_t)NULL,
91 	(user_opcode_handler_t)NULL,
92 	(user_opcode_handler_t)NULL,
93 	(user_opcode_handler_t)NULL,
94 	(user_opcode_handler_t)NULL,
95 	(user_opcode_handler_t)NULL,
96 	(user_opcode_handler_t)NULL,
97 	(user_opcode_handler_t)NULL,
98 	(user_opcode_handler_t)NULL,
99 	(user_opcode_handler_t)NULL,
100 	(user_opcode_handler_t)NULL,
101 	(user_opcode_handler_t)NULL,
102 	(user_opcode_handler_t)NULL,
103 	(user_opcode_handler_t)NULL,
104 	(user_opcode_handler_t)NULL,
105 	(user_opcode_handler_t)NULL,
106 	(user_opcode_handler_t)NULL,
107 	(user_opcode_handler_t)NULL,
108 	(user_opcode_handler_t)NULL,
109 	(user_opcode_handler_t)NULL,
110 	(user_opcode_handler_t)NULL,
111 	(user_opcode_handler_t)NULL,
112 	(user_opcode_handler_t)NULL,
113 	(user_opcode_handler_t)NULL,
114 	(user_opcode_handler_t)NULL,
115 	(user_opcode_handler_t)NULL,
116 	(user_opcode_handler_t)NULL,
117 	(user_opcode_handler_t)NULL,
118 	(user_opcode_handler_t)NULL,
119 	(user_opcode_handler_t)NULL,
120 	(user_opcode_handler_t)NULL,
121 	(user_opcode_handler_t)NULL,
122 	(user_opcode_handler_t)NULL,
123 	(user_opcode_handler_t)NULL,
124 	(user_opcode_handler_t)NULL,
125 	(user_opcode_handler_t)NULL,
126 	(user_opcode_handler_t)NULL,
127 	(user_opcode_handler_t)NULL,
128 	(user_opcode_handler_t)NULL,
129 	(user_opcode_handler_t)NULL,
130 	(user_opcode_handler_t)NULL,
131 	(user_opcode_handler_t)NULL,
132 	(user_opcode_handler_t)NULL,
133 	(user_opcode_handler_t)NULL,
134 	(user_opcode_handler_t)NULL,
135 	(user_opcode_handler_t)NULL,
136 	(user_opcode_handler_t)NULL,
137 	(user_opcode_handler_t)NULL,
138 	(user_opcode_handler_t)NULL,
139 	(user_opcode_handler_t)NULL,
140 	(user_opcode_handler_t)NULL,
141 	(user_opcode_handler_t)NULL,
142 	(user_opcode_handler_t)NULL,
143 	(user_opcode_handler_t)NULL,
144 	(user_opcode_handler_t)NULL,
145 	(user_opcode_handler_t)NULL,
146 	(user_opcode_handler_t)NULL,
147 	(user_opcode_handler_t)NULL,
148 	(user_opcode_handler_t)NULL,
149 	(user_opcode_handler_t)NULL,
150 	(user_opcode_handler_t)NULL,
151 	(user_opcode_handler_t)NULL,
152 	(user_opcode_handler_t)NULL,
153 	(user_opcode_handler_t)NULL,
154 	(user_opcode_handler_t)NULL,
155 	(user_opcode_handler_t)NULL,
156 	(user_opcode_handler_t)NULL,
157 	(user_opcode_handler_t)NULL,
158 	(user_opcode_handler_t)NULL,
159 	(user_opcode_handler_t)NULL,
160 	(user_opcode_handler_t)NULL,
161 	(user_opcode_handler_t)NULL,
162 	(user_opcode_handler_t)NULL,
163 	(user_opcode_handler_t)NULL,
164 	(user_opcode_handler_t)NULL,
165 	(user_opcode_handler_t)NULL,
166 	(user_opcode_handler_t)NULL,
167 	(user_opcode_handler_t)NULL,
168 	(user_opcode_handler_t)NULL,
169 	(user_opcode_handler_t)NULL,
170 	(user_opcode_handler_t)NULL,
171 	(user_opcode_handler_t)NULL,
172 	(user_opcode_handler_t)NULL,
173 	(user_opcode_handler_t)NULL,
174 	(user_opcode_handler_t)NULL,
175 	(user_opcode_handler_t)NULL,
176 	(user_opcode_handler_t)NULL,
177 	(user_opcode_handler_t)NULL,
178 	(user_opcode_handler_t)NULL,
179 	(user_opcode_handler_t)NULL,
180 	(user_opcode_handler_t)NULL,
181 	(user_opcode_handler_t)NULL,
182 	(user_opcode_handler_t)NULL,
183 	(user_opcode_handler_t)NULL,
184 	(user_opcode_handler_t)NULL,
185 	(user_opcode_handler_t)NULL,
186 	(user_opcode_handler_t)NULL,
187 	(user_opcode_handler_t)NULL,
188 	(user_opcode_handler_t)NULL,
189 	(user_opcode_handler_t)NULL,
190 	(user_opcode_handler_t)NULL,
191 	(user_opcode_handler_t)NULL,
192 	(user_opcode_handler_t)NULL,
193 	(user_opcode_handler_t)NULL,
194 	(user_opcode_handler_t)NULL,
195 	(user_opcode_handler_t)NULL,
196 	(user_opcode_handler_t)NULL,
197 	(user_opcode_handler_t)NULL,
198 	(user_opcode_handler_t)NULL,
199 	(user_opcode_handler_t)NULL,
200 	(user_opcode_handler_t)NULL,
201 	(user_opcode_handler_t)NULL,
202 	(user_opcode_handler_t)NULL,
203 	(user_opcode_handler_t)NULL,
204 	(user_opcode_handler_t)NULL,
205 	(user_opcode_handler_t)NULL,
206 	(user_opcode_handler_t)NULL,
207 	(user_opcode_handler_t)NULL,
208 	(user_opcode_handler_t)NULL,
209 	(user_opcode_handler_t)NULL,
210 	(user_opcode_handler_t)NULL,
211 	(user_opcode_handler_t)NULL,
212 	(user_opcode_handler_t)NULL,
213 	(user_opcode_handler_t)NULL,
214 	(user_opcode_handler_t)NULL,
215 	(user_opcode_handler_t)NULL,
216 	(user_opcode_handler_t)NULL,
217 	(user_opcode_handler_t)NULL,
218 	(user_opcode_handler_t)NULL,
219 	(user_opcode_handler_t)NULL,
220 	(user_opcode_handler_t)NULL,
221 	(user_opcode_handler_t)NULL,
222 	(user_opcode_handler_t)NULL,
223 	(user_opcode_handler_t)NULL,
224 	(user_opcode_handler_t)NULL,
225 	(user_opcode_handler_t)NULL,
226 	(user_opcode_handler_t)NULL,
227 	(user_opcode_handler_t)NULL,
228 	(user_opcode_handler_t)NULL,
229 	(user_opcode_handler_t)NULL,
230 	(user_opcode_handler_t)NULL,
231 	(user_opcode_handler_t)NULL,
232 	(user_opcode_handler_t)NULL,
233 	(user_opcode_handler_t)NULL,
234 	(user_opcode_handler_t)NULL,
235 	(user_opcode_handler_t)NULL,
236 	(user_opcode_handler_t)NULL,
237 	(user_opcode_handler_t)NULL,
238 	(user_opcode_handler_t)NULL,
239 	(user_opcode_handler_t)NULL,
240 	(user_opcode_handler_t)NULL,
241 	(user_opcode_handler_t)NULL,
242 	(user_opcode_handler_t)NULL,
243 	(user_opcode_handler_t)NULL,
244 	(user_opcode_handler_t)NULL,
245 	(user_opcode_handler_t)NULL,
246 	(user_opcode_handler_t)NULL,
247 	(user_opcode_handler_t)NULL,
248 	(user_opcode_handler_t)NULL,
249 	(user_opcode_handler_t)NULL,
250 	(user_opcode_handler_t)NULL,
251 	(user_opcode_handler_t)NULL,
252 	(user_opcode_handler_t)NULL,
253 	(user_opcode_handler_t)NULL,
254 	(user_opcode_handler_t)NULL,
255 	(user_opcode_handler_t)NULL,
256 	(user_opcode_handler_t)NULL,
257 	(user_opcode_handler_t)NULL,
258 	(user_opcode_handler_t)NULL,
259 	(user_opcode_handler_t)NULL,
260 	(user_opcode_handler_t)NULL,
261 	(user_opcode_handler_t)NULL,
262 	(user_opcode_handler_t)NULL,
263 	(user_opcode_handler_t)NULL,
264 	(user_opcode_handler_t)NULL,
265 	(user_opcode_handler_t)NULL,
266 	(user_opcode_handler_t)NULL,
267 	(user_opcode_handler_t)NULL,
268 	(user_opcode_handler_t)NULL,
269 	(user_opcode_handler_t)NULL,
270 	(user_opcode_handler_t)NULL,
271 	(user_opcode_handler_t)NULL,
272 	(user_opcode_handler_t)NULL,
273 	(user_opcode_handler_t)NULL,
274 	(user_opcode_handler_t)NULL,
275 	(user_opcode_handler_t)NULL,
276 	(user_opcode_handler_t)NULL,
277 	(user_opcode_handler_t)NULL,
278 	(user_opcode_handler_t)NULL,
279 	(user_opcode_handler_t)NULL,
280 	(user_opcode_handler_t)NULL
281 };
282 
283 static zend_uchar zend_user_opcodes[256] = {0,
284 	1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,
285 	17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,
286 	33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,
287 	49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,
288 	65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,
289 	81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,
290 	97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,
291 	113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,
292 	129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,
293 	145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,
294 	161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,
295 	177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,
296 	193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,
297 	209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,
298 	225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,
299 	241,242,243,244,245,246,247,248,249,250,251,252,253,254,255
300 };
301 
302 static opcode_handler_t zend_vm_get_opcode_handler(zend_uchar opcode, zend_op* op);
303 
304 
305 #undef OPLINE
306 #undef DCL_OPLINE
307 #undef USE_OPLINE
308 #undef LOAD_OPLINE
309 #undef SAVE_OPLINE
310 #define OPLINE EX(opline)
311 #define DCL_OPLINE
312 #define USE_OPLINE zend_op *opline = EX(opline);
313 #define LOAD_OPLINE()
314 #define SAVE_OPLINE()
315 #undef CHECK_EXCEPTION
316 #undef HANDLE_EXCEPTION
317 #undef HANDLE_EXCEPTION_LEAVE
318 #define CHECK_EXCEPTION() LOAD_OPLINE()
319 #define HANDLE_EXCEPTION() LOAD_OPLINE(); ZEND_VM_CONTINUE()
320 #define HANDLE_EXCEPTION_LEAVE() LOAD_OPLINE(); ZEND_VM_LEAVE()
321 #define LOAD_REGS()
322 #define ZEND_VM_CONTINUE()         return 0
323 #define ZEND_VM_RETURN()           return 1
324 #define ZEND_VM_ENTER()            return 2
325 #define ZEND_VM_LEAVE()            return 3
326 #define ZEND_VM_DISPATCH(opcode, opline) return zend_vm_get_opcode_handler(opcode, opline)(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
327 
328 #define ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_INTERNAL execute_data TSRMLS_CC
329 #undef EX
330 #define EX(element) execute_data->element
331 
332 #undef EX_CV
333 #define EX_CV(var) EX(CVs)[var]
334 #undef EX_CVs
335 #define EX_CVs() EX(CVs)
336 #undef EX_T
337 #define EX_T(offset) (*(temp_variable *)((char *) EX(Ts) + offset))
338 #undef EX_Ts
339 #define EX_Ts() EX(Ts)
340 
341 
execute(zend_op_array * op_array TSRMLS_DC)342 ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
343 {
344 	DCL_OPLINE
345 	zend_execute_data *execute_data;
346 	zend_bool nested = 0;
347 	zend_bool original_in_execution = EG(in_execution);
348 
349 
350 	if (EG(exception)) {
351 		return;
352 	}
353 
354 	EG(in_execution) = 1;
355 
356 zend_vm_enter:
357 	/* Initialize execute_data */
358 	execute_data = (zend_execute_data *)zend_vm_stack_alloc(
359 		ZEND_MM_ALIGNED_SIZE(sizeof(zend_execute_data)) +
360 		ZEND_MM_ALIGNED_SIZE(sizeof(zval**) * op_array->last_var * (EG(active_symbol_table) ? 1 : 2)) +
361 		ZEND_MM_ALIGNED_SIZE(sizeof(temp_variable)) * op_array->T TSRMLS_CC);
362 
363 	EX(CVs) = (zval***)((char*)execute_data + ZEND_MM_ALIGNED_SIZE(sizeof(zend_execute_data)));
364 	memset(EX(CVs), 0, sizeof(zval**) * op_array->last_var);
365 	EX(Ts) = (temp_variable *)(((char*)EX(CVs)) + ZEND_MM_ALIGNED_SIZE(sizeof(zval**) * op_array->last_var * (EG(active_symbol_table) ? 1 : 2)));
366 	EX(fbc) = NULL;
367 	EX(called_scope) = NULL;
368 	EX(object) = NULL;
369 	EX(old_error_reporting) = NULL;
370 	EX(op_array) = op_array;
371 	EX(symbol_table) = EG(active_symbol_table);
372 	EX(prev_execute_data) = EG(current_execute_data);
373 	EG(current_execute_data) = execute_data;
374 	EX(nested) = nested;
375 	nested = 1;
376 
377 	LOAD_REGS();
378 
379 	if (!op_array->run_time_cache && op_array->last_cache_slot) {
380 		op_array->run_time_cache = ecalloc(op_array->last_cache_slot, sizeof(void*));
381 	}
382 
383 	if (op_array->this_var != -1 && EG(This)) {
384  		Z_ADDREF_P(EG(This)); /* For $this pointer */
385 		if (!EG(active_symbol_table)) {
386 			EX_CV(op_array->this_var) = (zval**)EX_CVs() + (op_array->last_var + op_array->this_var);
387 			*EX_CV(op_array->this_var) = EG(This);
388 		} else {
389 			if (zend_hash_add(EG(active_symbol_table), "this", sizeof("this"), &EG(This), sizeof(zval *), (void**)&EX_CV(op_array->this_var))==FAILURE) {
390 				Z_DELREF_P(EG(This));
391 			}
392 		}
393 	}
394 
395 	EX(opline) = UNEXPECTED((op_array->fn_flags & ZEND_ACC_INTERACTIVE) != 0) && EG(start_op) ? EG(start_op) : op_array->opcodes;
396 	EG(opline_ptr) = &EX(opline);
397 	LOAD_OPLINE();
398 
399 	EX(function_state).function = (zend_function *) op_array;
400 	EX(function_state).arguments = NULL;
401 
402 	while (1) {
403     	int ret;
404 #ifdef ZEND_WIN32
405 		if (EG(timed_out)) {
406 			zend_timeout(0);
407 		}
408 #endif
409 
410 		if ((ret = OPLINE->handler(execute_data TSRMLS_CC)) > 0) {
411 			switch (ret) {
412 				case 1:
413 					EG(in_execution) = original_in_execution;
414 					return;
415 				case 2:
416 					op_array = EG(active_op_array);
417 					goto zend_vm_enter;
418 				case 3:
419 					execute_data = EG(current_execute_data);
420 				default:
421 					break;
422 			}
423 		}
424 
425 	}
426 	zend_error_noreturn(E_ERROR, "Arrived at end of main loop which shouldn't happen");
427 }
428 
ZEND_JMP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)429 static int ZEND_FASTCALL  ZEND_JMP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
430 {
431 	USE_OPLINE
432 
433 #if DEBUG_ZEND>=2
434 	printf("Jumping to %d\n", opline->op1.opline_num);
435 #endif
436 	ZEND_VM_SET_OPCODE(opline->op1.jmp_addr);
437 	ZEND_VM_CONTINUE(); /* CHECK_ME */
438 }
439 
ZEND_INIT_STRING_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)440 static int ZEND_FASTCALL  ZEND_INIT_STRING_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
441 {
442 	USE_OPLINE
443 	zval *tmp = &EX_T(opline->result.var).tmp_var;
444 
445 	SAVE_OPLINE();
446 	tmp->value.str.val = emalloc(1);
447 	tmp->value.str.val[0] = 0;
448 	tmp->value.str.len = 0;
449 	Z_SET_REFCOUNT_P(tmp, 1);
450 	tmp->type = IS_STRING;
451 	Z_UNSET_ISREF_P(tmp);
452 	/*CHECK_EXCEPTION();*/
453 	ZEND_VM_NEXT_OPCODE();
454 }
455 
zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)456 static int ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
457 {
458 	zend_bool nested;
459 	zend_op_array *op_array = EX(op_array);
460 
461 	EG(current_execute_data) = EX(prev_execute_data);
462 	EG(opline_ptr) = NULL;
463 	if (!EG(active_symbol_table)) {
464 		zval ***cv = EX_CVs();
465 		zval ***end = cv + op_array->last_var;
466 		while (cv != end) {
467 			if (*cv) {
468 				zval_ptr_dtor(*cv);
469 			}
470 			cv++;
471 		}
472 	}
473 
474 	if ((op_array->fn_flags & ZEND_ACC_CLOSURE) && op_array->prototype) {
475 		zval_ptr_dtor((zval**)&op_array->prototype);
476 	}
477 
478 	nested = EX(nested);
479 
480 	zend_vm_stack_free(execute_data TSRMLS_CC);
481 
482 	if (nested) {
483 		execute_data = EG(current_execute_data);
484 	}
485 	if (nested) {
486 		USE_OPLINE
487 
488 		LOAD_REGS();
489 		LOAD_OPLINE();
490 		if (UNEXPECTED(opline->opcode == ZEND_INCLUDE_OR_EVAL)) {
491 
492 			EX(function_state).function = (zend_function *) EX(op_array);
493 			EX(function_state).arguments = NULL;
494 			EX(object) = EX(current_object);
495 
496 			EG(opline_ptr) = &EX(opline);
497 			EG(active_op_array) = EX(op_array);
498 			EG(return_value_ptr_ptr) = EX(original_return_value);
499 			destroy_op_array(op_array TSRMLS_CC);
500 			efree(op_array);
501 			if (UNEXPECTED(EG(exception) != NULL)) {
502 				zend_throw_exception_internal(NULL TSRMLS_CC);
503 				HANDLE_EXCEPTION_LEAVE();
504 			} else if (RETURN_VALUE_USED(opline)) {
505 				if (!EX_T(opline->result.var).var.ptr) { /* there was no return statement */
506 					zval *retval;
507 
508 					ALLOC_ZVAL(retval);
509 					ZVAL_BOOL(retval, 1);
510 					INIT_PZVAL(retval);
511 					EX_T(opline->result.var).var.ptr = retval;
512 				}
513 			}
514 
515 			ZEND_VM_INC_OPCODE();
516 			ZEND_VM_LEAVE();
517 		} else {
518 
519 			EG(opline_ptr) = &EX(opline);
520 			EG(active_op_array) = EX(op_array);
521 			EG(return_value_ptr_ptr) = EX(original_return_value);
522 			if (EG(active_symbol_table)) {
523 				if (EG(symtable_cache_ptr)>=EG(symtable_cache_limit)) {
524 					zend_hash_destroy(EG(active_symbol_table));
525 					FREE_HASHTABLE(EG(active_symbol_table));
526 				} else {
527 					/* clean before putting into the cache, since clean
528 					   could call dtors, which could use cached hash */
529 					zend_hash_clean(EG(active_symbol_table));
530 					*(++EG(symtable_cache_ptr)) = EG(active_symbol_table);
531 				}
532 			}
533 			EG(active_symbol_table) = EX(symbol_table);
534 
535 			EX(function_state).function = (zend_function *) EX(op_array);
536 			EX(function_state).arguments = NULL;
537 
538 			if (EG(This)) {
539 				if (UNEXPECTED(EG(exception) != NULL) && IS_CTOR_CALL(EX(called_scope))) {
540 					if (IS_CTOR_USED(EX(called_scope))) {
541 						Z_DELREF_P(EG(This));
542 					}
543 					if (Z_REFCOUNT_P(EG(This)) == 1) {
544 						zend_object_store_ctor_failed(EG(This) TSRMLS_CC);
545 					}
546 				}
547 				zval_ptr_dtor(&EG(This));
548 			}
549 			EG(This) = EX(current_this);
550 			EG(scope) = EX(current_scope);
551 			EG(called_scope) = EX(current_called_scope);
552 
553 			EX(object) = EX(current_object);
554 			EX(called_scope) = DECODE_CTOR(EX(called_scope));
555 
556 			zend_vm_stack_clear_multiple(TSRMLS_C);
557 
558 			if (UNEXPECTED(EG(exception) != NULL)) {
559 				zend_throw_exception_internal(NULL TSRMLS_CC);
560 				if (RETURN_VALUE_USED(opline) && EX_T(opline->result.var).var.ptr) {
561 					zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
562 				}
563 				HANDLE_EXCEPTION_LEAVE();
564 			}
565 
566 			ZEND_VM_INC_OPCODE();
567 			ZEND_VM_LEAVE();
568 		}
569 	}
570 	ZEND_VM_RETURN();
571 }
572 
zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)573 static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
574 {
575 	USE_OPLINE
576 	zend_bool should_change_scope = 0;
577 	zend_function *fbc = EX(function_state).function;
578 
579 	SAVE_OPLINE();
580 	if (UNEXPECTED((fbc->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) != 0)) {
581 		if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_ABSTRACT) != 0)) {
582 			zend_error_noreturn(E_ERROR, "Cannot call abstract method %s::%s()", fbc->common.scope->name, fbc->common.function_name);
583 			CHECK_EXCEPTION();
584 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
585 		}
586 		if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_DEPRECATED) != 0)) {
587 			zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
588 				fbc->common.scope ? fbc->common.scope->name : "",
589 				fbc->common.scope ? "::" : "",
590 				fbc->common.function_name);
591 		}
592 	}
593 	if (fbc->common.scope &&
594 		!(fbc->common.fn_flags & ZEND_ACC_STATIC) &&
595 		!EX(object)) {
596 
597 		if (fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
598 			/* FIXME: output identifiers properly */
599 			zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically", fbc->common.scope->name, fbc->common.function_name);
600 		} else {
601 			/* FIXME: output identifiers properly */
602 			/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
603 			zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically", fbc->common.scope->name, fbc->common.function_name);
604 		}
605 	}
606 
607 	if (fbc->type == ZEND_USER_FUNCTION || fbc->common.scope) {
608 		should_change_scope = 1;
609 		EX(current_this) = EG(This);
610 		EX(current_scope) = EG(scope);
611 		EX(current_called_scope) = EG(called_scope);
612 		EG(This) = EX(object);
613 		EG(scope) = (fbc->type == ZEND_USER_FUNCTION || !EX(object)) ? fbc->common.scope : NULL;
614 		EG(called_scope) = EX(called_scope);
615 	}
616 
617 	zend_arg_types_stack_3_pop(&EG(arg_types_stack), &EX(called_scope), &EX(current_object), &EX(fbc));
618 	EX(function_state).arguments = zend_vm_stack_push_args(opline->extended_value TSRMLS_CC);
619 	LOAD_OPLINE();
620 
621 	if (fbc->type == ZEND_INTERNAL_FUNCTION) {
622 		temp_variable *ret = &EX_T(opline->result.var);
623 
624 		if (fbc->common.arg_info) {
625 			zend_uint i=0;
626 			zval **p = (zval**)EX(function_state).arguments;
627 			ulong arg_count = opline->extended_value;
628 
629 			while (arg_count>0) {
630 				zend_verify_arg_type(fbc, ++i, *(p-arg_count), 0 TSRMLS_CC);
631 				arg_count--;
632 			}
633 		}
634 
635 		if (EXPECTED(EG(exception) == NULL)) {
636 			MAKE_STD_ZVAL(ret->var.ptr);
637 			ZVAL_NULL(ret->var.ptr);
638 			ret->var.ptr_ptr = &ret->var.ptr;
639 			ret->var.fcall_returned_reference = (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
640 
641 			if (!zend_execute_internal) {
642 				/* saves one function call if zend_execute_internal is not used */
643 				fbc->internal_function.handler(opline->extended_value, ret->var.ptr, (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) ? &ret->var.ptr : NULL, EX(object), RETURN_VALUE_USED(opline) TSRMLS_CC);
644 			} else {
645 				zend_execute_internal(execute_data, RETURN_VALUE_USED(opline) TSRMLS_CC);
646 			}
647 
648 			if (!RETURN_VALUE_USED(opline)) {
649 				zval_ptr_dtor(&ret->var.ptr);
650 			}
651 		} else if (RETURN_VALUE_USED(opline)) {
652 			EX_T(opline->result.var).var.ptr = NULL;
653 		}
654 	} else if (fbc->type == ZEND_USER_FUNCTION) {
655 		EX(original_return_value) = EG(return_value_ptr_ptr);
656 		EG(active_symbol_table) = NULL;
657 		EG(active_op_array) = &fbc->op_array;
658 		EG(return_value_ptr_ptr) = NULL;
659 		if (RETURN_VALUE_USED(opline)) {
660 			temp_variable *ret = &EX_T(opline->result.var);
661 
662 			ret->var.ptr = NULL;
663 			EG(return_value_ptr_ptr) = &ret->var.ptr;
664 			ret->var.ptr_ptr = &ret->var.ptr;
665 			ret->var.fcall_returned_reference = (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
666 		}
667 
668 		if (EXPECTED(zend_execute == execute)) {
669 			if (EXPECTED(EG(exception) == NULL)) {
670 				ZEND_VM_ENTER();
671 			}
672 		} else {
673 			zend_execute(EG(active_op_array) TSRMLS_CC);
674 		}
675 
676 		EG(opline_ptr) = &EX(opline);
677 		EG(active_op_array) = EX(op_array);
678 		EG(return_value_ptr_ptr) = EX(original_return_value);
679 		if (EG(active_symbol_table)) {
680 			if (EG(symtable_cache_ptr)>=EG(symtable_cache_limit)) {
681 				zend_hash_destroy(EG(active_symbol_table));
682 				FREE_HASHTABLE(EG(active_symbol_table));
683 			} else {
684 				/* clean before putting into the cache, since clean
685 				   could call dtors, which could use cached hash */
686 				zend_hash_clean(EG(active_symbol_table));
687 				*(++EG(symtable_cache_ptr)) = EG(active_symbol_table);
688 			}
689 		}
690 		EG(active_symbol_table) = EX(symbol_table);
691 	} else { /* ZEND_OVERLOADED_FUNCTION */
692 		MAKE_STD_ZVAL(EX_T(opline->result.var).var.ptr);
693 		ZVAL_NULL(EX_T(opline->result.var).var.ptr);
694 
695 			/* Not sure what should be done here if it's a static method */
696 		if (EXPECTED(EX(object) != NULL)) {
697 			Z_OBJ_HT_P(EX(object))->call_method(fbc->common.function_name, opline->extended_value, EX_T(opline->result.var).var.ptr, &EX_T(opline->result.var).var.ptr, EX(object), RETURN_VALUE_USED(opline) TSRMLS_CC);
698 		} else {
699 			zend_error_noreturn(E_ERROR, "Cannot call overloaded function for non-object");
700 		}
701 
702 		if (fbc->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) {
703 			efree((char*)fbc->common.function_name);
704 		}
705 		efree(fbc);
706 
707 		if (!RETURN_VALUE_USED(opline)) {
708 			zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
709 		} else {
710 			Z_UNSET_ISREF_P(EX_T(opline->result.var).var.ptr);
711 			Z_SET_REFCOUNT_P(EX_T(opline->result.var).var.ptr, 1);
712 			EX_T(opline->result.var).var.fcall_returned_reference = 0;
713 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
714 		}
715 	}
716 
717 	EX(function_state).function = (zend_function *) EX(op_array);
718 	EX(function_state).arguments = NULL;
719 
720 	if (should_change_scope) {
721 		if (EG(This)) {
722 			if (UNEXPECTED(EG(exception) != NULL) && IS_CTOR_CALL(EX(called_scope))) {
723 				if (IS_CTOR_USED(EX(called_scope))) {
724 					Z_DELREF_P(EG(This));
725 				}
726 				if (Z_REFCOUNT_P(EG(This)) == 1) {
727 					zend_object_store_ctor_failed(EG(This) TSRMLS_CC);
728 				}
729 			}
730 			zval_ptr_dtor(&EG(This));
731 		}
732 		EG(This) = EX(current_this);
733 		EG(scope) = EX(current_scope);
734 		EG(called_scope) = EX(current_called_scope);
735 	}
736 
737 	EX(object) = EX(current_object);
738 	EX(called_scope) = DECODE_CTOR(EX(called_scope));
739 
740 	zend_vm_stack_clear_multiple(TSRMLS_C);
741 
742 	if (UNEXPECTED(EG(exception) != NULL)) {
743 		zend_throw_exception_internal(NULL TSRMLS_CC);
744 		if (RETURN_VALUE_USED(opline) && EX_T(opline->result.var).var.ptr) {
745 			zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
746 		}
747 		HANDLE_EXCEPTION();
748 	}
749 
750 	ZEND_VM_NEXT_OPCODE();
751 }
752 
ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)753 static int ZEND_FASTCALL  ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
754 {
755 	EX(function_state).function = EX(fbc);
756 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
757 }
758 
ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)759 static int ZEND_FASTCALL  ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
760 {
761 	USE_OPLINE
762 	zend_uint arg_num = opline->op1.num;
763 	zval **param = zend_vm_stack_get_arg(arg_num TSRMLS_CC);
764 
765 	SAVE_OPLINE();
766 	if (UNEXPECTED(param == NULL)) {
767 		if (zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, NULL, opline->extended_value TSRMLS_CC)) {
768 			const char *space;
769 			const char *class_name;
770 			zend_execute_data *ptr;
771 
772 			if (EG(active_op_array)->scope) {
773 				class_name = EG(active_op_array)->scope->name;
774 				space = "::";
775 			} else {
776 				class_name = space = "";
777 			}
778 			ptr = EX(prev_execute_data);
779 
780 			if(ptr && ptr->op_array) {
781 				zend_error(E_WARNING, "Missing argument %u for %s%s%s(), called in %s on line %d and defined", opline->op1.num, class_name, space, get_active_function_name(TSRMLS_C), ptr->op_array->filename, ptr->opline->lineno);
782 			} else {
783 				zend_error(E_WARNING, "Missing argument %u for %s%s%s()", opline->op1.num, class_name, space, get_active_function_name(TSRMLS_C));
784 			}
785 		}
786 	} else {
787 		zval **var_ptr;
788 
789 		zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, *param, opline->extended_value TSRMLS_CC);
790 		var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->result.var TSRMLS_CC);
791 		Z_DELREF_PP(var_ptr);
792 		*var_ptr = *param;
793 		Z_ADDREF_PP(var_ptr);
794 	}
795 
796 	CHECK_EXCEPTION();
797 	ZEND_VM_NEXT_OPCODE();
798 }
799 
ZEND_NEW_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)800 static int ZEND_FASTCALL  ZEND_NEW_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
801 {
802 	USE_OPLINE
803 	zval *object_zval;
804 	zend_function *constructor;
805 
806 	SAVE_OPLINE();
807 	if (UNEXPECTED((EX_T(opline->op1.var).class_entry->ce_flags & (ZEND_ACC_INTERFACE|ZEND_ACC_IMPLICIT_ABSTRACT_CLASS|ZEND_ACC_EXPLICIT_ABSTRACT_CLASS)) != 0)) {
808 		if (EX_T(opline->op1.var).class_entry->ce_flags & ZEND_ACC_INTERFACE) {
809 			zend_error_noreturn(E_ERROR, "Cannot instantiate interface %s", EX_T(opline->op1.var).class_entry->name);
810 		} else if ((EX_T(opline->op1.var).class_entry->ce_flags & ZEND_ACC_TRAIT) == ZEND_ACC_TRAIT) {
811 			zend_error_noreturn(E_ERROR, "Cannot instantiate trait %s", EX_T(opline->op1.var).class_entry->name);
812 		} else {
813 			zend_error_noreturn(E_ERROR, "Cannot instantiate abstract class %s", EX_T(opline->op1.var).class_entry->name);
814 		}
815 	}
816 	ALLOC_ZVAL(object_zval);
817 	object_init_ex(object_zval, EX_T(opline->op1.var).class_entry);
818 	INIT_PZVAL(object_zval);
819 
820 	constructor = Z_OBJ_HT_P(object_zval)->get_constructor(object_zval TSRMLS_CC);
821 
822 	if (constructor == NULL) {
823 		if (RETURN_VALUE_USED(opline)) {
824 			AI_SET_PTR(&EX_T(opline->result.var), object_zval);
825 		} else {
826 			zval_ptr_dtor(&object_zval);
827 		}
828 		ZEND_VM_JMP(EX(op_array)->opcodes + opline->op2.opline_num);
829 	} else {
830 		if (RETURN_VALUE_USED(opline)) {
831 			PZVAL_LOCK(object_zval);
832 			AI_SET_PTR(&EX_T(opline->result.var), object_zval);
833 		}
834 
835 		zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), ENCODE_CTOR(EX(called_scope), RETURN_VALUE_USED(opline)));
836 
837 		/* We are not handling overloaded classes right now */
838 		EX(object) = object_zval;
839 		EX(fbc) = constructor;
840 		EX(called_scope) = EX_T(opline->op1.var).class_entry;
841 
842 		CHECK_EXCEPTION();
843 		ZEND_VM_NEXT_OPCODE();
844 	}
845 }
846 
ZEND_BEGIN_SILENCE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)847 static int ZEND_FASTCALL  ZEND_BEGIN_SILENCE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
848 {
849 	USE_OPLINE
850 
851 	SAVE_OPLINE();
852 	Z_LVAL(EX_T(opline->result.var).tmp_var) = EG(error_reporting);
853 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_LONG;  /* shouldn't be necessary */
854 	if (EX(old_error_reporting) == NULL) {
855 		EX(old_error_reporting) = &EX_T(opline->result.var).tmp_var;
856 	}
857 
858 	if (EG(error_reporting)) {
859 		do {
860 			EG(error_reporting) = 0;
861 			if (!EG(error_reporting_ini_entry)) {
862 				if (UNEXPECTED(zend_hash_find(EG(ini_directives), "error_reporting", sizeof("error_reporting"), (void **) &EG(error_reporting_ini_entry)) == FAILURE)) {
863 					break;
864 				}
865 			}
866 			if (!EG(error_reporting_ini_entry)->modified) {
867 				if (!EG(modified_ini_directives)) {
868 					ALLOC_HASHTABLE(EG(modified_ini_directives));
869 					zend_hash_init(EG(modified_ini_directives), 8, NULL, NULL, 0);
870 				}
871 				if (EXPECTED(zend_hash_add(EG(modified_ini_directives), "error_reporting", sizeof("error_reporting"), &EG(error_reporting_ini_entry), sizeof(zend_ini_entry*), NULL) == SUCCESS)) {
872 					EG(error_reporting_ini_entry)->orig_value = EG(error_reporting_ini_entry)->value;
873 					EG(error_reporting_ini_entry)->orig_value_length = EG(error_reporting_ini_entry)->value_length;
874 					EG(error_reporting_ini_entry)->orig_modifiable = EG(error_reporting_ini_entry)->modifiable;
875 					EG(error_reporting_ini_entry)->modified = 1;
876 				}
877 			} else if (EG(error_reporting_ini_entry)->value != EG(error_reporting_ini_entry)->orig_value) {
878 				efree(EG(error_reporting_ini_entry)->value);
879 			}
880 			EG(error_reporting_ini_entry)->value = estrndup("0", sizeof("0")-1);
881 			EG(error_reporting_ini_entry)->value_length = sizeof("0")-1;
882 		} while (0);
883 	}
884 	CHECK_EXCEPTION();
885 	ZEND_VM_NEXT_OPCODE();
886 }
887 
ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)888 static int ZEND_FASTCALL  ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
889 {
890 	SAVE_OPLINE();
891 	zend_error_noreturn(E_ERROR, "Cannot call abstract method %s::%s()", EG(scope)->name, EX(op_array)->function_name);
892 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
893 }
894 
ZEND_EXT_STMT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)895 static int ZEND_FASTCALL  ZEND_EXT_STMT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
896 {
897 	SAVE_OPLINE();
898 	if (!EG(no_extensions)) {
899 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_statement_handler, EX(op_array) TSRMLS_CC);
900 	}
901 	CHECK_EXCEPTION();
902 	ZEND_VM_NEXT_OPCODE();
903 }
904 
ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)905 static int ZEND_FASTCALL  ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
906 {
907 	SAVE_OPLINE();
908 	if (!EG(no_extensions)) {
909 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_fcall_begin_handler, EX(op_array) TSRMLS_CC);
910 	}
911 	CHECK_EXCEPTION();
912 	ZEND_VM_NEXT_OPCODE();
913 }
914 
ZEND_EXT_FCALL_END_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)915 static int ZEND_FASTCALL  ZEND_EXT_FCALL_END_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
916 {
917 	SAVE_OPLINE();
918 	if (!EG(no_extensions)) {
919 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_fcall_end_handler, EX(op_array) TSRMLS_CC);
920 	}
921 	CHECK_EXCEPTION();
922 	ZEND_VM_NEXT_OPCODE();
923 }
924 
ZEND_DECLARE_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)925 static int ZEND_FASTCALL  ZEND_DECLARE_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
926 {
927 	USE_OPLINE
928 
929 	SAVE_OPLINE();
930 	EX_T(opline->result.var).class_entry = do_bind_class(EX(op_array), opline, EG(class_table), 0 TSRMLS_CC);
931 	CHECK_EXCEPTION();
932 	ZEND_VM_NEXT_OPCODE();
933 }
934 
ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)935 static int ZEND_FASTCALL  ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
936 {
937 	USE_OPLINE
938 
939 	SAVE_OPLINE();
940 	EX_T(opline->result.var).class_entry = do_bind_inherited_class(EX(op_array), opline, EG(class_table), EX_T(opline->extended_value).class_entry, 0 TSRMLS_CC);
941 	CHECK_EXCEPTION();
942 	ZEND_VM_NEXT_OPCODE();
943 }
944 
ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)945 static int ZEND_FASTCALL  ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
946 {
947 	USE_OPLINE
948 	zend_class_entry **pce, **pce_orig;
949 
950 	SAVE_OPLINE();
951 	if (zend_hash_quick_find(EG(class_table), Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void**)&pce) == FAILURE ||
952 	    (zend_hash_quick_find(EG(class_table), Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), Z_HASH_P(opline->op1.zv), (void**)&pce_orig) == SUCCESS &&
953 	     *pce != *pce_orig)) {
954 		do_bind_inherited_class(EX(op_array), opline, EG(class_table), EX_T(opline->extended_value).class_entry, 0 TSRMLS_CC);
955 	}
956 	CHECK_EXCEPTION();
957 	ZEND_VM_NEXT_OPCODE();
958 }
959 
ZEND_DECLARE_FUNCTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)960 static int ZEND_FASTCALL  ZEND_DECLARE_FUNCTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
961 {
962 	USE_OPLINE
963 
964 	SAVE_OPLINE();
965 	do_bind_function(EX(op_array), opline, EG(function_table), 0);
966 	CHECK_EXCEPTION();
967 	ZEND_VM_NEXT_OPCODE();
968 }
969 
ZEND_TICKS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)970 static int ZEND_FASTCALL  ZEND_TICKS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
971 {
972 	USE_OPLINE
973 
974 	SAVE_OPLINE();
975 	if (++EG(ticks_count)>=opline->extended_value) {
976 		EG(ticks_count)=0;
977 		if (zend_ticks_function) {
978 			zend_ticks_function(opline->extended_value);
979 		}
980 	}
981 	CHECK_EXCEPTION();
982 	ZEND_VM_NEXT_OPCODE();
983 }
984 
ZEND_EXT_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)985 static int ZEND_FASTCALL  ZEND_EXT_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
986 {
987 	ZEND_VM_NEXT_OPCODE();
988 }
989 
ZEND_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)990 static int ZEND_FASTCALL  ZEND_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
991 {
992 	ZEND_VM_NEXT_OPCODE();
993 }
994 
ZEND_ADD_TRAIT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)995 static int ZEND_FASTCALL  ZEND_ADD_TRAIT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
996 {
997 	USE_OPLINE
998 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
999 	zend_class_entry *trait;
1000 
1001 	SAVE_OPLINE();
1002 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1003 		trait = CACHED_PTR(opline->op2.literal->cache_slot);
1004 	} else {
1005 		trait = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv),
1006 		                                 Z_STRLEN_P(opline->op2.zv),
1007 		                                 opline->op2.literal + 1,
1008 		                                 opline->extended_value TSRMLS_CC);
1009 		if (UNEXPECTED(trait == NULL)) {
1010 			CHECK_EXCEPTION();
1011 			ZEND_VM_NEXT_OPCODE();
1012 		}
1013 		if (!((trait->ce_flags & ZEND_ACC_TRAIT) == ZEND_ACC_TRAIT)) {
1014 			zend_error_noreturn(E_ERROR, "%s cannot use %s - it is not a trait", ce->name, trait->name);
1015 		}
1016 		CACHE_PTR(opline->op2.literal->cache_slot, trait);
1017 	}
1018 
1019 	zend_do_implement_trait(ce, trait TSRMLS_CC);
1020 
1021  	CHECK_EXCEPTION();
1022 	ZEND_VM_NEXT_OPCODE();
1023 }
1024 
ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1025 static int ZEND_FASTCALL  ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1026 {
1027 	USE_OPLINE
1028 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
1029 
1030 	SAVE_OPLINE();
1031 	zend_do_bind_traits(ce TSRMLS_CC);
1032  	CHECK_EXCEPTION();
1033 	ZEND_VM_NEXT_OPCODE();
1034 }
1035 
ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1036 static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1037 {
1038 	zend_uint op_num = EG(opline_before_exception)-EG(active_op_array)->opcodes;
1039 	int i;
1040 	zend_uint catch_op_num = 0;
1041 	int catched = 0;
1042 	zval restored_error_reporting;
1043 
1044 	void **stack_frame = (void**)(((char*)EX_Ts()) +
1045 		(ZEND_MM_ALIGNED_SIZE(sizeof(temp_variable)) * EX(op_array)->T));
1046 
1047 	while (zend_vm_stack_top(TSRMLS_C) != stack_frame) {
1048 		zval *stack_zval_p = zend_vm_stack_pop(TSRMLS_C);
1049 		zval_ptr_dtor(&stack_zval_p);
1050 	}
1051 
1052 	for (i=0; i<EG(active_op_array)->last_try_catch; i++) {
1053 		if (EG(active_op_array)->try_catch_array[i].try_op > op_num) {
1054 			/* further blocks will not be relevant... */
1055 			break;
1056 		} else if (op_num < EG(active_op_array)->try_catch_array[i].catch_op) {
1057 			catch_op_num = EX(op_array)->try_catch_array[i].catch_op;
1058 			catched = 1;
1059 		}
1060 	}
1061 
1062 	while (EX(fbc)) {
1063 		EX(called_scope) = (zend_class_entry*)zend_ptr_stack_pop(&EG(arg_types_stack));
1064 		if (EX(object)) {
1065 			if (IS_CTOR_CALL(EX(called_scope))) {
1066 				if (IS_CTOR_USED(EX(called_scope))) {
1067 					Z_DELREF_P(EX(object));
1068 				}
1069 				if (Z_REFCOUNT_P(EX(object)) == 1) {
1070 					zend_object_store_ctor_failed(EX(object) TSRMLS_CC);
1071 				}
1072 			}
1073 			zval_ptr_dtor(&EX(object));
1074 		}
1075 		EX(called_scope) = DECODE_CTOR(EX(called_scope));
1076 		zend_arg_types_stack_2_pop(&EG(arg_types_stack), &EX(object), &EX(fbc));
1077 	}
1078 
1079 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
1080 		if (EX(op_array)->brk_cont_array[i].start < 0) {
1081 			continue;
1082 		} else if (EX(op_array)->brk_cont_array[i].start > op_num) {
1083 			/* further blocks will not be relevant... */
1084 			break;
1085 		} else if (op_num < EX(op_array)->brk_cont_array[i].brk) {
1086 			if (!catched ||
1087 			    catch_op_num >= EX(op_array)->brk_cont_array[i].brk) {
1088 				zend_op *brk_opline = &EX(op_array)->opcodes[EX(op_array)->brk_cont_array[i].brk];
1089 
1090 				switch (brk_opline->opcode) {
1091 					case ZEND_SWITCH_FREE:
1092 						if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1093 							zval_ptr_dtor(&EX_T(brk_opline->op1.var).var.ptr);
1094 						}
1095 						break;
1096 					case ZEND_FREE:
1097 						if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1098 							zendi_zval_dtor(EX_T(brk_opline->op1.var).tmp_var);
1099 						}
1100 						break;
1101 				}
1102 			}
1103 		}
1104 	}
1105 
1106 	/* restore previous error_reporting value */
1107 	if (!EG(error_reporting) && EX(old_error_reporting) != NULL && Z_LVAL_P(EX(old_error_reporting)) != 0) {
1108 		Z_TYPE(restored_error_reporting) = IS_LONG;
1109 		Z_LVAL(restored_error_reporting) = Z_LVAL_P(EX(old_error_reporting));
1110 		convert_to_string(&restored_error_reporting);
1111 		zend_alter_ini_entry_ex("error_reporting", sizeof("error_reporting"), Z_STRVAL(restored_error_reporting), Z_STRLEN(restored_error_reporting), ZEND_INI_USER, ZEND_INI_STAGE_RUNTIME, 1 TSRMLS_CC);
1112 		zendi_zval_dtor(restored_error_reporting);
1113 	}
1114 	EX(old_error_reporting) = NULL;
1115 
1116 	if (!catched) {
1117 		return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1118  	} else {
1119 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[catch_op_num]);
1120  		ZEND_VM_CONTINUE();
1121  	}
1122 }
1123 
ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1124 static int ZEND_FASTCALL  ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1125 {
1126 	USE_OPLINE
1127 
1128 	SAVE_OPLINE();
1129 	zend_verify_abstract_class(EX_T(opline->op1.var).class_entry TSRMLS_CC);
1130 	CHECK_EXCEPTION();
1131 	ZEND_VM_NEXT_OPCODE();
1132 }
1133 
ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1134 static int ZEND_FASTCALL  ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1135 {
1136 	USE_OPLINE
1137 	int ret;
1138 
1139 	SAVE_OPLINE();
1140 	ret = zend_user_opcode_handlers[opline->opcode](ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_INTERNAL);
1141 	LOAD_OPLINE();
1142 
1143 	switch (ret) {
1144 		case ZEND_USER_OPCODE_CONTINUE:
1145 			ZEND_VM_CONTINUE();
1146 		case ZEND_USER_OPCODE_RETURN:
1147 			return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1148 		case ZEND_USER_OPCODE_ENTER:
1149 			ZEND_VM_ENTER();
1150 		case ZEND_USER_OPCODE_LEAVE:
1151 			ZEND_VM_LEAVE();
1152 		case ZEND_USER_OPCODE_DISPATCH:
1153 			ZEND_VM_DISPATCH(opline->opcode, opline);
1154 		default:
1155 			ZEND_VM_DISPATCH((zend_uchar)(ret & 0xff), opline);
1156 	}
1157 }
1158 
ZEND_FETCH_CLASS_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1159 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1160 {
1161 	USE_OPLINE
1162 
1163 	SAVE_OPLINE();
1164 	EG(exception) = NULL;
1165 	if (IS_CONST == IS_UNUSED) {
1166 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1167 		CHECK_EXCEPTION();
1168 		ZEND_VM_NEXT_OPCODE();
1169 	} else {
1170 
1171 		zval *class_name = opline->op2.zv;
1172 
1173 		if (IS_CONST == IS_CONST) {
1174 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1175 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1176 			} else {
1177 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1178 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1179 			}
1180 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1181 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1182 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1183 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1184 		} else {
1185 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1186 		}
1187 
1188 		CHECK_EXCEPTION();
1189 		ZEND_VM_NEXT_OPCODE();
1190 	}
1191 }
1192 
ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1193 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1194 {
1195 	USE_OPLINE
1196 	zval *function_name;
1197 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
1198 
1199 	if (IS_CONST == IS_CONST) {
1200 		function_name = (zval*)(opline->op2.literal+1);
1201 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1202 			EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
1203 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &EX(fbc)) == FAILURE)) {
1204 			SAVE_OPLINE();
1205 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1206 		} else {
1207 			CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1208 		}
1209 		EX(object) = NULL;
1210 		/*CHECK_EXCEPTION();*/
1211 		ZEND_VM_NEXT_OPCODE();
1212 	} else {
1213 		char *function_name_strval, *lcname;
1214 		int function_name_strlen;
1215 
1216 
1217 		SAVE_OPLINE();
1218 		function_name = opline->op2.zv;
1219 
1220 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1221 			function_name_strval = Z_STRVAL_P(function_name);
1222 			function_name_strlen = Z_STRLEN_P(function_name);
1223 			if (function_name_strval[0] == '\\') {
1224 			    function_name_strlen -= 1;
1225 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1226 			} else {
1227 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1228 			}
1229 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &EX(fbc)) == FAILURE)) {
1230 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1231 			}
1232 			efree(lcname);
1233 
1234 			EX(object) = NULL;
1235 			CHECK_EXCEPTION();
1236 			ZEND_VM_NEXT_OPCODE();
1237 		} else if (IS_CONST != IS_CONST && IS_CONST != IS_TMP_VAR &&
1238 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1239 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1240 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &EX(called_scope), &EX(fbc), &EX(object) TSRMLS_CC) == SUCCESS) {
1241 			if (EX(object)) {
1242 				Z_ADDREF_P(EX(object));
1243 			}
1244 			if (IS_CONST == IS_VAR && 0 &&
1245 			    EX(fbc)->common.fn_flags & ZEND_ACC_CLOSURE) {
1246 				/* Delay closure destruction until its invocation */
1247 				EX(fbc)->common.prototype = (zend_function*)function_name;
1248 			} else {
1249 
1250 			}
1251 			CHECK_EXCEPTION();
1252 			ZEND_VM_NEXT_OPCODE();
1253 		} else if (IS_CONST != IS_CONST &&
1254 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1255 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1256 			zend_class_entry *ce;
1257 			zval **method = NULL;
1258 			zval **obj = NULL;
1259 
1260 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1261 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1262 
1263 			if (!obj || !method) {
1264 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1265 			}
1266 
1267 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1268 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1269 			}
1270 
1271 			if (Z_TYPE_PP(method) != IS_STRING) {
1272 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1273 			}
1274 
1275 			if (Z_TYPE_PP(obj) == IS_STRING) {
1276 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1277 				if (UNEXPECTED(EG(exception) != NULL)) {
1278 					HANDLE_EXCEPTION();
1279 				}
1280 				if (UNEXPECTED(ce == NULL)) {
1281 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_PP(obj));
1282 				}
1283 				EX(called_scope) = ce;
1284 				EX(object) = NULL;
1285 
1286 				if (ce->get_static_method) {
1287 					EX(fbc) = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1288 				} else {
1289 					EX(fbc) = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1290 				}
1291 			} else {
1292 				EX(object) = *obj;
1293 				ce = EX(called_scope) = Z_OBJCE_PP(obj);
1294 
1295 				EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1296 				if (UNEXPECTED(EX(fbc) == NULL)) {
1297 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), Z_STRVAL_PP(method));
1298 				}
1299 
1300 				if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1301 					EX(object) = NULL;
1302 				} else {
1303 					if (!PZVAL_IS_REF(EX(object))) {
1304 						Z_ADDREF_P(EX(object)); /* For $this pointer */
1305 					} else {
1306 						zval *this_ptr;
1307 						ALLOC_ZVAL(this_ptr);
1308 						INIT_PZVAL_COPY(this_ptr, EX(object));
1309 						zval_copy_ctor(this_ptr);
1310 						EX(object) = this_ptr;
1311 					}
1312 				}
1313 			}
1314 
1315 			if (UNEXPECTED(EX(fbc) == NULL)) {
1316 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1317 			}
1318 
1319 			CHECK_EXCEPTION();
1320 			ZEND_VM_NEXT_OPCODE();
1321 		} else {
1322 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1323 		}
1324 	}
1325 }
1326 
1327 
ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1328 static int ZEND_FASTCALL  ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1329 {
1330 	USE_OPLINE
1331 	zend_literal *func_name;
1332 
1333 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
1334 
1335 	func_name = opline->op2.literal + 1;
1336 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1337 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
1338 	} else if (zend_hash_quick_find(EG(function_table), Z_STRVAL(func_name->constant), Z_STRLEN(func_name->constant)+1, func_name->hash_value, (void **) &EX(fbc))==FAILURE) {
1339 		func_name++;
1340 		if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL(func_name->constant), Z_STRLEN(func_name->constant)+1, func_name->hash_value, (void **) &EX(fbc))==FAILURE)) {
1341 			SAVE_OPLINE();
1342 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1343 		} else {
1344 			CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1345 		}
1346 	} else {
1347 		CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1348 	}
1349 
1350 	EX(object) = NULL;
1351 	ZEND_VM_NEXT_OPCODE();
1352 }
1353 
ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1354 static int ZEND_FASTCALL  ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1355 {
1356 	USE_OPLINE
1357 	zval *assignment_value;
1358 	zend_uint arg_num = opline->op1.num;
1359 	zval **param = zend_vm_stack_get_arg(arg_num TSRMLS_CC);
1360 	zval **var_ptr;
1361 
1362 	SAVE_OPLINE();
1363 	if (param == NULL) {
1364 		ALLOC_ZVAL(assignment_value);
1365 		*assignment_value = *opline->op2.zv;
1366 		if ((Z_TYPE_P(assignment_value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT ||
1367 		     Z_TYPE_P(assignment_value)==IS_CONSTANT_ARRAY) {
1368 			Z_SET_REFCOUNT_P(assignment_value, 1);
1369 			zval_update_constant(&assignment_value, 0 TSRMLS_CC);
1370 		} else {
1371 			zval_copy_ctor(assignment_value);
1372 		}
1373 		INIT_PZVAL(assignment_value);
1374 	} else {
1375 		assignment_value = *param;
1376 		Z_ADDREF_P(assignment_value);
1377 	}
1378 
1379 	zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, assignment_value, opline->extended_value TSRMLS_CC);
1380 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->result.var TSRMLS_CC);
1381 	zval_ptr_dtor(var_ptr);
1382 	*var_ptr = assignment_value;
1383 
1384 	CHECK_EXCEPTION();
1385 	ZEND_VM_NEXT_OPCODE();
1386 }
1387 
ZEND_BRK_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1388 static int ZEND_FASTCALL  ZEND_BRK_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1389 {
1390 	USE_OPLINE
1391 	zend_brk_cont_element *el;
1392 
1393 	SAVE_OPLINE();
1394 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->op1.opline_num,
1395 	                   EX(op_array), EX_Ts() TSRMLS_CC);
1396 	ZEND_VM_JMP(EX(op_array)->opcodes + el->brk);
1397 }
1398 
ZEND_CONT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1399 static int ZEND_FASTCALL  ZEND_CONT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1400 {
1401 	USE_OPLINE
1402 	zend_brk_cont_element *el;
1403 
1404 	SAVE_OPLINE();
1405 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->op1.opline_num,
1406 	                   EX(op_array), EX_Ts() TSRMLS_CC);
1407 	ZEND_VM_JMP(EX(op_array)->opcodes + el->cont);
1408 }
1409 
ZEND_GOTO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1410 static int ZEND_FASTCALL  ZEND_GOTO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1411 {
1412 	zend_op *brk_opline;
1413 	USE_OPLINE
1414 	zend_brk_cont_element *el;
1415 
1416 	SAVE_OPLINE();
1417 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->extended_value,
1418  	                   EX(op_array), EX_Ts() TSRMLS_CC);
1419 
1420 	brk_opline = EX(op_array)->opcodes + el->brk;
1421 
1422 	switch (brk_opline->opcode) {
1423 		case ZEND_SWITCH_FREE:
1424 			if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1425 				zval_ptr_dtor(&EX_T(brk_opline->op1.var).var.ptr);
1426 			}
1427 			break;
1428 		case ZEND_FREE:
1429 			if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1430 				zendi_zval_dtor(EX_T(brk_opline->op1.var).tmp_var);
1431 			}
1432 			break;
1433 	}
1434 	ZEND_VM_JMP(opline->op1.jmp_addr);
1435 }
1436 
ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1437 static int ZEND_FASTCALL  ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1438 {
1439 	USE_OPLINE
1440 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
1441 	zend_class_entry *iface;
1442 
1443 	SAVE_OPLINE();
1444 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1445 		iface = CACHED_PTR(opline->op2.literal->cache_slot);
1446 	} else {
1447 		iface = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1448 		if (UNEXPECTED(iface == NULL)) {
1449 			CHECK_EXCEPTION();
1450 			ZEND_VM_NEXT_OPCODE();
1451 		}
1452 		CACHE_PTR(opline->op2.literal->cache_slot, iface);
1453 	}
1454 
1455 	if (UNEXPECTED((iface->ce_flags & ZEND_ACC_INTERFACE) == 0)) {
1456 		zend_error_noreturn(E_ERROR, "%s cannot implement %s - it is not an interface", ce->name, iface->name);
1457 	}
1458 	zend_do_implement_interface(ce, iface TSRMLS_CC);
1459 
1460 	CHECK_EXCEPTION();
1461 	ZEND_VM_NEXT_OPCODE();
1462 }
1463 
ZEND_FETCH_CLASS_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1464 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1465 {
1466 	USE_OPLINE
1467 
1468 	SAVE_OPLINE();
1469 	EG(exception) = NULL;
1470 	if (IS_TMP_VAR == IS_UNUSED) {
1471 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1472 		CHECK_EXCEPTION();
1473 		ZEND_VM_NEXT_OPCODE();
1474 	} else {
1475 		zend_free_op free_op2;
1476 		zval *class_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
1477 
1478 		if (IS_TMP_VAR == IS_CONST) {
1479 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1480 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1481 			} else {
1482 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1483 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1484 			}
1485 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1486 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1487 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1488 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1489 		} else {
1490 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1491 		}
1492 
1493 		zval_dtor(free_op2.var);
1494 		CHECK_EXCEPTION();
1495 		ZEND_VM_NEXT_OPCODE();
1496 	}
1497 }
1498 
ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1499 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1500 {
1501 	USE_OPLINE
1502 	zval *function_name;
1503 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
1504 
1505 	if (IS_TMP_VAR == IS_CONST) {
1506 		function_name = (zval*)(opline->op2.literal+1);
1507 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1508 			EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
1509 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &EX(fbc)) == FAILURE)) {
1510 			SAVE_OPLINE();
1511 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1512 		} else {
1513 			CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1514 		}
1515 		EX(object) = NULL;
1516 		/*CHECK_EXCEPTION();*/
1517 		ZEND_VM_NEXT_OPCODE();
1518 	} else {
1519 		char *function_name_strval, *lcname;
1520 		int function_name_strlen;
1521 		zend_free_op free_op2;
1522 
1523 		SAVE_OPLINE();
1524 		function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
1525 
1526 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1527 			function_name_strval = Z_STRVAL_P(function_name);
1528 			function_name_strlen = Z_STRLEN_P(function_name);
1529 			if (function_name_strval[0] == '\\') {
1530 			    function_name_strlen -= 1;
1531 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1532 			} else {
1533 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1534 			}
1535 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &EX(fbc)) == FAILURE)) {
1536 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1537 			}
1538 			efree(lcname);
1539 			zval_dtor(free_op2.var);
1540 			EX(object) = NULL;
1541 			CHECK_EXCEPTION();
1542 			ZEND_VM_NEXT_OPCODE();
1543 		} else if (IS_TMP_VAR != IS_CONST && IS_TMP_VAR != IS_TMP_VAR &&
1544 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1545 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1546 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &EX(called_scope), &EX(fbc), &EX(object) TSRMLS_CC) == SUCCESS) {
1547 			if (EX(object)) {
1548 				Z_ADDREF_P(EX(object));
1549 			}
1550 			if (IS_TMP_VAR == IS_VAR && 1 &&
1551 			    EX(fbc)->common.fn_flags & ZEND_ACC_CLOSURE) {
1552 				/* Delay closure destruction until its invocation */
1553 				EX(fbc)->common.prototype = (zend_function*)function_name;
1554 			} else {
1555 				zval_dtor(free_op2.var);
1556 			}
1557 			CHECK_EXCEPTION();
1558 			ZEND_VM_NEXT_OPCODE();
1559 		} else if (IS_TMP_VAR != IS_CONST &&
1560 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1561 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1562 			zend_class_entry *ce;
1563 			zval **method = NULL;
1564 			zval **obj = NULL;
1565 
1566 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1567 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1568 
1569 			if (!obj || !method) {
1570 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1571 			}
1572 
1573 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1574 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1575 			}
1576 
1577 			if (Z_TYPE_PP(method) != IS_STRING) {
1578 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1579 			}
1580 
1581 			if (Z_TYPE_PP(obj) == IS_STRING) {
1582 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1583 				if (UNEXPECTED(EG(exception) != NULL)) {
1584 					HANDLE_EXCEPTION();
1585 				}
1586 				if (UNEXPECTED(ce == NULL)) {
1587 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_PP(obj));
1588 				}
1589 				EX(called_scope) = ce;
1590 				EX(object) = NULL;
1591 
1592 				if (ce->get_static_method) {
1593 					EX(fbc) = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1594 				} else {
1595 					EX(fbc) = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1596 				}
1597 			} else {
1598 				EX(object) = *obj;
1599 				ce = EX(called_scope) = Z_OBJCE_PP(obj);
1600 
1601 				EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1602 				if (UNEXPECTED(EX(fbc) == NULL)) {
1603 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), Z_STRVAL_PP(method));
1604 				}
1605 
1606 				if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1607 					EX(object) = NULL;
1608 				} else {
1609 					if (!PZVAL_IS_REF(EX(object))) {
1610 						Z_ADDREF_P(EX(object)); /* For $this pointer */
1611 					} else {
1612 						zval *this_ptr;
1613 						ALLOC_ZVAL(this_ptr);
1614 						INIT_PZVAL_COPY(this_ptr, EX(object));
1615 						zval_copy_ctor(this_ptr);
1616 						EX(object) = this_ptr;
1617 					}
1618 				}
1619 			}
1620 
1621 			if (UNEXPECTED(EX(fbc) == NULL)) {
1622 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1623 			}
1624 			zval_dtor(free_op2.var);
1625 			CHECK_EXCEPTION();
1626 			ZEND_VM_NEXT_OPCODE();
1627 		} else {
1628 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1629 		}
1630 	}
1631 }
1632 
1633 
ZEND_FETCH_CLASS_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1634 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1635 {
1636 	USE_OPLINE
1637 
1638 	SAVE_OPLINE();
1639 	EG(exception) = NULL;
1640 	if (IS_VAR == IS_UNUSED) {
1641 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1642 		CHECK_EXCEPTION();
1643 		ZEND_VM_NEXT_OPCODE();
1644 	} else {
1645 		zend_free_op free_op2;
1646 		zval *class_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
1647 
1648 		if (IS_VAR == IS_CONST) {
1649 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1650 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1651 			} else {
1652 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1653 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1654 			}
1655 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1656 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1657 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1658 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1659 		} else {
1660 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1661 		}
1662 
1663 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1664 		CHECK_EXCEPTION();
1665 		ZEND_VM_NEXT_OPCODE();
1666 	}
1667 }
1668 
ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1669 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1670 {
1671 	USE_OPLINE
1672 	zval *function_name;
1673 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
1674 
1675 	if (IS_VAR == IS_CONST) {
1676 		function_name = (zval*)(opline->op2.literal+1);
1677 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1678 			EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
1679 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &EX(fbc)) == FAILURE)) {
1680 			SAVE_OPLINE();
1681 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1682 		} else {
1683 			CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1684 		}
1685 		EX(object) = NULL;
1686 		/*CHECK_EXCEPTION();*/
1687 		ZEND_VM_NEXT_OPCODE();
1688 	} else {
1689 		char *function_name_strval, *lcname;
1690 		int function_name_strlen;
1691 		zend_free_op free_op2;
1692 
1693 		SAVE_OPLINE();
1694 		function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
1695 
1696 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1697 			function_name_strval = Z_STRVAL_P(function_name);
1698 			function_name_strlen = Z_STRLEN_P(function_name);
1699 			if (function_name_strval[0] == '\\') {
1700 			    function_name_strlen -= 1;
1701 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1702 			} else {
1703 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1704 			}
1705 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &EX(fbc)) == FAILURE)) {
1706 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1707 			}
1708 			efree(lcname);
1709 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1710 			EX(object) = NULL;
1711 			CHECK_EXCEPTION();
1712 			ZEND_VM_NEXT_OPCODE();
1713 		} else if (IS_VAR != IS_CONST && IS_VAR != IS_TMP_VAR &&
1714 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1715 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1716 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &EX(called_scope), &EX(fbc), &EX(object) TSRMLS_CC) == SUCCESS) {
1717 			if (EX(object)) {
1718 				Z_ADDREF_P(EX(object));
1719 			}
1720 			if (IS_VAR == IS_VAR && (free_op2.var != NULL) &&
1721 			    EX(fbc)->common.fn_flags & ZEND_ACC_CLOSURE) {
1722 				/* Delay closure destruction until its invocation */
1723 				EX(fbc)->common.prototype = (zend_function*)function_name;
1724 			} else {
1725 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1726 			}
1727 			CHECK_EXCEPTION();
1728 			ZEND_VM_NEXT_OPCODE();
1729 		} else if (IS_VAR != IS_CONST &&
1730 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1731 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1732 			zend_class_entry *ce;
1733 			zval **method = NULL;
1734 			zval **obj = NULL;
1735 
1736 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1737 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1738 
1739 			if (!obj || !method) {
1740 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1741 			}
1742 
1743 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1744 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1745 			}
1746 
1747 			if (Z_TYPE_PP(method) != IS_STRING) {
1748 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1749 			}
1750 
1751 			if (Z_TYPE_PP(obj) == IS_STRING) {
1752 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1753 				if (UNEXPECTED(EG(exception) != NULL)) {
1754 					HANDLE_EXCEPTION();
1755 				}
1756 				if (UNEXPECTED(ce == NULL)) {
1757 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_PP(obj));
1758 				}
1759 				EX(called_scope) = ce;
1760 				EX(object) = NULL;
1761 
1762 				if (ce->get_static_method) {
1763 					EX(fbc) = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1764 				} else {
1765 					EX(fbc) = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1766 				}
1767 			} else {
1768 				EX(object) = *obj;
1769 				ce = EX(called_scope) = Z_OBJCE_PP(obj);
1770 
1771 				EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1772 				if (UNEXPECTED(EX(fbc) == NULL)) {
1773 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), Z_STRVAL_PP(method));
1774 				}
1775 
1776 				if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1777 					EX(object) = NULL;
1778 				} else {
1779 					if (!PZVAL_IS_REF(EX(object))) {
1780 						Z_ADDREF_P(EX(object)); /* For $this pointer */
1781 					} else {
1782 						zval *this_ptr;
1783 						ALLOC_ZVAL(this_ptr);
1784 						INIT_PZVAL_COPY(this_ptr, EX(object));
1785 						zval_copy_ctor(this_ptr);
1786 						EX(object) = this_ptr;
1787 					}
1788 				}
1789 			}
1790 
1791 			if (UNEXPECTED(EX(fbc) == NULL)) {
1792 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1793 			}
1794 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1795 			CHECK_EXCEPTION();
1796 			ZEND_VM_NEXT_OPCODE();
1797 		} else {
1798 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1799 		}
1800 	}
1801 }
1802 
1803 
ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1804 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1805 {
1806 	USE_OPLINE
1807 
1808 	SAVE_OPLINE();
1809 	EG(exception) = NULL;
1810 	if (IS_UNUSED == IS_UNUSED) {
1811 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1812 		CHECK_EXCEPTION();
1813 		ZEND_VM_NEXT_OPCODE();
1814 	} else {
1815 
1816 		zval *class_name = NULL;
1817 
1818 		if (IS_UNUSED == IS_CONST) {
1819 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1820 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1821 			} else {
1822 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1823 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1824 			}
1825 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1826 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1827 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1828 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1829 		} else {
1830 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1831 		}
1832 
1833 		CHECK_EXCEPTION();
1834 		ZEND_VM_NEXT_OPCODE();
1835 	}
1836 }
1837 
ZEND_FETCH_CLASS_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1838 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1839 {
1840 	USE_OPLINE
1841 
1842 	SAVE_OPLINE();
1843 	EG(exception) = NULL;
1844 	if (IS_CV == IS_UNUSED) {
1845 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1846 		CHECK_EXCEPTION();
1847 		ZEND_VM_NEXT_OPCODE();
1848 	} else {
1849 
1850 		zval *class_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
1851 
1852 		if (IS_CV == IS_CONST) {
1853 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1854 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1855 			} else {
1856 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1857 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1858 			}
1859 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1860 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1861 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1862 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1863 		} else {
1864 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1865 		}
1866 
1867 		CHECK_EXCEPTION();
1868 		ZEND_VM_NEXT_OPCODE();
1869 	}
1870 }
1871 
ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1872 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1873 {
1874 	USE_OPLINE
1875 	zval *function_name;
1876 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
1877 
1878 	if (IS_CV == IS_CONST) {
1879 		function_name = (zval*)(opline->op2.literal+1);
1880 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1881 			EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
1882 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &EX(fbc)) == FAILURE)) {
1883 			SAVE_OPLINE();
1884 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1885 		} else {
1886 			CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
1887 		}
1888 		EX(object) = NULL;
1889 		/*CHECK_EXCEPTION();*/
1890 		ZEND_VM_NEXT_OPCODE();
1891 	} else {
1892 		char *function_name_strval, *lcname;
1893 		int function_name_strlen;
1894 
1895 
1896 		SAVE_OPLINE();
1897 		function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
1898 
1899 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1900 			function_name_strval = Z_STRVAL_P(function_name);
1901 			function_name_strlen = Z_STRLEN_P(function_name);
1902 			if (function_name_strval[0] == '\\') {
1903 			    function_name_strlen -= 1;
1904 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1905 			} else {
1906 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1907 			}
1908 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &EX(fbc)) == FAILURE)) {
1909 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1910 			}
1911 			efree(lcname);
1912 
1913 			EX(object) = NULL;
1914 			CHECK_EXCEPTION();
1915 			ZEND_VM_NEXT_OPCODE();
1916 		} else if (IS_CV != IS_CONST && IS_CV != IS_TMP_VAR &&
1917 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1918 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1919 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &EX(called_scope), &EX(fbc), &EX(object) TSRMLS_CC) == SUCCESS) {
1920 			if (EX(object)) {
1921 				Z_ADDREF_P(EX(object));
1922 			}
1923 			if (IS_CV == IS_VAR && 0 &&
1924 			    EX(fbc)->common.fn_flags & ZEND_ACC_CLOSURE) {
1925 				/* Delay closure destruction until its invocation */
1926 				EX(fbc)->common.prototype = (zend_function*)function_name;
1927 			} else {
1928 
1929 			}
1930 			CHECK_EXCEPTION();
1931 			ZEND_VM_NEXT_OPCODE();
1932 		} else if (IS_CV != IS_CONST &&
1933 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1934 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1935 			zend_class_entry *ce;
1936 			zval **method = NULL;
1937 			zval **obj = NULL;
1938 
1939 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1940 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1941 
1942 			if (!obj || !method) {
1943 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1944 			}
1945 
1946 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1947 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1948 			}
1949 
1950 			if (Z_TYPE_PP(method) != IS_STRING) {
1951 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1952 			}
1953 
1954 			if (Z_TYPE_PP(obj) == IS_STRING) {
1955 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1956 				if (UNEXPECTED(EG(exception) != NULL)) {
1957 					HANDLE_EXCEPTION();
1958 				}
1959 				if (UNEXPECTED(ce == NULL)) {
1960 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_PP(obj));
1961 				}
1962 				EX(called_scope) = ce;
1963 				EX(object) = NULL;
1964 
1965 				if (ce->get_static_method) {
1966 					EX(fbc) = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1967 				} else {
1968 					EX(fbc) = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1969 				}
1970 			} else {
1971 				EX(object) = *obj;
1972 				ce = EX(called_scope) = Z_OBJCE_PP(obj);
1973 
1974 				EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1975 				if (UNEXPECTED(EX(fbc) == NULL)) {
1976 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), Z_STRVAL_PP(method));
1977 				}
1978 
1979 				if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1980 					EX(object) = NULL;
1981 				} else {
1982 					if (!PZVAL_IS_REF(EX(object))) {
1983 						Z_ADDREF_P(EX(object)); /* For $this pointer */
1984 					} else {
1985 						zval *this_ptr;
1986 						ALLOC_ZVAL(this_ptr);
1987 						INIT_PZVAL_COPY(this_ptr, EX(object));
1988 						zval_copy_ctor(this_ptr);
1989 						EX(object) = this_ptr;
1990 					}
1991 				}
1992 			}
1993 
1994 			if (UNEXPECTED(EX(fbc) == NULL)) {
1995 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1996 			}
1997 
1998 			CHECK_EXCEPTION();
1999 			ZEND_VM_NEXT_OPCODE();
2000 		} else {
2001 			zend_error_noreturn(E_ERROR, "Function name must be a string");
2002 		}
2003 	}
2004 }
2005 
2006 
ZEND_BW_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2007 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2008 {
2009 	USE_OPLINE
2010 
2011 
2012 	SAVE_OPLINE();
2013 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
2014 		opline->op1.zv TSRMLS_CC);
2015 
2016 	CHECK_EXCEPTION();
2017 	ZEND_VM_NEXT_OPCODE();
2018 }
2019 
ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2020 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2021 {
2022 	USE_OPLINE
2023 
2024 
2025 	SAVE_OPLINE();
2026 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
2027 		opline->op1.zv TSRMLS_CC);
2028 
2029 	CHECK_EXCEPTION();
2030 	ZEND_VM_NEXT_OPCODE();
2031 }
2032 
ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2033 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2034 {
2035 	USE_OPLINE
2036 
2037 	zval *z;
2038 
2039 	SAVE_OPLINE();
2040 	z = opline->op1.zv;
2041 
2042 	if (IS_CONST == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
2043 		INIT_PZVAL(z);
2044 	}
2045 	zend_print_variable(z);
2046 
2047 	CHECK_EXCEPTION();
2048 	ZEND_VM_NEXT_OPCODE();
2049 }
2050 
ZEND_PRINT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2051 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2052 {
2053 	USE_OPLINE
2054 
2055 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
2056 	return ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2057 }
2058 
ZEND_JMPZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2059 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2060 {
2061 	USE_OPLINE
2062 
2063 	zval *val;
2064 	int ret;
2065 
2066 	SAVE_OPLINE();
2067 	val = opline->op1.zv;
2068 
2069 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2070 		ret = Z_LVAL_P(val);
2071 	} else {
2072 		ret = i_zend_is_true(val);
2073 
2074 		if (UNEXPECTED(EG(exception) != NULL)) {
2075 			HANDLE_EXCEPTION();
2076 		}
2077 	}
2078 	if (!ret) {
2079 #if DEBUG_ZEND>=2
2080 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2081 #endif
2082 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2083 		ZEND_VM_CONTINUE();
2084 	}
2085 
2086 	ZEND_VM_NEXT_OPCODE();
2087 }
2088 
ZEND_JMPNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2089 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2090 {
2091 	USE_OPLINE
2092 
2093 	zval *val;
2094 	int ret;
2095 
2096 	SAVE_OPLINE();
2097 	val = opline->op1.zv;
2098 
2099 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2100 		ret = Z_LVAL_P(val);
2101 	} else {
2102 		ret = i_zend_is_true(val);
2103 
2104 		if (UNEXPECTED(EG(exception) != NULL)) {
2105 			HANDLE_EXCEPTION();
2106 		}
2107 	}
2108 	if (ret) {
2109 #if DEBUG_ZEND>=2
2110 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2111 #endif
2112 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2113 		ZEND_VM_CONTINUE();
2114 	}
2115 
2116 	ZEND_VM_NEXT_OPCODE();
2117 }
2118 
ZEND_JMPZNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2119 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2120 {
2121 	USE_OPLINE
2122 
2123 	zval *val;
2124 	int retval;
2125 
2126 	SAVE_OPLINE();
2127 	val = opline->op1.zv;
2128 
2129 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2130 		retval = Z_LVAL_P(val);
2131 	} else {
2132 		retval = i_zend_is_true(val);
2133 
2134 		if (UNEXPECTED(EG(exception) != NULL)) {
2135 			HANDLE_EXCEPTION();
2136 		}
2137 	}
2138 	if (EXPECTED(retval != 0)) {
2139 #if DEBUG_ZEND>=2
2140 		printf("Conditional jmp on true to %d\n", opline->extended_value);
2141 #endif
2142 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
2143 		ZEND_VM_CONTINUE(); /* CHECK_ME */
2144 	} else {
2145 #if DEBUG_ZEND>=2
2146 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
2147 #endif
2148 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
2149 		ZEND_VM_CONTINUE(); /* CHECK_ME */
2150 	}
2151 }
2152 
ZEND_JMPZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2153 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2154 {
2155 	USE_OPLINE
2156 
2157 	zval *val;
2158 	int retval;
2159 
2160 	SAVE_OPLINE();
2161 	val = opline->op1.zv;
2162 
2163 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2164 		retval = Z_LVAL_P(val);
2165 	} else {
2166 		retval = i_zend_is_true(val);
2167 
2168 		if (UNEXPECTED(EG(exception) != NULL)) {
2169 			HANDLE_EXCEPTION();
2170 		}
2171 	}
2172 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
2173 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
2174 	if (!retval) {
2175 #if DEBUG_ZEND>=2
2176 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2177 #endif
2178 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2179 		ZEND_VM_CONTINUE();
2180 	}
2181 	ZEND_VM_NEXT_OPCODE();
2182 }
2183 
ZEND_JMPNZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2184 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2185 {
2186 	USE_OPLINE
2187 
2188 	zval *val;
2189 	int retval;
2190 
2191 	SAVE_OPLINE();
2192 	val = opline->op1.zv;
2193 
2194 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2195 		retval = Z_LVAL_P(val);
2196 	} else {
2197 		retval = i_zend_is_true(val);
2198 
2199 		if (UNEXPECTED(EG(exception) != NULL)) {
2200 			HANDLE_EXCEPTION();
2201 		}
2202 	}
2203 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
2204 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
2205 	if (retval) {
2206 #if DEBUG_ZEND>=2
2207 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2208 #endif
2209 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2210 		ZEND_VM_CONTINUE();
2211 	}
2212 	ZEND_VM_NEXT_OPCODE();
2213 }
2214 
ZEND_DO_FCALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2215 static int ZEND_FASTCALL  ZEND_DO_FCALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2216 {
2217 	USE_OPLINE
2218 
2219 	zval *fname = opline->op1.zv;
2220 
2221 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
2222 
2223 	if (CACHED_PTR(opline->op1.literal->cache_slot)) {
2224 		EX(function_state).function = CACHED_PTR(opline->op1.literal->cache_slot);
2225 	} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(fname), Z_STRLEN_P(fname)+1, Z_HASH_P(fname), (void **) &EX(function_state).function)==FAILURE)) {
2226 	    SAVE_OPLINE();
2227 		zend_error_noreturn(E_ERROR, "Call to undefined function %s()", fname->value.str.val);
2228 	} else {
2229 		CACHE_PTR(opline->op1.literal->cache_slot, EX(function_state).function);
2230 	}
2231 	EX(object) = NULL;
2232 
2233 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2234 }
2235 
ZEND_RETURN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2236 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2237 {
2238 	USE_OPLINE
2239 	zval *retval_ptr;
2240 
2241 
2242 	SAVE_OPLINE();
2243 	retval_ptr = opline->op1.zv;
2244 
2245 	if (!EG(return_value_ptr_ptr)) {
2246 		if (IS_CONST == IS_TMP_VAR) {
2247 
2248 		}
2249 	} else if (!0) { /* Not a temp var */
2250 		if (IS_CONST == IS_CONST ||
2251 		    (PZVAL_IS_REF(retval_ptr) && Z_REFCOUNT_P(retval_ptr) > 0)) {
2252 			zval *ret;
2253 
2254 			ALLOC_ZVAL(ret);
2255 			INIT_PZVAL_COPY(ret, retval_ptr);
2256 			zval_copy_ctor(ret);
2257 			*EG(return_value_ptr_ptr) = ret;
2258 		} else if ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2259 		           retval_ptr == &EG(uninitialized_zval)) {
2260 			zval *ret;
2261 
2262 			ALLOC_INIT_ZVAL(ret);
2263 			*EG(return_value_ptr_ptr) = ret;
2264 		} else {
2265 			*EG(return_value_ptr_ptr) = retval_ptr;
2266 			Z_ADDREF_P(retval_ptr);
2267 		}
2268 	} else {
2269 		zval *ret;
2270 
2271 		ALLOC_ZVAL(ret);
2272 		INIT_PZVAL_COPY(ret, retval_ptr);
2273 		*EG(return_value_ptr_ptr) = ret;
2274 	}
2275 
2276 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2277 }
2278 
ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2279 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2280 {
2281 	USE_OPLINE
2282 	zval *retval_ptr;
2283 	zval **retval_ptr_ptr;
2284 
2285 
2286 	SAVE_OPLINE();
2287 
2288 	do {
2289 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
2290 			/* Not supposed to happen, but we'll allow it */
2291 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
2292 
2293 			retval_ptr = opline->op1.zv;
2294 			if (!EG(return_value_ptr_ptr)) {
2295 				if (IS_CONST == IS_TMP_VAR) {
2296 
2297 				}
2298 			} else if (!0) { /* Not a temp var */
2299 				zval *ret;
2300 
2301 				ALLOC_ZVAL(ret);
2302 				INIT_PZVAL_COPY(ret, retval_ptr);
2303 				zval_copy_ctor(ret);
2304 				*EG(return_value_ptr_ptr) = ret;
2305 			} else {
2306 				zval *ret;
2307 
2308 				ALLOC_ZVAL(ret);
2309 				INIT_PZVAL_COPY(ret, retval_ptr);
2310 				*EG(return_value_ptr_ptr) = ret;
2311 			}
2312 			break;
2313 		}
2314 
2315 		retval_ptr_ptr = NULL;
2316 
2317 		if (IS_CONST == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
2318 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
2319 		}
2320 
2321 		if (IS_CONST == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
2322 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
2323 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
2324 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
2325 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
2326 				if (EG(return_value_ptr_ptr)) {
2327 					zval *ret;
2328 
2329 					ALLOC_ZVAL(ret);
2330 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
2331 					zval_copy_ctor(ret);
2332 					*EG(return_value_ptr_ptr) = ret;
2333 				}
2334 				break;
2335 			}
2336 		}
2337 
2338 		if (EG(return_value_ptr_ptr)) {
2339 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
2340 			Z_ADDREF_PP(retval_ptr_ptr);
2341 
2342 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
2343 		}
2344 	} while (0);
2345 
2346 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2347 }
2348 
ZEND_THROW_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2349 static int ZEND_FASTCALL  ZEND_THROW_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2350 {
2351 	USE_OPLINE
2352 	zval *value;
2353 	zval *exception;
2354 
2355 
2356 	SAVE_OPLINE();
2357 	value = opline->op1.zv;
2358 
2359 	if (IS_CONST == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
2360 		zend_error_noreturn(E_ERROR, "Can only throw objects");
2361 	}
2362 	zend_exception_save(TSRMLS_C);
2363 	/* Not sure if a complete copy is what we want here */
2364 	ALLOC_ZVAL(exception);
2365 	INIT_PZVAL_COPY(exception, value);
2366 	if (!0) {
2367 		zval_copy_ctor(exception);
2368 	}
2369 
2370 	zend_throw_exception_object(exception TSRMLS_CC);
2371 	zend_exception_restore(TSRMLS_C);
2372 
2373 	HANDLE_EXCEPTION();
2374 }
2375 
ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2376 static int ZEND_FASTCALL  ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2377 {
2378 	USE_OPLINE
2379 
2380 	SAVE_OPLINE();
2381 	if (opline->extended_value==ZEND_DO_FCALL_BY_NAME
2382 		&& ARG_MUST_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
2383 			zend_error_noreturn(E_ERROR, "Cannot pass parameter %d by reference", opline->op2.opline_num);
2384 	}
2385 	{
2386 		zval *valptr;
2387 		zval *value;
2388 
2389 
2390 		value = opline->op1.zv;
2391 
2392 		ALLOC_ZVAL(valptr);
2393 		INIT_PZVAL_COPY(valptr, value);
2394 		if (!0) {
2395 			zval_copy_ctor(valptr);
2396 		}
2397 		zend_vm_stack_push(valptr TSRMLS_CC);
2398 
2399 	}
2400 	CHECK_EXCEPTION();
2401 	ZEND_VM_NEXT_OPCODE();
2402 }
2403 
ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2404 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2405 {
2406 	USE_OPLINE
2407 
2408 	zval *retval = &EX_T(opline->result.var).tmp_var;
2409 
2410 	SAVE_OPLINE();
2411 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
2412 	ZVAL_BOOL(retval, i_zend_is_true(opline->op1.zv));
2413 
2414 	CHECK_EXCEPTION();
2415 	ZEND_VM_NEXT_OPCODE();
2416 }
2417 
ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2418 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2419 {
2420 	USE_OPLINE
2421 
2422 	zval *obj;
2423 	zend_class_entry *ce;
2424 	zend_function *clone;
2425 	zend_object_clone_obj_t clone_call;
2426 
2427 	SAVE_OPLINE();
2428 	obj = opline->op1.zv;
2429 
2430 	if (IS_CONST == IS_CONST ||
2431 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
2432 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
2433 	}
2434 
2435 	ce = Z_OBJCE_P(obj);
2436 	clone = ce ? ce->clone : NULL;
2437 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
2438 	if (UNEXPECTED(clone_call == NULL)) {
2439 		if (ce) {
2440 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
2441 		} else {
2442 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
2443 		}
2444 	}
2445 
2446 	if (ce && clone) {
2447 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
2448 			/* Ensure that if we're calling a private function, we're allowed to do so.
2449 			 */
2450 			if (UNEXPECTED(ce != EG(scope))) {
2451 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
2452 			}
2453 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
2454 			/* Ensure that if we're calling a protected function, we're allowed to do so.
2455 			 */
2456 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
2457 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
2458 			}
2459 		}
2460 	}
2461 
2462 	if (EXPECTED(EG(exception) == NULL)) {
2463 		zval *retval;
2464 
2465 		ALLOC_ZVAL(retval);
2466 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
2467 		Z_TYPE_P(retval) = IS_OBJECT;
2468 		Z_SET_REFCOUNT_P(retval, 1);
2469 		Z_SET_ISREF_P(retval);
2470 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
2471 			zval_ptr_dtor(&retval);
2472 		} else {
2473 			AI_SET_PTR(&EX_T(opline->result.var), retval);
2474 		}
2475 	}
2476 
2477 	CHECK_EXCEPTION();
2478 	ZEND_VM_NEXT_OPCODE();
2479 }
2480 
ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2481 static int ZEND_FASTCALL  ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2482 {
2483 	USE_OPLINE
2484 
2485 	zval *expr;
2486 	zval *result = &EX_T(opline->result.var).tmp_var;
2487 
2488 	SAVE_OPLINE();
2489 	expr = opline->op1.zv;
2490 
2491 	if (opline->extended_value != IS_STRING) {
2492 		ZVAL_COPY_VALUE(result, expr);
2493 		if (!0) {
2494 			zendi_zval_copy_ctor(*result);
2495 		}
2496 	}
2497 	switch (opline->extended_value) {
2498 		case IS_NULL:
2499 			convert_to_null(result);
2500 			break;
2501 		case IS_BOOL:
2502 			convert_to_boolean(result);
2503 			break;
2504 		case IS_LONG:
2505 			convert_to_long(result);
2506 			break;
2507 		case IS_DOUBLE:
2508 			convert_to_double(result);
2509 			break;
2510 		case IS_STRING: {
2511 			zval var_copy;
2512 			int use_copy;
2513 
2514 			zend_make_printable_zval(expr, &var_copy, &use_copy);
2515 			if (use_copy) {
2516 				ZVAL_COPY_VALUE(result, &var_copy);
2517 				if (0) {
2518 
2519 				}
2520 			} else {
2521 				ZVAL_COPY_VALUE(result, expr);
2522 				if (!0) {
2523 					zendi_zval_copy_ctor(*result);
2524 				}
2525 			}
2526 			break;
2527 		}
2528 		case IS_ARRAY:
2529 			convert_to_array(result);
2530 			break;
2531 		case IS_OBJECT:
2532 			convert_to_object(result);
2533 			break;
2534 	}
2535 
2536 	CHECK_EXCEPTION();
2537 	ZEND_VM_NEXT_OPCODE();
2538 }
2539 
ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2540 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2541 {
2542 	USE_OPLINE
2543 	zend_op_array *new_op_array=NULL;
2544 
2545 	zval *inc_filename;
2546     zval *tmp_inc_filename = NULL;
2547 	zend_bool failure_retval=0;
2548 
2549 	SAVE_OPLINE();
2550 	inc_filename = opline->op1.zv;
2551 
2552 	if (inc_filename->type!=IS_STRING) {
2553 		MAKE_STD_ZVAL(tmp_inc_filename);
2554 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
2555 		zval_copy_ctor(tmp_inc_filename);
2556 		convert_to_string(tmp_inc_filename);
2557 		inc_filename = tmp_inc_filename;
2558 	}
2559 
2560 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
2561 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
2562 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2563 		} else {
2564 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2565 		}
2566 	} else {
2567 		switch (opline->extended_value) {
2568 			case ZEND_INCLUDE_ONCE:
2569 			case ZEND_REQUIRE_ONCE: {
2570 					zend_file_handle file_handle;
2571 					char *resolved_path;
2572 
2573 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
2574 					if (resolved_path) {
2575 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
2576 					} else {
2577 						resolved_path = Z_STRVAL_P(inc_filename);
2578 					}
2579 
2580 					if (failure_retval) {
2581 						/* do nothing, file already included */
2582 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
2583 
2584 						if (!file_handle.opened_path) {
2585 							file_handle.opened_path = estrdup(resolved_path);
2586 						}
2587 
2588 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
2589 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
2590 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
2591 						} else {
2592 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
2593 							failure_retval=1;
2594 						}
2595 					} else {
2596 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
2597 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2598 						} else {
2599 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2600 						}
2601 					}
2602 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
2603 						efree(resolved_path);
2604 					}
2605 				}
2606 				break;
2607 			case ZEND_INCLUDE:
2608 			case ZEND_REQUIRE:
2609 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
2610 				break;
2611 			case ZEND_EVAL: {
2612 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
2613 
2614 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
2615 					efree(eval_desc);
2616 				}
2617 				break;
2618 			EMPTY_SWITCH_DEFAULT_CASE()
2619 		}
2620 	}
2621 	if (tmp_inc_filename) {
2622 		zval_ptr_dtor(&tmp_inc_filename);
2623 	}
2624 
2625 	if (UNEXPECTED(EG(exception) != NULL)) {
2626 		HANDLE_EXCEPTION();
2627 	} else if (EXPECTED(new_op_array != NULL)) {
2628 		EX(original_return_value) = EG(return_value_ptr_ptr);
2629 		EG(active_op_array) = new_op_array;
2630 		if (RETURN_VALUE_USED(opline)) {
2631 			EX_T(opline->result.var).var.ptr = NULL;
2632 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2633 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
2634 		} else {
2635 			EG(return_value_ptr_ptr) = NULL;
2636 		}
2637 
2638 		EX(current_object) = EX(object);
2639 
2640 		EX(function_state).function = (zend_function *) new_op_array;
2641 		EX(object) = NULL;
2642 
2643 		if (!EG(active_symbol_table)) {
2644 			zend_rebuild_symbol_table(TSRMLS_C);
2645 		}
2646 
2647 		if (EXPECTED(zend_execute == execute)) {
2648 			ZEND_VM_ENTER();
2649 		} else {
2650 			zend_execute(new_op_array TSRMLS_CC);
2651 		}
2652 
2653 		EX(function_state).function = (zend_function *) EX(op_array);
2654 		EX(object) = EX(current_object);
2655 
2656 		EG(opline_ptr) = &EX(opline);
2657 		EG(active_op_array) = EX(op_array);
2658 		EG(return_value_ptr_ptr) = EX(original_return_value);
2659 		destroy_op_array(new_op_array TSRMLS_CC);
2660 		efree(new_op_array);
2661 		if (UNEXPECTED(EG(exception) != NULL)) {
2662 			zend_throw_exception_internal(NULL TSRMLS_CC);
2663 			HANDLE_EXCEPTION();
2664 		} else if (RETURN_VALUE_USED(opline)) {
2665 			if (!EX_T(opline->result.var).var.ptr) { /* there was no return statement */
2666 				zval *retval;
2667 
2668 				ALLOC_ZVAL(retval);
2669 				ZVAL_BOOL(retval, 1);
2670 				INIT_PZVAL(retval);
2671 				EX_T(opline->result.var).var.ptr = retval;
2672 			}
2673 		}
2674 
2675 	} else if (RETURN_VALUE_USED(opline)) {
2676 		zval *retval;
2677 
2678 		ALLOC_ZVAL(retval);
2679 		ZVAL_BOOL(retval, failure_retval);
2680 		INIT_PZVAL(retval);
2681 		AI_SET_PTR(&EX_T(opline->result.var), retval);
2682 	}
2683 	ZEND_VM_NEXT_OPCODE();
2684 }
2685 
ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2686 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2687 {
2688 	USE_OPLINE
2689 
2690 	zval *array_ptr, **array_ptr_ptr;
2691 	HashTable *fe_ht;
2692 	zend_object_iterator *iter = NULL;
2693 	zend_class_entry *ce = NULL;
2694 	zend_bool is_empty = 0;
2695 
2696 	SAVE_OPLINE();
2697 
2698 	if ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2699 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
2700 		array_ptr_ptr = NULL;
2701 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
2702 			MAKE_STD_ZVAL(array_ptr);
2703 			ZVAL_NULL(array_ptr);
2704 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
2705 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
2706 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
2707 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
2708 			}
2709 
2710 			ce = Z_OBJCE_PP(array_ptr_ptr);
2711 			if (!ce || ce->get_iterator == NULL) {
2712 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
2713 				Z_ADDREF_PP(array_ptr_ptr);
2714 			}
2715 			array_ptr = *array_ptr_ptr;
2716 		} else {
2717 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
2718 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
2719 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
2720 					Z_SET_ISREF_PP(array_ptr_ptr);
2721 				}
2722 			}
2723 			array_ptr = *array_ptr_ptr;
2724 			Z_ADDREF_P(array_ptr);
2725 		}
2726 	} else {
2727 		array_ptr = opline->op1.zv;
2728 		if (0) { /* IS_TMP_VAR */
2729 			zval *tmp;
2730 
2731 			ALLOC_ZVAL(tmp);
2732 			INIT_PZVAL_COPY(tmp, array_ptr);
2733 			array_ptr = tmp;
2734 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
2735 				ce = Z_OBJCE_P(array_ptr);
2736 				if (ce && ce->get_iterator) {
2737 					Z_DELREF_P(array_ptr);
2738 				}
2739 			}
2740 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
2741 			ce = Z_OBJCE_P(array_ptr);
2742 			if (!ce || !ce->get_iterator) {
2743 				Z_ADDREF_P(array_ptr);
2744 			}
2745 		} else if (IS_CONST == IS_CONST ||
2746 		           ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2747 		            !Z_ISREF_P(array_ptr) &&
2748 		            Z_REFCOUNT_P(array_ptr) > 1)) {
2749 			zval *tmp;
2750 
2751 			ALLOC_ZVAL(tmp);
2752 			INIT_PZVAL_COPY(tmp, array_ptr);
2753 			zval_copy_ctor(tmp);
2754 			array_ptr = tmp;
2755 		} else {
2756 			Z_ADDREF_P(array_ptr);
2757 		}
2758 	}
2759 
2760 	if (ce && ce->get_iterator) {
2761 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
2762 
2763 		if (iter && EXPECTED(EG(exception) == NULL)) {
2764 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
2765 		} else {
2766 
2767 			if (!EG(exception)) {
2768 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
2769 			}
2770 			zend_throw_exception_internal(NULL TSRMLS_CC);
2771 			HANDLE_EXCEPTION();
2772 		}
2773 	}
2774 
2775 	EX_T(opline->result.var).fe.ptr = array_ptr;
2776 
2777 	if (iter) {
2778 		iter->index = 0;
2779 		if (iter->funcs->rewind) {
2780 			iter->funcs->rewind(iter TSRMLS_CC);
2781 			if (UNEXPECTED(EG(exception) != NULL)) {
2782 				zval_ptr_dtor(&array_ptr);
2783 
2784 				HANDLE_EXCEPTION();
2785 			}
2786 		}
2787 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
2788 		if (UNEXPECTED(EG(exception) != NULL)) {
2789 			zval_ptr_dtor(&array_ptr);
2790 
2791 			HANDLE_EXCEPTION();
2792 		}
2793 		iter->index = -1; /* will be set to 0 before using next handler */
2794 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
2795 		zend_hash_internal_pointer_reset(fe_ht);
2796 		if (ce) {
2797 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
2798 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
2799 				char *str_key;
2800 				uint str_key_len;
2801 				ulong int_key;
2802 				zend_uchar key_type;
2803 
2804 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
2805 				if (key_type != HASH_KEY_NON_EXISTANT &&
2806 					(key_type == HASH_KEY_IS_LONG ||
2807 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
2808 					break;
2809 				}
2810 				zend_hash_move_forward(fe_ht);
2811 			}
2812 		}
2813 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
2814 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
2815 	} else {
2816 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
2817 		is_empty = 1;
2818 	}
2819 
2820 	if (is_empty) {
2821 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
2822 	} else {
2823 		CHECK_EXCEPTION();
2824 		ZEND_VM_NEXT_OPCODE();
2825 	}
2826 }
2827 
ZEND_EXIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2828 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2829 {
2830 #if 0 || (IS_CONST != IS_UNUSED)
2831 	USE_OPLINE
2832 
2833 	SAVE_OPLINE();
2834 	if (IS_CONST != IS_UNUSED) {
2835 
2836 		zval *ptr = opline->op1.zv;
2837 
2838 		if (Z_TYPE_P(ptr) == IS_LONG) {
2839 			EG(exit_status) = Z_LVAL_P(ptr);
2840 		} else {
2841 			zend_print_variable(ptr);
2842 		}
2843 
2844 	}
2845 #endif
2846 	zend_bailout();
2847 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
2848 }
2849 
ZEND_JMP_SET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2850 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2851 {
2852 	USE_OPLINE
2853 
2854 	zval *value;
2855 
2856 	SAVE_OPLINE();
2857 	value = opline->op1.zv;
2858 
2859 	if (i_zend_is_true(value)) {
2860 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
2861 		if (!0) {
2862 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
2863 		}
2864 
2865 #if DEBUG_ZEND>=2
2866 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2867 #endif
2868 		ZEND_VM_JMP(opline->op2.jmp_addr);
2869 	}
2870 
2871 	CHECK_EXCEPTION();
2872 	ZEND_VM_NEXT_OPCODE();
2873 }
2874 
ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2875 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2876 {
2877 	USE_OPLINE
2878 
2879 	zval *value, *ret;
2880 
2881 	SAVE_OPLINE();
2882 	value = opline->op1.zv;
2883 
2884 	if (i_zend_is_true(value)) {
2885 		if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
2886 			Z_ADDREF_P(value);
2887 			EX_T(opline->result.var).var.ptr = value;
2888 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2889 		} else {
2890 			ALLOC_ZVAL(ret);
2891 			INIT_PZVAL_COPY(ret, value);
2892 			EX_T(opline->result.var).var.ptr = ret;
2893 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2894 			if (!0) {
2895 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
2896 			}
2897 		}
2898 
2899 #if DEBUG_ZEND>=2
2900 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2901 #endif
2902 		ZEND_VM_JMP(opline->op2.jmp_addr);
2903 	}
2904 
2905 	CHECK_EXCEPTION();
2906 	ZEND_VM_NEXT_OPCODE();
2907 }
2908 
ZEND_QM_ASSIGN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2909 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2910 {
2911 	USE_OPLINE
2912 
2913 	zval *value;
2914 
2915 	SAVE_OPLINE();
2916 	value = opline->op1.zv;
2917 
2918 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
2919 	if (!0) {
2920 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
2921 	}
2922 
2923 	CHECK_EXCEPTION();
2924 	ZEND_VM_NEXT_OPCODE();
2925 }
2926 
ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2927 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2928 {
2929 	USE_OPLINE
2930 
2931 	zval *value, *ret;
2932 
2933 	SAVE_OPLINE();
2934 	value = opline->op1.zv;
2935 
2936 	if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
2937 		Z_ADDREF_P(value);
2938 		EX_T(opline->result.var).var.ptr = value;
2939 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2940 	} else {
2941 		ALLOC_ZVAL(ret);
2942 		INIT_PZVAL_COPY(ret, value);
2943 		EX_T(opline->result.var).var.ptr = ret;
2944 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2945 		if (!0) {
2946 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
2947 		}
2948 	}
2949 
2950 	CHECK_EXCEPTION();
2951 	ZEND_VM_NEXT_OPCODE();
2952 }
2953 
ZEND_ADD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2954 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2955 {
2956 	USE_OPLINE
2957 
2958 
2959 	SAVE_OPLINE();
2960 	fast_add_function(&EX_T(opline->result.var).tmp_var,
2961 		opline->op1.zv,
2962 		opline->op2.zv TSRMLS_CC);
2963 
2964 
2965 	CHECK_EXCEPTION();
2966 	ZEND_VM_NEXT_OPCODE();
2967 }
2968 
ZEND_SUB_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2969 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2970 {
2971 	USE_OPLINE
2972 
2973 
2974 	SAVE_OPLINE();
2975 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
2976 		opline->op1.zv,
2977 		opline->op2.zv TSRMLS_CC);
2978 
2979 
2980 	CHECK_EXCEPTION();
2981 	ZEND_VM_NEXT_OPCODE();
2982 }
2983 
ZEND_MUL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2984 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2985 {
2986 	USE_OPLINE
2987 
2988 
2989 	SAVE_OPLINE();
2990 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
2991 		opline->op1.zv,
2992 		opline->op2.zv TSRMLS_CC);
2993 
2994 
2995 	CHECK_EXCEPTION();
2996 	ZEND_VM_NEXT_OPCODE();
2997 }
2998 
ZEND_DIV_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2999 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3000 {
3001 	USE_OPLINE
3002 
3003 
3004 	SAVE_OPLINE();
3005 	fast_div_function(&EX_T(opline->result.var).tmp_var,
3006 		opline->op1.zv,
3007 		opline->op2.zv TSRMLS_CC);
3008 
3009 
3010 	CHECK_EXCEPTION();
3011 	ZEND_VM_NEXT_OPCODE();
3012 }
3013 
ZEND_MOD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3014 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3015 {
3016 	USE_OPLINE
3017 
3018 
3019 	SAVE_OPLINE();
3020 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
3021 		opline->op1.zv,
3022 		opline->op2.zv TSRMLS_CC);
3023 
3024 
3025 	CHECK_EXCEPTION();
3026 	ZEND_VM_NEXT_OPCODE();
3027 }
3028 
ZEND_SL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3029 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3030 {
3031 	USE_OPLINE
3032 
3033 
3034 	SAVE_OPLINE();
3035 	shift_left_function(&EX_T(opline->result.var).tmp_var,
3036 		opline->op1.zv,
3037 		opline->op2.zv TSRMLS_CC);
3038 
3039 
3040 	CHECK_EXCEPTION();
3041 	ZEND_VM_NEXT_OPCODE();
3042 }
3043 
ZEND_SR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3044 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3045 {
3046 	USE_OPLINE
3047 
3048 
3049 	SAVE_OPLINE();
3050 	shift_right_function(&EX_T(opline->result.var).tmp_var,
3051 		opline->op1.zv,
3052 		opline->op2.zv TSRMLS_CC);
3053 
3054 
3055 	CHECK_EXCEPTION();
3056 	ZEND_VM_NEXT_OPCODE();
3057 }
3058 
ZEND_CONCAT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3059 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3060 {
3061 	USE_OPLINE
3062 
3063 
3064 	SAVE_OPLINE();
3065 	concat_function(&EX_T(opline->result.var).tmp_var,
3066 		opline->op1.zv,
3067 		opline->op2.zv TSRMLS_CC);
3068 
3069 
3070 	CHECK_EXCEPTION();
3071 	ZEND_VM_NEXT_OPCODE();
3072 }
3073 
ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3074 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3075 {
3076 	USE_OPLINE
3077 
3078 
3079 	SAVE_OPLINE();
3080 	is_identical_function(&EX_T(opline->result.var).tmp_var,
3081 		opline->op1.zv,
3082 		opline->op2.zv TSRMLS_CC);
3083 
3084 
3085 	CHECK_EXCEPTION();
3086 	ZEND_VM_NEXT_OPCODE();
3087 }
3088 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3089 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3090 {
3091 	USE_OPLINE
3092 
3093 	zval *result = &EX_T(opline->result.var).tmp_var;
3094 
3095 	SAVE_OPLINE();
3096 	is_identical_function(result,
3097 		opline->op1.zv,
3098 		opline->op2.zv TSRMLS_CC);
3099 	Z_LVAL_P(result) = !Z_LVAL_P(result);
3100 
3101 
3102 	CHECK_EXCEPTION();
3103 	ZEND_VM_NEXT_OPCODE();
3104 }
3105 
ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3106 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3107 {
3108 	USE_OPLINE
3109 
3110 	zval *result = &EX_T(opline->result.var).tmp_var;
3111 
3112 	SAVE_OPLINE();
3113 	ZVAL_BOOL(result, fast_equal_function(result,
3114 		opline->op1.zv,
3115 		opline->op2.zv TSRMLS_CC));
3116 
3117 
3118 	CHECK_EXCEPTION();
3119 	ZEND_VM_NEXT_OPCODE();
3120 }
3121 
ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3122 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3123 {
3124 	USE_OPLINE
3125 
3126 	zval *result = &EX_T(opline->result.var).tmp_var;
3127 
3128 	SAVE_OPLINE();
3129 	ZVAL_BOOL(result, fast_not_equal_function(result,
3130 		opline->op1.zv,
3131 		opline->op2.zv TSRMLS_CC));
3132 
3133 
3134 	CHECK_EXCEPTION();
3135 	ZEND_VM_NEXT_OPCODE();
3136 }
3137 
ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3138 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3139 {
3140 	USE_OPLINE
3141 
3142 	zval *result = &EX_T(opline->result.var).tmp_var;
3143 
3144 	SAVE_OPLINE();
3145 	ZVAL_BOOL(result, fast_is_smaller_function(result,
3146 		opline->op1.zv,
3147 		opline->op2.zv TSRMLS_CC));
3148 
3149 
3150 	CHECK_EXCEPTION();
3151 	ZEND_VM_NEXT_OPCODE();
3152 }
3153 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3154 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3155 {
3156 	USE_OPLINE
3157 
3158 	zval *result = &EX_T(opline->result.var).tmp_var;
3159 
3160 	SAVE_OPLINE();
3161 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
3162 		opline->op1.zv,
3163 		opline->op2.zv TSRMLS_CC));
3164 
3165 
3166 	CHECK_EXCEPTION();
3167 	ZEND_VM_NEXT_OPCODE();
3168 }
3169 
ZEND_BW_OR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3170 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3171 {
3172 	USE_OPLINE
3173 
3174 
3175 	SAVE_OPLINE();
3176 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
3177 		opline->op1.zv,
3178 		opline->op2.zv TSRMLS_CC);
3179 
3180 
3181 	CHECK_EXCEPTION();
3182 	ZEND_VM_NEXT_OPCODE();
3183 }
3184 
ZEND_BW_AND_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3185 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3186 {
3187 	USE_OPLINE
3188 
3189 
3190 	SAVE_OPLINE();
3191 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
3192 		opline->op1.zv,
3193 		opline->op2.zv TSRMLS_CC);
3194 
3195 
3196 	CHECK_EXCEPTION();
3197 	ZEND_VM_NEXT_OPCODE();
3198 }
3199 
ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3200 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3201 {
3202 	USE_OPLINE
3203 
3204 
3205 	SAVE_OPLINE();
3206 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
3207 		opline->op1.zv,
3208 		opline->op2.zv TSRMLS_CC);
3209 
3210 
3211 	CHECK_EXCEPTION();
3212 	ZEND_VM_NEXT_OPCODE();
3213 }
3214 
ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3215 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3216 {
3217 	USE_OPLINE
3218 
3219 
3220 	SAVE_OPLINE();
3221 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
3222 		opline->op1.zv,
3223 		opline->op2.zv TSRMLS_CC);
3224 
3225 
3226 	CHECK_EXCEPTION();
3227 	ZEND_VM_NEXT_OPCODE();
3228 }
3229 
zend_fetch_var_address_helper_SPEC_CONST_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)3230 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
3231 {
3232 	USE_OPLINE
3233 	zend_free_op free_op1;
3234 	zval *varname;
3235 	zval **retval;
3236 	zval tmp_varname;
3237 	HashTable *target_symbol_table;
3238 	ulong hash_value;
3239 
3240 	SAVE_OPLINE();
3241 	varname = opline->op1.zv;
3242 
3243  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
3244 		ZVAL_COPY_VALUE(&tmp_varname, varname);
3245 		zval_copy_ctor(&tmp_varname);
3246 		Z_SET_REFCOUNT(tmp_varname, 1);
3247 		Z_UNSET_ISREF(tmp_varname);
3248 		convert_to_string(&tmp_varname);
3249 		varname = &tmp_varname;
3250 	}
3251 
3252 	if (IS_CONST != IS_UNUSED) {
3253 		zend_class_entry *ce;
3254 
3255 		if (IS_CONST == IS_CONST) {
3256 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3257 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
3258 			} else {
3259 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3260 				if (UNEXPECTED(ce == NULL)) {
3261 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
3262 						zval_dtor(&tmp_varname);
3263 					}
3264 
3265 					CHECK_EXCEPTION();
3266 					ZEND_VM_NEXT_OPCODE();
3267 				}
3268 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
3269 			}
3270 		} else {
3271 			ce = EX_T(opline->op2.var).class_entry;
3272 		}
3273 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3274 
3275 	} else {
3276 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
3277 /*
3278 		if (!target_symbol_table) {
3279 			CHECK_EXCEPTION();
3280 			ZEND_VM_NEXT_OPCODE();
3281 		}
3282 */
3283 		if (IS_CONST == IS_CONST) {
3284 			hash_value = Z_HASH_P(varname);
3285 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
3286 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
3287 		} else {
3288 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
3289 		}
3290 
3291 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
3292 			switch (type) {
3293 				case BP_VAR_R:
3294 				case BP_VAR_UNSET:
3295 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
3296 					/* break missing intentionally */
3297 				case BP_VAR_IS:
3298 					retval = &EG(uninitialized_zval_ptr);
3299 					break;
3300 				case BP_VAR_RW:
3301 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
3302 					/* break missing intentionally */
3303 				case BP_VAR_W:
3304 					Z_ADDREF_P(&EG(uninitialized_zval));
3305 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
3306 					break;
3307 				EMPTY_SWITCH_DEFAULT_CASE()
3308 			}
3309 		}
3310 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
3311 			case ZEND_FETCH_GLOBAL:
3312 				if (IS_CONST != IS_TMP_VAR) {
3313 
3314 				}
3315 				break;
3316 			case ZEND_FETCH_LOCAL:
3317 
3318 				break;
3319 			case ZEND_FETCH_STATIC:
3320 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
3321 				break;
3322 			case ZEND_FETCH_GLOBAL_LOCK:
3323 				if (IS_CONST == IS_VAR && !free_op1.var) {
3324 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
3325 				}
3326 				break;
3327 		}
3328 	}
3329 
3330 
3331 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
3332 		zval_dtor(&tmp_varname);
3333 	}
3334 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
3335 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
3336 	}
3337 	PZVAL_LOCK(*retval);
3338 	switch (type) {
3339 		case BP_VAR_R:
3340 		case BP_VAR_IS:
3341 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
3342 			break;
3343 		case BP_VAR_UNSET: {
3344 			zend_free_op free_res;
3345 
3346 			PZVAL_UNLOCK(*retval, &free_res);
3347 			if (retval != &EG(uninitialized_zval_ptr)) {
3348 				SEPARATE_ZVAL_IF_NOT_REF(retval);
3349 			}
3350 			PZVAL_LOCK(*retval);
3351 			FREE_OP_VAR_PTR(free_res);
3352 		}
3353 		/* break missing intentionally */
3354 		default:
3355 			EX_T(opline->result.var).var.ptr_ptr = retval;
3356 			break;
3357 	}
3358 	CHECK_EXCEPTION();
3359 	ZEND_VM_NEXT_OPCODE();
3360 }
3361 
ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3362 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3363 {
3364 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3365 }
3366 
ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3367 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3368 {
3369 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3370 }
3371 
ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3372 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3373 {
3374 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3375 }
3376 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3377 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3378 {
3379 	USE_OPLINE
3380 
3381 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3382 }
3383 
ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3384 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3385 {
3386 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3387 }
3388 
ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3389 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3390 {
3391 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3392 }
3393 
ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3394 static int ZEND_FASTCALL  ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3395 {
3396 	USE_OPLINE
3397 
3398 	zval *container;
3399 
3400 	SAVE_OPLINE();
3401 	container = opline->op1.zv;
3402 
3403 	if (UNEXPECTED(Z_TYPE_P(container) != IS_ARRAY)) {
3404 		PZVAL_LOCK(&EG(uninitialized_zval));
3405 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
3406 	} else {
3407 
3408 		zval *value = *zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
3409 
3410 		PZVAL_LOCK(value);
3411 		AI_SET_PTR(&EX_T(opline->result.var), value);
3412 
3413 	}
3414 	CHECK_EXCEPTION();
3415 	ZEND_VM_NEXT_OPCODE();
3416 }
3417 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3418 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3419 {
3420 	USE_OPLINE
3421 	zval *function_name;
3422 	zend_class_entry *ce;
3423 
3424 	SAVE_OPLINE();
3425 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
3426 
3427 	if (IS_CONST == IS_CONST) {
3428 		/* no function found. try a static method in class */
3429 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
3430 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
3431 		} else {
3432 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
3433 			if (UNEXPECTED(EG(exception) != NULL)) {
3434 				HANDLE_EXCEPTION();
3435 			}
3436 			if (UNEXPECTED(ce == NULL)) {
3437 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
3438 			}
3439 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
3440 		}
3441 		EX(called_scope) = ce;
3442 	} else {
3443 		ce = EX_T(opline->op1.var).class_entry;
3444 
3445 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
3446 			EX(called_scope) = EG(called_scope);
3447 		} else {
3448 			EX(called_scope) = ce;
3449 		}
3450 	}
3451 
3452 	if (IS_CONST == IS_CONST &&
3453 	    IS_CONST == IS_CONST &&
3454 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
3455 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
3456 	} else if (IS_CONST != IS_CONST &&
3457 	           IS_CONST == IS_CONST &&
3458 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
3459 		/* do nothing */
3460 	} else if (IS_CONST != IS_UNUSED) {
3461 		char *function_name_strval = NULL;
3462 		int function_name_strlen = 0;
3463 
3464 
3465 		if (IS_CONST == IS_CONST) {
3466 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
3467 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
3468 		} else {
3469 			function_name = opline->op2.zv;
3470 
3471 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
3472 				zend_error_noreturn(E_ERROR, "Function name must be a string");
3473 			} else {
3474 				function_name_strval = Z_STRVAL_P(function_name);
3475 				function_name_strlen = Z_STRLEN_P(function_name);
3476  			}
3477 		}
3478 
3479 		if (function_name_strval) {
3480 			if (ce->get_static_method) {
3481 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
3482 			} else {
3483 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
3484 			}
3485 			if (UNEXPECTED(EX(fbc) == NULL)) {
3486 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
3487 			}
3488 			if (IS_CONST == IS_CONST &&
3489 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
3490 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
3491 				if (IS_CONST == IS_CONST) {
3492 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
3493 				} else {
3494 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
3495 				}
3496 			}
3497 		}
3498 		if (IS_CONST != IS_CONST) {
3499 
3500 		}
3501 	} else {
3502 		if (UNEXPECTED(ce->constructor == NULL)) {
3503 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
3504 		}
3505 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
3506 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
3507 		}
3508 		EX(fbc) = ce->constructor;
3509 	}
3510 
3511 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
3512 		EX(object) = NULL;
3513 	} else {
3514 		if (EG(This) &&
3515 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
3516 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
3517 		    /* We are calling method of the other (incompatible) class,
3518 		       but passing $this. This is done for compatibility with php-4. */
3519 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
3520 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
3521 			} else {
3522 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
3523 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
3524 			}
3525 		}
3526 		if ((EX(object) = EG(This))) {
3527 			Z_ADDREF_P(EX(object));
3528 			EX(called_scope) = Z_OBJCE_P(EX(object));
3529 		}
3530 	}
3531 
3532 	CHECK_EXCEPTION();
3533 	ZEND_VM_NEXT_OPCODE();
3534 }
3535 
ZEND_CASE_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3536 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3537 {
3538 	USE_OPLINE
3539 
3540 
3541 	SAVE_OPLINE();
3542 	if (IS_CONST==IS_VAR) {
3543 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
3544 	}
3545 	is_equal_function(&EX_T(opline->result.var).tmp_var,
3546 				 opline->op1.zv,
3547 				 opline->op2.zv TSRMLS_CC);
3548 
3549 	CHECK_EXCEPTION();
3550 	ZEND_VM_NEXT_OPCODE();
3551 }
3552 
ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3553 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3554 {
3555 	USE_OPLINE
3556 
3557 	SAVE_OPLINE();
3558 	if (IS_CONST == IS_UNUSED) {
3559 		zend_constant *c;
3560 		zval *retval;
3561 
3562 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3563 			c = CACHED_PTR(opline->op2.literal->cache_slot);
3564 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
3565 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
3566 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
3567 				if(!actual) {
3568 					actual = Z_STRVAL_P(opline->op2.zv);
3569 				} else {
3570 					actual++;
3571 				}
3572 				/* non-qualified constant - allow text substitution */
3573 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
3574 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
3575 				CHECK_EXCEPTION();
3576 				ZEND_VM_NEXT_OPCODE();
3577 			} else {
3578 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
3579 			}
3580 		} else {
3581 			CACHE_PTR(opline->op2.literal->cache_slot, c);
3582 		}
3583 		retval = &EX_T(opline->result.var).tmp_var;
3584 		ZVAL_COPY_VALUE(retval, &c->value);
3585 		zval_copy_ctor(retval);
3586 		CHECK_EXCEPTION();
3587 		ZEND_VM_NEXT_OPCODE();
3588 	} else {
3589 		/* class constant */
3590 		zend_class_entry *ce;
3591 		zval **value;
3592 
3593 		if (IS_CONST == IS_CONST) {
3594 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3595 				value = CACHED_PTR(opline->op2.literal->cache_slot);
3596 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3597 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3598 				CHECK_EXCEPTION();
3599 				ZEND_VM_NEXT_OPCODE();
3600 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
3601 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
3602 			} else {
3603 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
3604 				if (UNEXPECTED(EG(exception) != NULL)) {
3605 					HANDLE_EXCEPTION();
3606 				}
3607 				if (UNEXPECTED(ce == NULL)) {
3608 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
3609 				}
3610 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
3611 			}
3612 		} else {
3613 			ce = EX_T(opline->op1.var).class_entry;
3614 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
3615 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3616 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3617 				CHECK_EXCEPTION();
3618 				ZEND_VM_NEXT_OPCODE();
3619 			}
3620 		}
3621 
3622 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
3623 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
3624 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
3625 				zend_class_entry *old_scope = EG(scope);
3626 
3627 				EG(scope) = ce;
3628 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
3629 				EG(scope) = old_scope;
3630 			}
3631 			if (IS_CONST == IS_CONST) {
3632 				CACHE_PTR(opline->op2.literal->cache_slot, value);
3633 			} else {
3634 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
3635 			}
3636 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3637 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3638 		} else {
3639 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
3640 		}
3641 
3642 		CHECK_EXCEPTION();
3643 		ZEND_VM_NEXT_OPCODE();
3644 	}
3645 }
3646 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3647 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3648 {
3649 	USE_OPLINE
3650 
3651 	zval *expr_ptr;
3652 
3653 	SAVE_OPLINE();
3654 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
3655 		zval **expr_ptr_ptr = NULL;
3656 
3657 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
3658 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
3659 		}
3660 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
3661 		expr_ptr = *expr_ptr_ptr;
3662 		Z_ADDREF_P(expr_ptr);
3663 	} else {
3664 		expr_ptr=opline->op1.zv;
3665 		if (0) { /* temporary variable */
3666 			zval *new_expr;
3667 
3668 			ALLOC_ZVAL(new_expr);
3669 			INIT_PZVAL_COPY(new_expr, expr_ptr);
3670 			expr_ptr = new_expr;
3671 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
3672 			zval *new_expr;
3673 
3674 			ALLOC_ZVAL(new_expr);
3675 			INIT_PZVAL_COPY(new_expr, expr_ptr);
3676 			expr_ptr = new_expr;
3677 			zendi_zval_copy_ctor(*expr_ptr);
3678 		} else {
3679 			Z_ADDREF_P(expr_ptr);
3680 		}
3681 	}
3682 
3683 	if (IS_CONST != IS_UNUSED) {
3684 
3685 		zval *offset = opline->op2.zv;
3686 		ulong hval;
3687 
3688 		switch (Z_TYPE_P(offset)) {
3689 			case IS_DOUBLE:
3690 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
3691 				goto num_index;
3692 			case IS_LONG:
3693 			case IS_BOOL:
3694 				hval = Z_LVAL_P(offset);
3695 num_index:
3696 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
3697 				break;
3698 			case IS_STRING:
3699 				if (IS_CONST == IS_CONST) {
3700 					hval = Z_HASH_P(offset);
3701 				} else {
3702 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
3703 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
3704 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
3705 					} else {
3706 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
3707 					}
3708 				}
3709 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
3710 				break;
3711 			case IS_NULL:
3712 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
3713 				break;
3714 			default:
3715 				zend_error(E_WARNING, "Illegal offset type");
3716 				zval_ptr_dtor(&expr_ptr);
3717 				/* do nothing */
3718 				break;
3719 		}
3720 
3721 	} else {
3722 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
3723 	}
3724 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
3725 
3726 	} else {
3727 
3728 	}
3729 	CHECK_EXCEPTION();
3730 	ZEND_VM_NEXT_OPCODE();
3731 }
3732 
ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3733 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3734 {
3735 	USE_OPLINE
3736 
3737 	array_init(&EX_T(opline->result.var).tmp_var);
3738 	if (IS_CONST == IS_UNUSED) {
3739 		ZEND_VM_NEXT_OPCODE();
3740 #if 0 || IS_CONST != IS_UNUSED
3741 	} else {
3742 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3743 #endif
3744 	}
3745 }
3746 
ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3747 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3748 {
3749 	USE_OPLINE
3750 	zval tmp, *varname;
3751 	HashTable *target_symbol_table;
3752 
3753 
3754 	SAVE_OPLINE();
3755 	if (IS_CONST == IS_CV &&
3756 	    IS_CONST == IS_UNUSED &&
3757 	    (opline->extended_value & ZEND_QUICK_SET)) {
3758 		if (EG(active_symbol_table)) {
3759 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
3760 
3761 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
3762 			EX_CV(opline->op1.var) = NULL;
3763 		} else if (EX_CV(opline->op1.var)) {
3764 			zval_ptr_dtor(EX_CV(opline->op1.var));
3765 			EX_CV(opline->op1.var) = NULL;
3766 		}
3767 		CHECK_EXCEPTION();
3768 		ZEND_VM_NEXT_OPCODE();
3769 	}
3770 
3771 	varname = opline->op1.zv;
3772 
3773 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
3774 		ZVAL_COPY_VALUE(&tmp, varname);
3775 		zval_copy_ctor(&tmp);
3776 		convert_to_string(&tmp);
3777 		varname = &tmp;
3778 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3779 		Z_ADDREF_P(varname);
3780 	}
3781 
3782 	if (IS_CONST != IS_UNUSED) {
3783 		zend_class_entry *ce;
3784 
3785 		if (IS_CONST == IS_CONST) {
3786 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3787 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
3788 			} else {
3789 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3790 				if (UNEXPECTED(EG(exception) != NULL)) {
3791 					if (IS_CONST != IS_CONST && varname == &tmp) {
3792 						zval_dtor(&tmp);
3793 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3794 						zval_ptr_dtor(&varname);
3795 					}
3796 
3797 					HANDLE_EXCEPTION();
3798 				}
3799 				if (UNEXPECTED(ce == NULL)) {
3800 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
3801 				}
3802 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
3803 			}
3804 		} else {
3805 			ce = EX_T(opline->op2.var).class_entry;
3806 		}
3807 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3808 	} else {
3809 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
3810 
3811 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
3812 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
3813 	}
3814 
3815 	if (IS_CONST != IS_CONST && varname == &tmp) {
3816 		zval_dtor(&tmp);
3817 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3818 		zval_ptr_dtor(&varname);
3819 	}
3820 
3821 	CHECK_EXCEPTION();
3822 	ZEND_VM_NEXT_OPCODE();
3823 }
3824 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3825 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3826 {
3827 	USE_OPLINE
3828 	zval **value;
3829 	zend_bool isset = 1;
3830 
3831 	SAVE_OPLINE();
3832 	if (IS_CONST == IS_CV &&
3833 	    IS_CONST == IS_UNUSED &&
3834 	    (opline->extended_value & ZEND_QUICK_SET)) {
3835 		if (EX_CV(opline->op1.var)) {
3836 			value = EX_CV(opline->op1.var);
3837 		} else if (EG(active_symbol_table)) {
3838 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
3839 
3840 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
3841 				isset = 0;
3842 			}
3843 		} else {
3844 			isset = 0;
3845 		}
3846 	} else {
3847 		HashTable *target_symbol_table;
3848 
3849 		zval tmp, *varname = opline->op1.zv;
3850 
3851 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
3852 			ZVAL_COPY_VALUE(&tmp, varname);
3853 			zval_copy_ctor(&tmp);
3854 			convert_to_string(&tmp);
3855 			varname = &tmp;
3856 		}
3857 
3858 		if (IS_CONST != IS_UNUSED) {
3859 			zend_class_entry *ce;
3860 
3861 			if (IS_CONST == IS_CONST) {
3862 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3863 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
3864 				} else {
3865 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3866 					if (UNEXPECTED(ce == NULL)) {
3867 						CHECK_EXCEPTION();
3868 						ZEND_VM_NEXT_OPCODE();
3869 					}
3870 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
3871 				}
3872 			} else {
3873 				ce = EX_T(opline->op2.var).class_entry;
3874 			}
3875 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3876 			if (!value) {
3877 				isset = 0;
3878 			}
3879 		} else {
3880 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
3881 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
3882 				isset = 0;
3883 			}
3884 		}
3885 
3886 		if (IS_CONST != IS_CONST && varname == &tmp) {
3887 			zval_dtor(&tmp);
3888 		}
3889 
3890 	}
3891 
3892 	if (opline->extended_value & ZEND_ISSET) {
3893 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
3894 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
3895 		} else {
3896 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
3897 		}
3898 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
3899 		if (!isset || !i_zend_is_true(*value)) {
3900 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
3901 		} else {
3902 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
3903 		}
3904 	}
3905 
3906 	CHECK_EXCEPTION();
3907 	ZEND_VM_NEXT_OPCODE();
3908 }
3909 
ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3910 static int ZEND_FASTCALL  ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3911 {
3912 	USE_OPLINE
3913 
3914 	zval *name;
3915 	zval *val;
3916 	zend_constant c;
3917 
3918 	SAVE_OPLINE();
3919 	name  = opline->op1.zv;
3920 	val   = opline->op2.zv;
3921 
3922 	if ((Z_TYPE_P(val) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT || Z_TYPE_P(val) == IS_CONSTANT_ARRAY) {
3923 		zval tmp;
3924 		zval *tmp_ptr = &tmp;
3925 
3926 		ZVAL_COPY_VALUE(&tmp, val);
3927 		if (Z_TYPE_P(val) == IS_CONSTANT_ARRAY) {
3928 			zval_copy_ctor(&tmp);
3929 		}
3930 		INIT_PZVAL(&tmp);
3931 		zval_update_constant(&tmp_ptr, NULL TSRMLS_CC);
3932 		c.value = *tmp_ptr;
3933 	} else {
3934 		INIT_PZVAL_COPY(&c.value, val);
3935 		zval_copy_ctor(&c.value);
3936 	}
3937 	c.flags = CONST_CS; /* non persistent, case sensetive */
3938 	c.name = IS_INTERNED(Z_STRVAL_P(name)) ? Z_STRVAL_P(name) : zend_strndup(Z_STRVAL_P(name), Z_STRLEN_P(name));
3939 	c.name_len = Z_STRLEN_P(name)+1;
3940 	c.module_number = PHP_USER_CONSTANT;
3941 
3942 	if (zend_register_constant(&c TSRMLS_CC) == FAILURE) {
3943 	}
3944 
3945 
3946 	CHECK_EXCEPTION();
3947 	ZEND_VM_NEXT_OPCODE();
3948 }
3949 
ZEND_ADD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3950 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3951 {
3952 	USE_OPLINE
3953 	zend_free_op free_op2;
3954 
3955 	SAVE_OPLINE();
3956 	fast_add_function(&EX_T(opline->result.var).tmp_var,
3957 		opline->op1.zv,
3958 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
3959 
3960 	zval_dtor(free_op2.var);
3961 	CHECK_EXCEPTION();
3962 	ZEND_VM_NEXT_OPCODE();
3963 }
3964 
ZEND_SUB_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3965 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3966 {
3967 	USE_OPLINE
3968 	zend_free_op free_op2;
3969 
3970 	SAVE_OPLINE();
3971 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
3972 		opline->op1.zv,
3973 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
3974 
3975 	zval_dtor(free_op2.var);
3976 	CHECK_EXCEPTION();
3977 	ZEND_VM_NEXT_OPCODE();
3978 }
3979 
ZEND_MUL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3980 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3981 {
3982 	USE_OPLINE
3983 	zend_free_op free_op2;
3984 
3985 	SAVE_OPLINE();
3986 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
3987 		opline->op1.zv,
3988 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
3989 
3990 	zval_dtor(free_op2.var);
3991 	CHECK_EXCEPTION();
3992 	ZEND_VM_NEXT_OPCODE();
3993 }
3994 
ZEND_DIV_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3995 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3996 {
3997 	USE_OPLINE
3998 	zend_free_op free_op2;
3999 
4000 	SAVE_OPLINE();
4001 	fast_div_function(&EX_T(opline->result.var).tmp_var,
4002 		opline->op1.zv,
4003 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4004 
4005 	zval_dtor(free_op2.var);
4006 	CHECK_EXCEPTION();
4007 	ZEND_VM_NEXT_OPCODE();
4008 }
4009 
ZEND_MOD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4010 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4011 {
4012 	USE_OPLINE
4013 	zend_free_op free_op2;
4014 
4015 	SAVE_OPLINE();
4016 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
4017 		opline->op1.zv,
4018 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4019 
4020 	zval_dtor(free_op2.var);
4021 	CHECK_EXCEPTION();
4022 	ZEND_VM_NEXT_OPCODE();
4023 }
4024 
ZEND_SL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4025 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4026 {
4027 	USE_OPLINE
4028 	zend_free_op free_op2;
4029 
4030 	SAVE_OPLINE();
4031 	shift_left_function(&EX_T(opline->result.var).tmp_var,
4032 		opline->op1.zv,
4033 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4034 
4035 	zval_dtor(free_op2.var);
4036 	CHECK_EXCEPTION();
4037 	ZEND_VM_NEXT_OPCODE();
4038 }
4039 
ZEND_SR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4040 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4041 {
4042 	USE_OPLINE
4043 	zend_free_op free_op2;
4044 
4045 	SAVE_OPLINE();
4046 	shift_right_function(&EX_T(opline->result.var).tmp_var,
4047 		opline->op1.zv,
4048 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4049 
4050 	zval_dtor(free_op2.var);
4051 	CHECK_EXCEPTION();
4052 	ZEND_VM_NEXT_OPCODE();
4053 }
4054 
ZEND_CONCAT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4055 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4056 {
4057 	USE_OPLINE
4058 	zend_free_op free_op2;
4059 
4060 	SAVE_OPLINE();
4061 	concat_function(&EX_T(opline->result.var).tmp_var,
4062 		opline->op1.zv,
4063 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4064 
4065 	zval_dtor(free_op2.var);
4066 	CHECK_EXCEPTION();
4067 	ZEND_VM_NEXT_OPCODE();
4068 }
4069 
ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4070 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4071 {
4072 	USE_OPLINE
4073 	zend_free_op free_op2;
4074 
4075 	SAVE_OPLINE();
4076 	is_identical_function(&EX_T(opline->result.var).tmp_var,
4077 		opline->op1.zv,
4078 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4079 
4080 	zval_dtor(free_op2.var);
4081 	CHECK_EXCEPTION();
4082 	ZEND_VM_NEXT_OPCODE();
4083 }
4084 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4085 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4086 {
4087 	USE_OPLINE
4088 	zend_free_op free_op2;
4089 	zval *result = &EX_T(opline->result.var).tmp_var;
4090 
4091 	SAVE_OPLINE();
4092 	is_identical_function(result,
4093 		opline->op1.zv,
4094 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4095 	Z_LVAL_P(result) = !Z_LVAL_P(result);
4096 
4097 	zval_dtor(free_op2.var);
4098 	CHECK_EXCEPTION();
4099 	ZEND_VM_NEXT_OPCODE();
4100 }
4101 
ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4102 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4103 {
4104 	USE_OPLINE
4105 	zend_free_op free_op2;
4106 	zval *result = &EX_T(opline->result.var).tmp_var;
4107 
4108 	SAVE_OPLINE();
4109 	ZVAL_BOOL(result, fast_equal_function(result,
4110 		opline->op1.zv,
4111 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4112 
4113 	zval_dtor(free_op2.var);
4114 	CHECK_EXCEPTION();
4115 	ZEND_VM_NEXT_OPCODE();
4116 }
4117 
ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4118 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4119 {
4120 	USE_OPLINE
4121 	zend_free_op free_op2;
4122 	zval *result = &EX_T(opline->result.var).tmp_var;
4123 
4124 	SAVE_OPLINE();
4125 	ZVAL_BOOL(result, fast_not_equal_function(result,
4126 		opline->op1.zv,
4127 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4128 
4129 	zval_dtor(free_op2.var);
4130 	CHECK_EXCEPTION();
4131 	ZEND_VM_NEXT_OPCODE();
4132 }
4133 
ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4134 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4135 {
4136 	USE_OPLINE
4137 	zend_free_op free_op2;
4138 	zval *result = &EX_T(opline->result.var).tmp_var;
4139 
4140 	SAVE_OPLINE();
4141 	ZVAL_BOOL(result, fast_is_smaller_function(result,
4142 		opline->op1.zv,
4143 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4144 
4145 	zval_dtor(free_op2.var);
4146 	CHECK_EXCEPTION();
4147 	ZEND_VM_NEXT_OPCODE();
4148 }
4149 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4150 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4151 {
4152 	USE_OPLINE
4153 	zend_free_op free_op2;
4154 	zval *result = &EX_T(opline->result.var).tmp_var;
4155 
4156 	SAVE_OPLINE();
4157 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
4158 		opline->op1.zv,
4159 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4160 
4161 	zval_dtor(free_op2.var);
4162 	CHECK_EXCEPTION();
4163 	ZEND_VM_NEXT_OPCODE();
4164 }
4165 
ZEND_BW_OR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4166 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4167 {
4168 	USE_OPLINE
4169 	zend_free_op free_op2;
4170 
4171 	SAVE_OPLINE();
4172 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
4173 		opline->op1.zv,
4174 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4175 
4176 	zval_dtor(free_op2.var);
4177 	CHECK_EXCEPTION();
4178 	ZEND_VM_NEXT_OPCODE();
4179 }
4180 
ZEND_BW_AND_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4181 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4182 {
4183 	USE_OPLINE
4184 	zend_free_op free_op2;
4185 
4186 	SAVE_OPLINE();
4187 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
4188 		opline->op1.zv,
4189 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4190 
4191 	zval_dtor(free_op2.var);
4192 	CHECK_EXCEPTION();
4193 	ZEND_VM_NEXT_OPCODE();
4194 }
4195 
ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4196 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4197 {
4198 	USE_OPLINE
4199 	zend_free_op free_op2;
4200 
4201 	SAVE_OPLINE();
4202 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
4203 		opline->op1.zv,
4204 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4205 
4206 	zval_dtor(free_op2.var);
4207 	CHECK_EXCEPTION();
4208 	ZEND_VM_NEXT_OPCODE();
4209 }
4210 
ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4211 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4212 {
4213 	USE_OPLINE
4214 	zend_free_op free_op2;
4215 
4216 	SAVE_OPLINE();
4217 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
4218 		opline->op1.zv,
4219 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4220 
4221 	zval_dtor(free_op2.var);
4222 	CHECK_EXCEPTION();
4223 	ZEND_VM_NEXT_OPCODE();
4224 }
4225 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4226 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4227 {
4228 	USE_OPLINE
4229 	zval *function_name;
4230 	zend_class_entry *ce;
4231 
4232 	SAVE_OPLINE();
4233 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
4234 
4235 	if (IS_CONST == IS_CONST) {
4236 		/* no function found. try a static method in class */
4237 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
4238 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
4239 		} else {
4240 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
4241 			if (UNEXPECTED(EG(exception) != NULL)) {
4242 				HANDLE_EXCEPTION();
4243 			}
4244 			if (UNEXPECTED(ce == NULL)) {
4245 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
4246 			}
4247 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
4248 		}
4249 		EX(called_scope) = ce;
4250 	} else {
4251 		ce = EX_T(opline->op1.var).class_entry;
4252 
4253 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
4254 			EX(called_scope) = EG(called_scope);
4255 		} else {
4256 			EX(called_scope) = ce;
4257 		}
4258 	}
4259 
4260 	if (IS_CONST == IS_CONST &&
4261 	    IS_TMP_VAR == IS_CONST &&
4262 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
4263 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
4264 	} else if (IS_CONST != IS_CONST &&
4265 	           IS_TMP_VAR == IS_CONST &&
4266 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
4267 		/* do nothing */
4268 	} else if (IS_TMP_VAR != IS_UNUSED) {
4269 		char *function_name_strval = NULL;
4270 		int function_name_strlen = 0;
4271 		zend_free_op free_op2;
4272 
4273 		if (IS_TMP_VAR == IS_CONST) {
4274 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
4275 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
4276 		} else {
4277 			function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
4278 
4279 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
4280 				zend_error_noreturn(E_ERROR, "Function name must be a string");
4281 			} else {
4282 				function_name_strval = Z_STRVAL_P(function_name);
4283 				function_name_strlen = Z_STRLEN_P(function_name);
4284  			}
4285 		}
4286 
4287 		if (function_name_strval) {
4288 			if (ce->get_static_method) {
4289 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
4290 			} else {
4291 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
4292 			}
4293 			if (UNEXPECTED(EX(fbc) == NULL)) {
4294 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
4295 			}
4296 			if (IS_TMP_VAR == IS_CONST &&
4297 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
4298 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
4299 				if (IS_CONST == IS_CONST) {
4300 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
4301 				} else {
4302 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
4303 				}
4304 			}
4305 		}
4306 		if (IS_TMP_VAR != IS_CONST) {
4307 			zval_dtor(free_op2.var);
4308 		}
4309 	} else {
4310 		if (UNEXPECTED(ce->constructor == NULL)) {
4311 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
4312 		}
4313 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
4314 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
4315 		}
4316 		EX(fbc) = ce->constructor;
4317 	}
4318 
4319 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
4320 		EX(object) = NULL;
4321 	} else {
4322 		if (EG(This) &&
4323 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
4324 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
4325 		    /* We are calling method of the other (incompatible) class,
4326 		       but passing $this. This is done for compatibility with php-4. */
4327 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
4328 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
4329 			} else {
4330 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
4331 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
4332 			}
4333 		}
4334 		if ((EX(object) = EG(This))) {
4335 			Z_ADDREF_P(EX(object));
4336 			EX(called_scope) = Z_OBJCE_P(EX(object));
4337 		}
4338 	}
4339 
4340 	CHECK_EXCEPTION();
4341 	ZEND_VM_NEXT_OPCODE();
4342 }
4343 
ZEND_CASE_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4344 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4345 {
4346 	USE_OPLINE
4347 	zend_free_op free_op2;
4348 
4349 	SAVE_OPLINE();
4350 	if (IS_CONST==IS_VAR) {
4351 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
4352 	}
4353 	is_equal_function(&EX_T(opline->result.var).tmp_var,
4354 				 opline->op1.zv,
4355 				 _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4356 
4357 	zval_dtor(free_op2.var);
4358 	CHECK_EXCEPTION();
4359 	ZEND_VM_NEXT_OPCODE();
4360 }
4361 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4362 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4363 {
4364 	USE_OPLINE
4365 
4366 	zval *expr_ptr;
4367 
4368 	SAVE_OPLINE();
4369 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
4370 		zval **expr_ptr_ptr = NULL;
4371 
4372 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
4373 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
4374 		}
4375 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
4376 		expr_ptr = *expr_ptr_ptr;
4377 		Z_ADDREF_P(expr_ptr);
4378 	} else {
4379 		expr_ptr=opline->op1.zv;
4380 		if (0) { /* temporary variable */
4381 			zval *new_expr;
4382 
4383 			ALLOC_ZVAL(new_expr);
4384 			INIT_PZVAL_COPY(new_expr, expr_ptr);
4385 			expr_ptr = new_expr;
4386 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
4387 			zval *new_expr;
4388 
4389 			ALLOC_ZVAL(new_expr);
4390 			INIT_PZVAL_COPY(new_expr, expr_ptr);
4391 			expr_ptr = new_expr;
4392 			zendi_zval_copy_ctor(*expr_ptr);
4393 		} else {
4394 			Z_ADDREF_P(expr_ptr);
4395 		}
4396 	}
4397 
4398 	if (IS_TMP_VAR != IS_UNUSED) {
4399 		zend_free_op free_op2;
4400 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
4401 		ulong hval;
4402 
4403 		switch (Z_TYPE_P(offset)) {
4404 			case IS_DOUBLE:
4405 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
4406 				goto num_index;
4407 			case IS_LONG:
4408 			case IS_BOOL:
4409 				hval = Z_LVAL_P(offset);
4410 num_index:
4411 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
4412 				break;
4413 			case IS_STRING:
4414 				if (IS_TMP_VAR == IS_CONST) {
4415 					hval = Z_HASH_P(offset);
4416 				} else {
4417 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
4418 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
4419 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
4420 					} else {
4421 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
4422 					}
4423 				}
4424 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
4425 				break;
4426 			case IS_NULL:
4427 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
4428 				break;
4429 			default:
4430 				zend_error(E_WARNING, "Illegal offset type");
4431 				zval_ptr_dtor(&expr_ptr);
4432 				/* do nothing */
4433 				break;
4434 		}
4435 		zval_dtor(free_op2.var);
4436 	} else {
4437 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
4438 	}
4439 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
4440 
4441 	} else {
4442 
4443 	}
4444 	CHECK_EXCEPTION();
4445 	ZEND_VM_NEXT_OPCODE();
4446 }
4447 
ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4448 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4449 {
4450 	USE_OPLINE
4451 
4452 	array_init(&EX_T(opline->result.var).tmp_var);
4453 	if (IS_CONST == IS_UNUSED) {
4454 		ZEND_VM_NEXT_OPCODE();
4455 #if 0 || IS_CONST != IS_UNUSED
4456 	} else {
4457 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4458 #endif
4459 	}
4460 }
4461 
ZEND_ADD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4462 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4463 {
4464 	USE_OPLINE
4465 	zend_free_op free_op2;
4466 
4467 	SAVE_OPLINE();
4468 	fast_add_function(&EX_T(opline->result.var).tmp_var,
4469 		opline->op1.zv,
4470 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4471 
4472 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4473 	CHECK_EXCEPTION();
4474 	ZEND_VM_NEXT_OPCODE();
4475 }
4476 
ZEND_SUB_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4477 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4478 {
4479 	USE_OPLINE
4480 	zend_free_op free_op2;
4481 
4482 	SAVE_OPLINE();
4483 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
4484 		opline->op1.zv,
4485 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4486 
4487 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4488 	CHECK_EXCEPTION();
4489 	ZEND_VM_NEXT_OPCODE();
4490 }
4491 
ZEND_MUL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4492 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4493 {
4494 	USE_OPLINE
4495 	zend_free_op free_op2;
4496 
4497 	SAVE_OPLINE();
4498 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
4499 		opline->op1.zv,
4500 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4501 
4502 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4503 	CHECK_EXCEPTION();
4504 	ZEND_VM_NEXT_OPCODE();
4505 }
4506 
ZEND_DIV_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4507 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4508 {
4509 	USE_OPLINE
4510 	zend_free_op free_op2;
4511 
4512 	SAVE_OPLINE();
4513 	fast_div_function(&EX_T(opline->result.var).tmp_var,
4514 		opline->op1.zv,
4515 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4516 
4517 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4518 	CHECK_EXCEPTION();
4519 	ZEND_VM_NEXT_OPCODE();
4520 }
4521 
ZEND_MOD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4522 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4523 {
4524 	USE_OPLINE
4525 	zend_free_op free_op2;
4526 
4527 	SAVE_OPLINE();
4528 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
4529 		opline->op1.zv,
4530 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4531 
4532 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4533 	CHECK_EXCEPTION();
4534 	ZEND_VM_NEXT_OPCODE();
4535 }
4536 
ZEND_SL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4537 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4538 {
4539 	USE_OPLINE
4540 	zend_free_op free_op2;
4541 
4542 	SAVE_OPLINE();
4543 	shift_left_function(&EX_T(opline->result.var).tmp_var,
4544 		opline->op1.zv,
4545 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4546 
4547 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4548 	CHECK_EXCEPTION();
4549 	ZEND_VM_NEXT_OPCODE();
4550 }
4551 
ZEND_SR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4552 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4553 {
4554 	USE_OPLINE
4555 	zend_free_op free_op2;
4556 
4557 	SAVE_OPLINE();
4558 	shift_right_function(&EX_T(opline->result.var).tmp_var,
4559 		opline->op1.zv,
4560 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4561 
4562 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4563 	CHECK_EXCEPTION();
4564 	ZEND_VM_NEXT_OPCODE();
4565 }
4566 
ZEND_CONCAT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4567 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4568 {
4569 	USE_OPLINE
4570 	zend_free_op free_op2;
4571 
4572 	SAVE_OPLINE();
4573 	concat_function(&EX_T(opline->result.var).tmp_var,
4574 		opline->op1.zv,
4575 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4576 
4577 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4578 	CHECK_EXCEPTION();
4579 	ZEND_VM_NEXT_OPCODE();
4580 }
4581 
ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4582 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4583 {
4584 	USE_OPLINE
4585 	zend_free_op free_op2;
4586 
4587 	SAVE_OPLINE();
4588 	is_identical_function(&EX_T(opline->result.var).tmp_var,
4589 		opline->op1.zv,
4590 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4591 
4592 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4593 	CHECK_EXCEPTION();
4594 	ZEND_VM_NEXT_OPCODE();
4595 }
4596 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4597 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4598 {
4599 	USE_OPLINE
4600 	zend_free_op free_op2;
4601 	zval *result = &EX_T(opline->result.var).tmp_var;
4602 
4603 	SAVE_OPLINE();
4604 	is_identical_function(result,
4605 		opline->op1.zv,
4606 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4607 	Z_LVAL_P(result) = !Z_LVAL_P(result);
4608 
4609 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4610 	CHECK_EXCEPTION();
4611 	ZEND_VM_NEXT_OPCODE();
4612 }
4613 
ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4614 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4615 {
4616 	USE_OPLINE
4617 	zend_free_op free_op2;
4618 	zval *result = &EX_T(opline->result.var).tmp_var;
4619 
4620 	SAVE_OPLINE();
4621 	ZVAL_BOOL(result, fast_equal_function(result,
4622 		opline->op1.zv,
4623 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4624 
4625 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4626 	CHECK_EXCEPTION();
4627 	ZEND_VM_NEXT_OPCODE();
4628 }
4629 
ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4630 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4631 {
4632 	USE_OPLINE
4633 	zend_free_op free_op2;
4634 	zval *result = &EX_T(opline->result.var).tmp_var;
4635 
4636 	SAVE_OPLINE();
4637 	ZVAL_BOOL(result, fast_not_equal_function(result,
4638 		opline->op1.zv,
4639 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4640 
4641 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4642 	CHECK_EXCEPTION();
4643 	ZEND_VM_NEXT_OPCODE();
4644 }
4645 
ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4646 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4647 {
4648 	USE_OPLINE
4649 	zend_free_op free_op2;
4650 	zval *result = &EX_T(opline->result.var).tmp_var;
4651 
4652 	SAVE_OPLINE();
4653 	ZVAL_BOOL(result, fast_is_smaller_function(result,
4654 		opline->op1.zv,
4655 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4656 
4657 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4658 	CHECK_EXCEPTION();
4659 	ZEND_VM_NEXT_OPCODE();
4660 }
4661 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4662 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4663 {
4664 	USE_OPLINE
4665 	zend_free_op free_op2;
4666 	zval *result = &EX_T(opline->result.var).tmp_var;
4667 
4668 	SAVE_OPLINE();
4669 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
4670 		opline->op1.zv,
4671 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
4672 
4673 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4674 	CHECK_EXCEPTION();
4675 	ZEND_VM_NEXT_OPCODE();
4676 }
4677 
ZEND_BW_OR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4678 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4679 {
4680 	USE_OPLINE
4681 	zend_free_op free_op2;
4682 
4683 	SAVE_OPLINE();
4684 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
4685 		opline->op1.zv,
4686 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4687 
4688 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4689 	CHECK_EXCEPTION();
4690 	ZEND_VM_NEXT_OPCODE();
4691 }
4692 
ZEND_BW_AND_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4693 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4694 {
4695 	USE_OPLINE
4696 	zend_free_op free_op2;
4697 
4698 	SAVE_OPLINE();
4699 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
4700 		opline->op1.zv,
4701 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4702 
4703 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4704 	CHECK_EXCEPTION();
4705 	ZEND_VM_NEXT_OPCODE();
4706 }
4707 
ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4708 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4709 {
4710 	USE_OPLINE
4711 	zend_free_op free_op2;
4712 
4713 	SAVE_OPLINE();
4714 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
4715 		opline->op1.zv,
4716 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4717 
4718 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4719 	CHECK_EXCEPTION();
4720 	ZEND_VM_NEXT_OPCODE();
4721 }
4722 
ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4723 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4724 {
4725 	USE_OPLINE
4726 	zend_free_op free_op2;
4727 
4728 	SAVE_OPLINE();
4729 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
4730 		opline->op1.zv,
4731 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
4732 
4733 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4734 	CHECK_EXCEPTION();
4735 	ZEND_VM_NEXT_OPCODE();
4736 }
4737 
zend_fetch_var_address_helper_SPEC_CONST_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)4738 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
4739 {
4740 	USE_OPLINE
4741 	zend_free_op free_op1;
4742 	zval *varname;
4743 	zval **retval;
4744 	zval tmp_varname;
4745 	HashTable *target_symbol_table;
4746 	ulong hash_value;
4747 
4748 	SAVE_OPLINE();
4749 	varname = opline->op1.zv;
4750 
4751  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
4752 		ZVAL_COPY_VALUE(&tmp_varname, varname);
4753 		zval_copy_ctor(&tmp_varname);
4754 		Z_SET_REFCOUNT(tmp_varname, 1);
4755 		Z_UNSET_ISREF(tmp_varname);
4756 		convert_to_string(&tmp_varname);
4757 		varname = &tmp_varname;
4758 	}
4759 
4760 	if (IS_VAR != IS_UNUSED) {
4761 		zend_class_entry *ce;
4762 
4763 		if (IS_VAR == IS_CONST) {
4764 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
4765 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
4766 			} else {
4767 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
4768 				if (UNEXPECTED(ce == NULL)) {
4769 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
4770 						zval_dtor(&tmp_varname);
4771 					}
4772 
4773 					CHECK_EXCEPTION();
4774 					ZEND_VM_NEXT_OPCODE();
4775 				}
4776 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
4777 			}
4778 		} else {
4779 			ce = EX_T(opline->op2.var).class_entry;
4780 		}
4781 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
4782 
4783 	} else {
4784 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
4785 /*
4786 		if (!target_symbol_table) {
4787 			CHECK_EXCEPTION();
4788 			ZEND_VM_NEXT_OPCODE();
4789 		}
4790 */
4791 		if (IS_CONST == IS_CONST) {
4792 			hash_value = Z_HASH_P(varname);
4793 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
4794 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
4795 		} else {
4796 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
4797 		}
4798 
4799 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
4800 			switch (type) {
4801 				case BP_VAR_R:
4802 				case BP_VAR_UNSET:
4803 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
4804 					/* break missing intentionally */
4805 				case BP_VAR_IS:
4806 					retval = &EG(uninitialized_zval_ptr);
4807 					break;
4808 				case BP_VAR_RW:
4809 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
4810 					/* break missing intentionally */
4811 				case BP_VAR_W:
4812 					Z_ADDREF_P(&EG(uninitialized_zval));
4813 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
4814 					break;
4815 				EMPTY_SWITCH_DEFAULT_CASE()
4816 			}
4817 		}
4818 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
4819 			case ZEND_FETCH_GLOBAL:
4820 				if (IS_CONST != IS_TMP_VAR) {
4821 
4822 				}
4823 				break;
4824 			case ZEND_FETCH_LOCAL:
4825 
4826 				break;
4827 			case ZEND_FETCH_STATIC:
4828 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
4829 				break;
4830 			case ZEND_FETCH_GLOBAL_LOCK:
4831 				if (IS_CONST == IS_VAR && !free_op1.var) {
4832 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
4833 				}
4834 				break;
4835 		}
4836 	}
4837 
4838 
4839 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
4840 		zval_dtor(&tmp_varname);
4841 	}
4842 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
4843 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
4844 	}
4845 	PZVAL_LOCK(*retval);
4846 	switch (type) {
4847 		case BP_VAR_R:
4848 		case BP_VAR_IS:
4849 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
4850 			break;
4851 		case BP_VAR_UNSET: {
4852 			zend_free_op free_res;
4853 
4854 			PZVAL_UNLOCK(*retval, &free_res);
4855 			if (retval != &EG(uninitialized_zval_ptr)) {
4856 				SEPARATE_ZVAL_IF_NOT_REF(retval);
4857 			}
4858 			PZVAL_LOCK(*retval);
4859 			FREE_OP_VAR_PTR(free_res);
4860 		}
4861 		/* break missing intentionally */
4862 		default:
4863 			EX_T(opline->result.var).var.ptr_ptr = retval;
4864 			break;
4865 	}
4866 	CHECK_EXCEPTION();
4867 	ZEND_VM_NEXT_OPCODE();
4868 }
4869 
ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4870 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4871 {
4872 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4873 }
4874 
ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4875 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4876 {
4877 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4878 }
4879 
ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4880 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4881 {
4882 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4883 }
4884 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4885 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4886 {
4887 	USE_OPLINE
4888 
4889 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4890 }
4891 
ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4892 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4893 {
4894 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4895 }
4896 
ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4897 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4898 {
4899 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4900 }
4901 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4902 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4903 {
4904 	USE_OPLINE
4905 	zval *function_name;
4906 	zend_class_entry *ce;
4907 
4908 	SAVE_OPLINE();
4909 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
4910 
4911 	if (IS_CONST == IS_CONST) {
4912 		/* no function found. try a static method in class */
4913 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
4914 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
4915 		} else {
4916 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
4917 			if (UNEXPECTED(EG(exception) != NULL)) {
4918 				HANDLE_EXCEPTION();
4919 			}
4920 			if (UNEXPECTED(ce == NULL)) {
4921 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
4922 			}
4923 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
4924 		}
4925 		EX(called_scope) = ce;
4926 	} else {
4927 		ce = EX_T(opline->op1.var).class_entry;
4928 
4929 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
4930 			EX(called_scope) = EG(called_scope);
4931 		} else {
4932 			EX(called_scope) = ce;
4933 		}
4934 	}
4935 
4936 	if (IS_CONST == IS_CONST &&
4937 	    IS_VAR == IS_CONST &&
4938 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
4939 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
4940 	} else if (IS_CONST != IS_CONST &&
4941 	           IS_VAR == IS_CONST &&
4942 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
4943 		/* do nothing */
4944 	} else if (IS_VAR != IS_UNUSED) {
4945 		char *function_name_strval = NULL;
4946 		int function_name_strlen = 0;
4947 		zend_free_op free_op2;
4948 
4949 		if (IS_VAR == IS_CONST) {
4950 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
4951 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
4952 		} else {
4953 			function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
4954 
4955 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
4956 				zend_error_noreturn(E_ERROR, "Function name must be a string");
4957 			} else {
4958 				function_name_strval = Z_STRVAL_P(function_name);
4959 				function_name_strlen = Z_STRLEN_P(function_name);
4960  			}
4961 		}
4962 
4963 		if (function_name_strval) {
4964 			if (ce->get_static_method) {
4965 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
4966 			} else {
4967 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
4968 			}
4969 			if (UNEXPECTED(EX(fbc) == NULL)) {
4970 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
4971 			}
4972 			if (IS_VAR == IS_CONST &&
4973 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
4974 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
4975 				if (IS_CONST == IS_CONST) {
4976 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
4977 				} else {
4978 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
4979 				}
4980 			}
4981 		}
4982 		if (IS_VAR != IS_CONST) {
4983 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4984 		}
4985 	} else {
4986 		if (UNEXPECTED(ce->constructor == NULL)) {
4987 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
4988 		}
4989 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
4990 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
4991 		}
4992 		EX(fbc) = ce->constructor;
4993 	}
4994 
4995 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
4996 		EX(object) = NULL;
4997 	} else {
4998 		if (EG(This) &&
4999 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
5000 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
5001 		    /* We are calling method of the other (incompatible) class,
5002 		       but passing $this. This is done for compatibility with php-4. */
5003 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
5004 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
5005 			} else {
5006 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
5007 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
5008 			}
5009 		}
5010 		if ((EX(object) = EG(This))) {
5011 			Z_ADDREF_P(EX(object));
5012 			EX(called_scope) = Z_OBJCE_P(EX(object));
5013 		}
5014 	}
5015 
5016 	CHECK_EXCEPTION();
5017 	ZEND_VM_NEXT_OPCODE();
5018 }
5019 
ZEND_CASE_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5020 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5021 {
5022 	USE_OPLINE
5023 	zend_free_op free_op2;
5024 
5025 	SAVE_OPLINE();
5026 	if (IS_CONST==IS_VAR) {
5027 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
5028 	}
5029 	is_equal_function(&EX_T(opline->result.var).tmp_var,
5030 				 opline->op1.zv,
5031 				 _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
5032 
5033 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5034 	CHECK_EXCEPTION();
5035 	ZEND_VM_NEXT_OPCODE();
5036 }
5037 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5038 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5039 {
5040 	USE_OPLINE
5041 
5042 	zval *expr_ptr;
5043 
5044 	SAVE_OPLINE();
5045 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5046 		zval **expr_ptr_ptr = NULL;
5047 
5048 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
5049 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
5050 		}
5051 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
5052 		expr_ptr = *expr_ptr_ptr;
5053 		Z_ADDREF_P(expr_ptr);
5054 	} else {
5055 		expr_ptr=opline->op1.zv;
5056 		if (0) { /* temporary variable */
5057 			zval *new_expr;
5058 
5059 			ALLOC_ZVAL(new_expr);
5060 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5061 			expr_ptr = new_expr;
5062 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
5063 			zval *new_expr;
5064 
5065 			ALLOC_ZVAL(new_expr);
5066 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5067 			expr_ptr = new_expr;
5068 			zendi_zval_copy_ctor(*expr_ptr);
5069 		} else {
5070 			Z_ADDREF_P(expr_ptr);
5071 		}
5072 	}
5073 
5074 	if (IS_VAR != IS_UNUSED) {
5075 		zend_free_op free_op2;
5076 		zval *offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
5077 		ulong hval;
5078 
5079 		switch (Z_TYPE_P(offset)) {
5080 			case IS_DOUBLE:
5081 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
5082 				goto num_index;
5083 			case IS_LONG:
5084 			case IS_BOOL:
5085 				hval = Z_LVAL_P(offset);
5086 num_index:
5087 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
5088 				break;
5089 			case IS_STRING:
5090 				if (IS_VAR == IS_CONST) {
5091 					hval = Z_HASH_P(offset);
5092 				} else {
5093 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
5094 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
5095 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
5096 					} else {
5097 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
5098 					}
5099 				}
5100 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
5101 				break;
5102 			case IS_NULL:
5103 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
5104 				break;
5105 			default:
5106 				zend_error(E_WARNING, "Illegal offset type");
5107 				zval_ptr_dtor(&expr_ptr);
5108 				/* do nothing */
5109 				break;
5110 		}
5111 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5112 	} else {
5113 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
5114 	}
5115 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5116 
5117 	} else {
5118 
5119 	}
5120 	CHECK_EXCEPTION();
5121 	ZEND_VM_NEXT_OPCODE();
5122 }
5123 
ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5124 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5125 {
5126 	USE_OPLINE
5127 
5128 	array_init(&EX_T(opline->result.var).tmp_var);
5129 	if (IS_CONST == IS_UNUSED) {
5130 		ZEND_VM_NEXT_OPCODE();
5131 #if 0 || IS_CONST != IS_UNUSED
5132 	} else {
5133 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5134 #endif
5135 	}
5136 }
5137 
ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5138 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5139 {
5140 	USE_OPLINE
5141 	zval tmp, *varname;
5142 	HashTable *target_symbol_table;
5143 
5144 
5145 	SAVE_OPLINE();
5146 	if (IS_CONST == IS_CV &&
5147 	    IS_VAR == IS_UNUSED &&
5148 	    (opline->extended_value & ZEND_QUICK_SET)) {
5149 		if (EG(active_symbol_table)) {
5150 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5151 
5152 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
5153 			EX_CV(opline->op1.var) = NULL;
5154 		} else if (EX_CV(opline->op1.var)) {
5155 			zval_ptr_dtor(EX_CV(opline->op1.var));
5156 			EX_CV(opline->op1.var) = NULL;
5157 		}
5158 		CHECK_EXCEPTION();
5159 		ZEND_VM_NEXT_OPCODE();
5160 	}
5161 
5162 	varname = opline->op1.zv;
5163 
5164 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5165 		ZVAL_COPY_VALUE(&tmp, varname);
5166 		zval_copy_ctor(&tmp);
5167 		convert_to_string(&tmp);
5168 		varname = &tmp;
5169 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5170 		Z_ADDREF_P(varname);
5171 	}
5172 
5173 	if (IS_VAR != IS_UNUSED) {
5174 		zend_class_entry *ce;
5175 
5176 		if (IS_VAR == IS_CONST) {
5177 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5178 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5179 			} else {
5180 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5181 				if (UNEXPECTED(EG(exception) != NULL)) {
5182 					if (IS_CONST != IS_CONST && varname == &tmp) {
5183 						zval_dtor(&tmp);
5184 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5185 						zval_ptr_dtor(&varname);
5186 					}
5187 
5188 					HANDLE_EXCEPTION();
5189 				}
5190 				if (UNEXPECTED(ce == NULL)) {
5191 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
5192 				}
5193 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5194 			}
5195 		} else {
5196 			ce = EX_T(opline->op2.var).class_entry;
5197 		}
5198 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5199 	} else {
5200 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
5201 
5202 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5203 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
5204 	}
5205 
5206 	if (IS_CONST != IS_CONST && varname == &tmp) {
5207 		zval_dtor(&tmp);
5208 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5209 		zval_ptr_dtor(&varname);
5210 	}
5211 
5212 	CHECK_EXCEPTION();
5213 	ZEND_VM_NEXT_OPCODE();
5214 }
5215 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5216 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5217 {
5218 	USE_OPLINE
5219 	zval **value;
5220 	zend_bool isset = 1;
5221 
5222 	SAVE_OPLINE();
5223 	if (IS_CONST == IS_CV &&
5224 	    IS_VAR == IS_UNUSED &&
5225 	    (opline->extended_value & ZEND_QUICK_SET)) {
5226 		if (EX_CV(opline->op1.var)) {
5227 			value = EX_CV(opline->op1.var);
5228 		} else if (EG(active_symbol_table)) {
5229 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5230 
5231 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
5232 				isset = 0;
5233 			}
5234 		} else {
5235 			isset = 0;
5236 		}
5237 	} else {
5238 		HashTable *target_symbol_table;
5239 
5240 		zval tmp, *varname = opline->op1.zv;
5241 
5242 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5243 			ZVAL_COPY_VALUE(&tmp, varname);
5244 			zval_copy_ctor(&tmp);
5245 			convert_to_string(&tmp);
5246 			varname = &tmp;
5247 		}
5248 
5249 		if (IS_VAR != IS_UNUSED) {
5250 			zend_class_entry *ce;
5251 
5252 			if (IS_VAR == IS_CONST) {
5253 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5254 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
5255 				} else {
5256 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5257 					if (UNEXPECTED(ce == NULL)) {
5258 						CHECK_EXCEPTION();
5259 						ZEND_VM_NEXT_OPCODE();
5260 					}
5261 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
5262 				}
5263 			} else {
5264 				ce = EX_T(opline->op2.var).class_entry;
5265 			}
5266 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5267 			if (!value) {
5268 				isset = 0;
5269 			}
5270 		} else {
5271 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5272 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
5273 				isset = 0;
5274 			}
5275 		}
5276 
5277 		if (IS_CONST != IS_CONST && varname == &tmp) {
5278 			zval_dtor(&tmp);
5279 		}
5280 
5281 	}
5282 
5283 	if (opline->extended_value & ZEND_ISSET) {
5284 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
5285 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5286 		} else {
5287 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5288 		}
5289 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
5290 		if (!isset || !i_zend_is_true(*value)) {
5291 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5292 		} else {
5293 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5294 		}
5295 	}
5296 
5297 	CHECK_EXCEPTION();
5298 	ZEND_VM_NEXT_OPCODE();
5299 }
5300 
zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)5301 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
5302 {
5303 	USE_OPLINE
5304 	zend_free_op free_op1;
5305 	zval *varname;
5306 	zval **retval;
5307 	zval tmp_varname;
5308 	HashTable *target_symbol_table;
5309 	ulong hash_value;
5310 
5311 	SAVE_OPLINE();
5312 	varname = opline->op1.zv;
5313 
5314  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
5315 		ZVAL_COPY_VALUE(&tmp_varname, varname);
5316 		zval_copy_ctor(&tmp_varname);
5317 		Z_SET_REFCOUNT(tmp_varname, 1);
5318 		Z_UNSET_ISREF(tmp_varname);
5319 		convert_to_string(&tmp_varname);
5320 		varname = &tmp_varname;
5321 	}
5322 
5323 	if (IS_UNUSED != IS_UNUSED) {
5324 		zend_class_entry *ce;
5325 
5326 		if (IS_UNUSED == IS_CONST) {
5327 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5328 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5329 			} else {
5330 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5331 				if (UNEXPECTED(ce == NULL)) {
5332 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
5333 						zval_dtor(&tmp_varname);
5334 					}
5335 
5336 					CHECK_EXCEPTION();
5337 					ZEND_VM_NEXT_OPCODE();
5338 				}
5339 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5340 			}
5341 		} else {
5342 			ce = EX_T(opline->op2.var).class_entry;
5343 		}
5344 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5345 
5346 	} else {
5347 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5348 /*
5349 		if (!target_symbol_table) {
5350 			CHECK_EXCEPTION();
5351 			ZEND_VM_NEXT_OPCODE();
5352 		}
5353 */
5354 		if (IS_CONST == IS_CONST) {
5355 			hash_value = Z_HASH_P(varname);
5356 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
5357 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
5358 		} else {
5359 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
5360 		}
5361 
5362 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
5363 			switch (type) {
5364 				case BP_VAR_R:
5365 				case BP_VAR_UNSET:
5366 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
5367 					/* break missing intentionally */
5368 				case BP_VAR_IS:
5369 					retval = &EG(uninitialized_zval_ptr);
5370 					break;
5371 				case BP_VAR_RW:
5372 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
5373 					/* break missing intentionally */
5374 				case BP_VAR_W:
5375 					Z_ADDREF_P(&EG(uninitialized_zval));
5376 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
5377 					break;
5378 				EMPTY_SWITCH_DEFAULT_CASE()
5379 			}
5380 		}
5381 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
5382 			case ZEND_FETCH_GLOBAL:
5383 				if (IS_CONST != IS_TMP_VAR) {
5384 
5385 				}
5386 				break;
5387 			case ZEND_FETCH_LOCAL:
5388 
5389 				break;
5390 			case ZEND_FETCH_STATIC:
5391 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
5392 				break;
5393 			case ZEND_FETCH_GLOBAL_LOCK:
5394 				if (IS_CONST == IS_VAR && !free_op1.var) {
5395 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
5396 				}
5397 				break;
5398 		}
5399 	}
5400 
5401 
5402 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
5403 		zval_dtor(&tmp_varname);
5404 	}
5405 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
5406 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
5407 	}
5408 	PZVAL_LOCK(*retval);
5409 	switch (type) {
5410 		case BP_VAR_R:
5411 		case BP_VAR_IS:
5412 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
5413 			break;
5414 		case BP_VAR_UNSET: {
5415 			zend_free_op free_res;
5416 
5417 			PZVAL_UNLOCK(*retval, &free_res);
5418 			if (retval != &EG(uninitialized_zval_ptr)) {
5419 				SEPARATE_ZVAL_IF_NOT_REF(retval);
5420 			}
5421 			PZVAL_LOCK(*retval);
5422 			FREE_OP_VAR_PTR(free_res);
5423 		}
5424 		/* break missing intentionally */
5425 		default:
5426 			EX_T(opline->result.var).var.ptr_ptr = retval;
5427 			break;
5428 	}
5429 	CHECK_EXCEPTION();
5430 	ZEND_VM_NEXT_OPCODE();
5431 }
5432 
ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5433 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5434 {
5435 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5436 }
5437 
ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5438 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5439 {
5440 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5441 }
5442 
ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5443 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5444 {
5445 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5446 }
5447 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5448 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5449 {
5450 	USE_OPLINE
5451 
5452 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5453 }
5454 
ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5455 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5456 {
5457 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5458 }
5459 
ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5460 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5461 {
5462 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5463 }
5464 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5465 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5466 {
5467 	USE_OPLINE
5468 	zval *function_name;
5469 	zend_class_entry *ce;
5470 
5471 	SAVE_OPLINE();
5472 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
5473 
5474 	if (IS_CONST == IS_CONST) {
5475 		/* no function found. try a static method in class */
5476 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
5477 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
5478 		} else {
5479 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
5480 			if (UNEXPECTED(EG(exception) != NULL)) {
5481 				HANDLE_EXCEPTION();
5482 			}
5483 			if (UNEXPECTED(ce == NULL)) {
5484 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
5485 			}
5486 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
5487 		}
5488 		EX(called_scope) = ce;
5489 	} else {
5490 		ce = EX_T(opline->op1.var).class_entry;
5491 
5492 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
5493 			EX(called_scope) = EG(called_scope);
5494 		} else {
5495 			EX(called_scope) = ce;
5496 		}
5497 	}
5498 
5499 	if (IS_CONST == IS_CONST &&
5500 	    IS_UNUSED == IS_CONST &&
5501 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
5502 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
5503 	} else if (IS_CONST != IS_CONST &&
5504 	           IS_UNUSED == IS_CONST &&
5505 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
5506 		/* do nothing */
5507 	} else if (IS_UNUSED != IS_UNUSED) {
5508 		char *function_name_strval = NULL;
5509 		int function_name_strlen = 0;
5510 
5511 
5512 		if (IS_UNUSED == IS_CONST) {
5513 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
5514 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
5515 		} else {
5516 			function_name = NULL;
5517 
5518 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
5519 				zend_error_noreturn(E_ERROR, "Function name must be a string");
5520 			} else {
5521 				function_name_strval = Z_STRVAL_P(function_name);
5522 				function_name_strlen = Z_STRLEN_P(function_name);
5523  			}
5524 		}
5525 
5526 		if (function_name_strval) {
5527 			if (ce->get_static_method) {
5528 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
5529 			} else {
5530 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_UNUSED == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
5531 			}
5532 			if (UNEXPECTED(EX(fbc) == NULL)) {
5533 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
5534 			}
5535 			if (IS_UNUSED == IS_CONST &&
5536 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
5537 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
5538 				if (IS_CONST == IS_CONST) {
5539 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
5540 				} else {
5541 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
5542 				}
5543 			}
5544 		}
5545 		if (IS_UNUSED != IS_CONST) {
5546 
5547 		}
5548 	} else {
5549 		if (UNEXPECTED(ce->constructor == NULL)) {
5550 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
5551 		}
5552 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
5553 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
5554 		}
5555 		EX(fbc) = ce->constructor;
5556 	}
5557 
5558 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
5559 		EX(object) = NULL;
5560 	} else {
5561 		if (EG(This) &&
5562 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
5563 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
5564 		    /* We are calling method of the other (incompatible) class,
5565 		       but passing $this. This is done for compatibility with php-4. */
5566 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
5567 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
5568 			} else {
5569 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
5570 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
5571 			}
5572 		}
5573 		if ((EX(object) = EG(This))) {
5574 			Z_ADDREF_P(EX(object));
5575 			EX(called_scope) = Z_OBJCE_P(EX(object));
5576 		}
5577 	}
5578 
5579 	CHECK_EXCEPTION();
5580 	ZEND_VM_NEXT_OPCODE();
5581 }
5582 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5583 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5584 {
5585 	USE_OPLINE
5586 
5587 	zval *expr_ptr;
5588 
5589 	SAVE_OPLINE();
5590 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5591 		zval **expr_ptr_ptr = NULL;
5592 
5593 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
5594 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
5595 		}
5596 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
5597 		expr_ptr = *expr_ptr_ptr;
5598 		Z_ADDREF_P(expr_ptr);
5599 	} else {
5600 		expr_ptr=opline->op1.zv;
5601 		if (0) { /* temporary variable */
5602 			zval *new_expr;
5603 
5604 			ALLOC_ZVAL(new_expr);
5605 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5606 			expr_ptr = new_expr;
5607 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
5608 			zval *new_expr;
5609 
5610 			ALLOC_ZVAL(new_expr);
5611 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5612 			expr_ptr = new_expr;
5613 			zendi_zval_copy_ctor(*expr_ptr);
5614 		} else {
5615 			Z_ADDREF_P(expr_ptr);
5616 		}
5617 	}
5618 
5619 	if (IS_UNUSED != IS_UNUSED) {
5620 
5621 		zval *offset = NULL;
5622 		ulong hval;
5623 
5624 		switch (Z_TYPE_P(offset)) {
5625 			case IS_DOUBLE:
5626 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
5627 				goto num_index;
5628 			case IS_LONG:
5629 			case IS_BOOL:
5630 				hval = Z_LVAL_P(offset);
5631 num_index:
5632 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
5633 				break;
5634 			case IS_STRING:
5635 				if (IS_UNUSED == IS_CONST) {
5636 					hval = Z_HASH_P(offset);
5637 				} else {
5638 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
5639 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
5640 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
5641 					} else {
5642 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
5643 					}
5644 				}
5645 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
5646 				break;
5647 			case IS_NULL:
5648 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
5649 				break;
5650 			default:
5651 				zend_error(E_WARNING, "Illegal offset type");
5652 				zval_ptr_dtor(&expr_ptr);
5653 				/* do nothing */
5654 				break;
5655 		}
5656 
5657 	} else {
5658 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
5659 	}
5660 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5661 
5662 	} else {
5663 
5664 	}
5665 	CHECK_EXCEPTION();
5666 	ZEND_VM_NEXT_OPCODE();
5667 }
5668 
ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5669 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5670 {
5671 	USE_OPLINE
5672 
5673 	array_init(&EX_T(opline->result.var).tmp_var);
5674 	if (IS_CONST == IS_UNUSED) {
5675 		ZEND_VM_NEXT_OPCODE();
5676 #if 0 || IS_CONST != IS_UNUSED
5677 	} else {
5678 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5679 #endif
5680 	}
5681 }
5682 
ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5683 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5684 {
5685 	USE_OPLINE
5686 	zval tmp, *varname;
5687 	HashTable *target_symbol_table;
5688 
5689 
5690 	SAVE_OPLINE();
5691 	if (IS_CONST == IS_CV &&
5692 	    IS_UNUSED == IS_UNUSED &&
5693 	    (opline->extended_value & ZEND_QUICK_SET)) {
5694 		if (EG(active_symbol_table)) {
5695 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5696 
5697 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
5698 			EX_CV(opline->op1.var) = NULL;
5699 		} else if (EX_CV(opline->op1.var)) {
5700 			zval_ptr_dtor(EX_CV(opline->op1.var));
5701 			EX_CV(opline->op1.var) = NULL;
5702 		}
5703 		CHECK_EXCEPTION();
5704 		ZEND_VM_NEXT_OPCODE();
5705 	}
5706 
5707 	varname = opline->op1.zv;
5708 
5709 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5710 		ZVAL_COPY_VALUE(&tmp, varname);
5711 		zval_copy_ctor(&tmp);
5712 		convert_to_string(&tmp);
5713 		varname = &tmp;
5714 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5715 		Z_ADDREF_P(varname);
5716 	}
5717 
5718 	if (IS_UNUSED != IS_UNUSED) {
5719 		zend_class_entry *ce;
5720 
5721 		if (IS_UNUSED == IS_CONST) {
5722 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5723 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5724 			} else {
5725 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5726 				if (UNEXPECTED(EG(exception) != NULL)) {
5727 					if (IS_CONST != IS_CONST && varname == &tmp) {
5728 						zval_dtor(&tmp);
5729 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5730 						zval_ptr_dtor(&varname);
5731 					}
5732 
5733 					HANDLE_EXCEPTION();
5734 				}
5735 				if (UNEXPECTED(ce == NULL)) {
5736 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
5737 				}
5738 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5739 			}
5740 		} else {
5741 			ce = EX_T(opline->op2.var).class_entry;
5742 		}
5743 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5744 	} else {
5745 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
5746 
5747 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5748 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
5749 	}
5750 
5751 	if (IS_CONST != IS_CONST && varname == &tmp) {
5752 		zval_dtor(&tmp);
5753 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5754 		zval_ptr_dtor(&varname);
5755 	}
5756 
5757 	CHECK_EXCEPTION();
5758 	ZEND_VM_NEXT_OPCODE();
5759 }
5760 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5761 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5762 {
5763 	USE_OPLINE
5764 	zval **value;
5765 	zend_bool isset = 1;
5766 
5767 	SAVE_OPLINE();
5768 	if (IS_CONST == IS_CV &&
5769 	    IS_UNUSED == IS_UNUSED &&
5770 	    (opline->extended_value & ZEND_QUICK_SET)) {
5771 		if (EX_CV(opline->op1.var)) {
5772 			value = EX_CV(opline->op1.var);
5773 		} else if (EG(active_symbol_table)) {
5774 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5775 
5776 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
5777 				isset = 0;
5778 			}
5779 		} else {
5780 			isset = 0;
5781 		}
5782 	} else {
5783 		HashTable *target_symbol_table;
5784 
5785 		zval tmp, *varname = opline->op1.zv;
5786 
5787 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5788 			ZVAL_COPY_VALUE(&tmp, varname);
5789 			zval_copy_ctor(&tmp);
5790 			convert_to_string(&tmp);
5791 			varname = &tmp;
5792 		}
5793 
5794 		if (IS_UNUSED != IS_UNUSED) {
5795 			zend_class_entry *ce;
5796 
5797 			if (IS_UNUSED == IS_CONST) {
5798 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5799 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
5800 				} else {
5801 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5802 					if (UNEXPECTED(ce == NULL)) {
5803 						CHECK_EXCEPTION();
5804 						ZEND_VM_NEXT_OPCODE();
5805 					}
5806 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
5807 				}
5808 			} else {
5809 				ce = EX_T(opline->op2.var).class_entry;
5810 			}
5811 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5812 			if (!value) {
5813 				isset = 0;
5814 			}
5815 		} else {
5816 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5817 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
5818 				isset = 0;
5819 			}
5820 		}
5821 
5822 		if (IS_CONST != IS_CONST && varname == &tmp) {
5823 			zval_dtor(&tmp);
5824 		}
5825 
5826 	}
5827 
5828 	if (opline->extended_value & ZEND_ISSET) {
5829 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
5830 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5831 		} else {
5832 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5833 		}
5834 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
5835 		if (!isset || !i_zend_is_true(*value)) {
5836 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5837 		} else {
5838 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5839 		}
5840 	}
5841 
5842 	CHECK_EXCEPTION();
5843 	ZEND_VM_NEXT_OPCODE();
5844 }
5845 
ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5846 static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5847 {
5848 	USE_OPLINE
5849 	zend_function *op_array;
5850 	int closure_is_static, closure_is_being_defined_inside_static_context;
5851 
5852 	SAVE_OPLINE();
5853 
5854 	if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), Z_HASH_P(opline->op1.zv), (void *) &op_array) == FAILURE) ||
5855 	    UNEXPECTED(op_array->type != ZEND_USER_FUNCTION)) {
5856 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
5857 	}
5858 
5859 	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
5860 	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
5861 	if (closure_is_static || closure_is_being_defined_inside_static_context) {
5862 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
5863 	} else {
5864 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
5865 	}
5866 
5867 	CHECK_EXCEPTION();
5868 	ZEND_VM_NEXT_OPCODE();
5869 }
5870 
ZEND_ADD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5871 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5872 {
5873 	USE_OPLINE
5874 
5875 
5876 	SAVE_OPLINE();
5877 	fast_add_function(&EX_T(opline->result.var).tmp_var,
5878 		opline->op1.zv,
5879 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5880 
5881 
5882 	CHECK_EXCEPTION();
5883 	ZEND_VM_NEXT_OPCODE();
5884 }
5885 
ZEND_SUB_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5886 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5887 {
5888 	USE_OPLINE
5889 
5890 
5891 	SAVE_OPLINE();
5892 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
5893 		opline->op1.zv,
5894 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5895 
5896 
5897 	CHECK_EXCEPTION();
5898 	ZEND_VM_NEXT_OPCODE();
5899 }
5900 
ZEND_MUL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5901 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5902 {
5903 	USE_OPLINE
5904 
5905 
5906 	SAVE_OPLINE();
5907 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
5908 		opline->op1.zv,
5909 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5910 
5911 
5912 	CHECK_EXCEPTION();
5913 	ZEND_VM_NEXT_OPCODE();
5914 }
5915 
ZEND_DIV_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5916 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5917 {
5918 	USE_OPLINE
5919 
5920 
5921 	SAVE_OPLINE();
5922 	fast_div_function(&EX_T(opline->result.var).tmp_var,
5923 		opline->op1.zv,
5924 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5925 
5926 
5927 	CHECK_EXCEPTION();
5928 	ZEND_VM_NEXT_OPCODE();
5929 }
5930 
ZEND_MOD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5931 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5932 {
5933 	USE_OPLINE
5934 
5935 
5936 	SAVE_OPLINE();
5937 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
5938 		opline->op1.zv,
5939 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5940 
5941 
5942 	CHECK_EXCEPTION();
5943 	ZEND_VM_NEXT_OPCODE();
5944 }
5945 
ZEND_SL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5946 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5947 {
5948 	USE_OPLINE
5949 
5950 
5951 	SAVE_OPLINE();
5952 	shift_left_function(&EX_T(opline->result.var).tmp_var,
5953 		opline->op1.zv,
5954 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5955 
5956 
5957 	CHECK_EXCEPTION();
5958 	ZEND_VM_NEXT_OPCODE();
5959 }
5960 
ZEND_SR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5961 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5962 {
5963 	USE_OPLINE
5964 
5965 
5966 	SAVE_OPLINE();
5967 	shift_right_function(&EX_T(opline->result.var).tmp_var,
5968 		opline->op1.zv,
5969 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5970 
5971 
5972 	CHECK_EXCEPTION();
5973 	ZEND_VM_NEXT_OPCODE();
5974 }
5975 
ZEND_CONCAT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5976 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5977 {
5978 	USE_OPLINE
5979 
5980 
5981 	SAVE_OPLINE();
5982 	concat_function(&EX_T(opline->result.var).tmp_var,
5983 		opline->op1.zv,
5984 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
5985 
5986 
5987 	CHECK_EXCEPTION();
5988 	ZEND_VM_NEXT_OPCODE();
5989 }
5990 
ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5991 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5992 {
5993 	USE_OPLINE
5994 
5995 
5996 	SAVE_OPLINE();
5997 	is_identical_function(&EX_T(opline->result.var).tmp_var,
5998 		opline->op1.zv,
5999 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6000 
6001 
6002 	CHECK_EXCEPTION();
6003 	ZEND_VM_NEXT_OPCODE();
6004 }
6005 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6006 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6007 {
6008 	USE_OPLINE
6009 
6010 	zval *result = &EX_T(opline->result.var).tmp_var;
6011 
6012 	SAVE_OPLINE();
6013 	is_identical_function(result,
6014 		opline->op1.zv,
6015 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6016 	Z_LVAL_P(result) = !Z_LVAL_P(result);
6017 
6018 
6019 	CHECK_EXCEPTION();
6020 	ZEND_VM_NEXT_OPCODE();
6021 }
6022 
ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6023 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6024 {
6025 	USE_OPLINE
6026 
6027 	zval *result = &EX_T(opline->result.var).tmp_var;
6028 
6029 	SAVE_OPLINE();
6030 	ZVAL_BOOL(result, fast_equal_function(result,
6031 		opline->op1.zv,
6032 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
6033 
6034 
6035 	CHECK_EXCEPTION();
6036 	ZEND_VM_NEXT_OPCODE();
6037 }
6038 
ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6039 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6040 {
6041 	USE_OPLINE
6042 
6043 	zval *result = &EX_T(opline->result.var).tmp_var;
6044 
6045 	SAVE_OPLINE();
6046 	ZVAL_BOOL(result, fast_not_equal_function(result,
6047 		opline->op1.zv,
6048 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
6049 
6050 
6051 	CHECK_EXCEPTION();
6052 	ZEND_VM_NEXT_OPCODE();
6053 }
6054 
ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6055 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6056 {
6057 	USE_OPLINE
6058 
6059 	zval *result = &EX_T(opline->result.var).tmp_var;
6060 
6061 	SAVE_OPLINE();
6062 	ZVAL_BOOL(result, fast_is_smaller_function(result,
6063 		opline->op1.zv,
6064 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
6065 
6066 
6067 	CHECK_EXCEPTION();
6068 	ZEND_VM_NEXT_OPCODE();
6069 }
6070 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6071 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6072 {
6073 	USE_OPLINE
6074 
6075 	zval *result = &EX_T(opline->result.var).tmp_var;
6076 
6077 	SAVE_OPLINE();
6078 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
6079 		opline->op1.zv,
6080 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
6081 
6082 
6083 	CHECK_EXCEPTION();
6084 	ZEND_VM_NEXT_OPCODE();
6085 }
6086 
ZEND_BW_OR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6087 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6088 {
6089 	USE_OPLINE
6090 
6091 
6092 	SAVE_OPLINE();
6093 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
6094 		opline->op1.zv,
6095 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6096 
6097 
6098 	CHECK_EXCEPTION();
6099 	ZEND_VM_NEXT_OPCODE();
6100 }
6101 
ZEND_BW_AND_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6102 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6103 {
6104 	USE_OPLINE
6105 
6106 
6107 	SAVE_OPLINE();
6108 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
6109 		opline->op1.zv,
6110 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6111 
6112 
6113 	CHECK_EXCEPTION();
6114 	ZEND_VM_NEXT_OPCODE();
6115 }
6116 
ZEND_BW_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6117 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6118 {
6119 	USE_OPLINE
6120 
6121 
6122 	SAVE_OPLINE();
6123 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
6124 		opline->op1.zv,
6125 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6126 
6127 
6128 	CHECK_EXCEPTION();
6129 	ZEND_VM_NEXT_OPCODE();
6130 }
6131 
ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6132 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6133 {
6134 	USE_OPLINE
6135 
6136 
6137 	SAVE_OPLINE();
6138 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
6139 		opline->op1.zv,
6140 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6141 
6142 
6143 	CHECK_EXCEPTION();
6144 	ZEND_VM_NEXT_OPCODE();
6145 }
6146 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6147 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6148 {
6149 	USE_OPLINE
6150 	zval *function_name;
6151 	zend_class_entry *ce;
6152 
6153 	SAVE_OPLINE();
6154 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
6155 
6156 	if (IS_CONST == IS_CONST) {
6157 		/* no function found. try a static method in class */
6158 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
6159 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
6160 		} else {
6161 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
6162 			if (UNEXPECTED(EG(exception) != NULL)) {
6163 				HANDLE_EXCEPTION();
6164 			}
6165 			if (UNEXPECTED(ce == NULL)) {
6166 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
6167 			}
6168 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
6169 		}
6170 		EX(called_scope) = ce;
6171 	} else {
6172 		ce = EX_T(opline->op1.var).class_entry;
6173 
6174 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
6175 			EX(called_scope) = EG(called_scope);
6176 		} else {
6177 			EX(called_scope) = ce;
6178 		}
6179 	}
6180 
6181 	if (IS_CONST == IS_CONST &&
6182 	    IS_CV == IS_CONST &&
6183 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
6184 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
6185 	} else if (IS_CONST != IS_CONST &&
6186 	           IS_CV == IS_CONST &&
6187 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
6188 		/* do nothing */
6189 	} else if (IS_CV != IS_UNUSED) {
6190 		char *function_name_strval = NULL;
6191 		int function_name_strlen = 0;
6192 
6193 
6194 		if (IS_CV == IS_CONST) {
6195 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
6196 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
6197 		} else {
6198 			function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
6199 
6200 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
6201 				zend_error_noreturn(E_ERROR, "Function name must be a string");
6202 			} else {
6203 				function_name_strval = Z_STRVAL_P(function_name);
6204 				function_name_strlen = Z_STRLEN_P(function_name);
6205  			}
6206 		}
6207 
6208 		if (function_name_strval) {
6209 			if (ce->get_static_method) {
6210 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
6211 			} else {
6212 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
6213 			}
6214 			if (UNEXPECTED(EX(fbc) == NULL)) {
6215 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
6216 			}
6217 			if (IS_CV == IS_CONST &&
6218 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
6219 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
6220 				if (IS_CONST == IS_CONST) {
6221 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
6222 				} else {
6223 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
6224 				}
6225 			}
6226 		}
6227 		if (IS_CV != IS_CONST) {
6228 
6229 		}
6230 	} else {
6231 		if (UNEXPECTED(ce->constructor == NULL)) {
6232 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
6233 		}
6234 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
6235 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
6236 		}
6237 		EX(fbc) = ce->constructor;
6238 	}
6239 
6240 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
6241 		EX(object) = NULL;
6242 	} else {
6243 		if (EG(This) &&
6244 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
6245 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
6246 		    /* We are calling method of the other (incompatible) class,
6247 		       but passing $this. This is done for compatibility with php-4. */
6248 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
6249 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
6250 			} else {
6251 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
6252 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
6253 			}
6254 		}
6255 		if ((EX(object) = EG(This))) {
6256 			Z_ADDREF_P(EX(object));
6257 			EX(called_scope) = Z_OBJCE_P(EX(object));
6258 		}
6259 	}
6260 
6261 	CHECK_EXCEPTION();
6262 	ZEND_VM_NEXT_OPCODE();
6263 }
6264 
ZEND_CATCH_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6265 static int ZEND_FASTCALL  ZEND_CATCH_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6266 {
6267 	USE_OPLINE
6268 	zend_class_entry *ce, *catch_ce;
6269 	zval *exception;
6270 
6271 	SAVE_OPLINE();
6272 	/* Check whether an exception has been thrown, if not, jump over code */
6273 	zend_exception_restore(TSRMLS_C);
6274 	if (EG(exception) == NULL) {
6275 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
6276 		ZEND_VM_CONTINUE(); /* CHECK_ME */
6277 	}
6278 	if (CACHED_PTR(opline->op1.literal->cache_slot)) {
6279 		catch_ce = CACHED_PTR(opline->op1.literal->cache_slot);
6280 	} else {
6281 		catch_ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, ZEND_FETCH_CLASS_NO_AUTOLOAD TSRMLS_CC);
6282 
6283 		CACHE_PTR(opline->op1.literal->cache_slot, catch_ce);
6284 	}
6285 	ce = Z_OBJCE_P(EG(exception));
6286 
6287 #ifdef HAVE_DTRACE
6288 	if (DTRACE_EXCEPTION_CAUGHT_ENABLED()) {
6289 		DTRACE_EXCEPTION_CAUGHT((char *)ce->name);
6290 	}
6291 #endif /* HAVE_DTRACE */
6292 
6293 	if (ce != catch_ce) {
6294 		if (!instanceof_function(ce, catch_ce TSRMLS_CC)) {
6295 			if (opline->result.num) {
6296 				zend_throw_exception_internal(NULL TSRMLS_CC);
6297 				HANDLE_EXCEPTION();
6298 			}
6299 			ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
6300 			ZEND_VM_CONTINUE(); /* CHECK_ME */
6301 		}
6302 	}
6303 
6304 	exception = EG(exception);
6305 	if (!EG(active_symbol_table)) {
6306 		if (EX_CV(opline->op2.var)) {
6307 			zval_ptr_dtor(EX_CV(opline->op2.var));
6308 		}
6309 		EX_CV(opline->op2.var) = (zval**)EX_CVs() + (EX(op_array)->last_var + opline->op2.var);
6310 		*EX_CV(opline->op2.var) = EG(exception);
6311 	} else {
6312 		zend_compiled_variable *cv = &CV_DEF_OF(opline->op2.var);
6313 		zend_hash_quick_update(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value,
6314 		    &EG(exception), sizeof(zval *), (void**)&EX_CV(opline->op2.var));
6315 	}
6316 	if (UNEXPECTED(EG(exception) != exception)) {
6317 		Z_ADDREF_P(EG(exception));
6318 		HANDLE_EXCEPTION();
6319 	} else {
6320 		EG(exception) = NULL;
6321 		ZEND_VM_NEXT_OPCODE();
6322 	}
6323 }
6324 
ZEND_CASE_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6325 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6326 {
6327 	USE_OPLINE
6328 
6329 
6330 	SAVE_OPLINE();
6331 	if (IS_CONST==IS_VAR) {
6332 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
6333 	}
6334 	is_equal_function(&EX_T(opline->result.var).tmp_var,
6335 				 opline->op1.zv,
6336 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
6337 
6338 	CHECK_EXCEPTION();
6339 	ZEND_VM_NEXT_OPCODE();
6340 }
6341 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6342 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6343 {
6344 	USE_OPLINE
6345 
6346 	zval *expr_ptr;
6347 
6348 	SAVE_OPLINE();
6349 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
6350 		zval **expr_ptr_ptr = NULL;
6351 
6352 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
6353 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
6354 		}
6355 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
6356 		expr_ptr = *expr_ptr_ptr;
6357 		Z_ADDREF_P(expr_ptr);
6358 	} else {
6359 		expr_ptr=opline->op1.zv;
6360 		if (0) { /* temporary variable */
6361 			zval *new_expr;
6362 
6363 			ALLOC_ZVAL(new_expr);
6364 			INIT_PZVAL_COPY(new_expr, expr_ptr);
6365 			expr_ptr = new_expr;
6366 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
6367 			zval *new_expr;
6368 
6369 			ALLOC_ZVAL(new_expr);
6370 			INIT_PZVAL_COPY(new_expr, expr_ptr);
6371 			expr_ptr = new_expr;
6372 			zendi_zval_copy_ctor(*expr_ptr);
6373 		} else {
6374 			Z_ADDREF_P(expr_ptr);
6375 		}
6376 	}
6377 
6378 	if (IS_CV != IS_UNUSED) {
6379 
6380 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
6381 		ulong hval;
6382 
6383 		switch (Z_TYPE_P(offset)) {
6384 			case IS_DOUBLE:
6385 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
6386 				goto num_index;
6387 			case IS_LONG:
6388 			case IS_BOOL:
6389 				hval = Z_LVAL_P(offset);
6390 num_index:
6391 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
6392 				break;
6393 			case IS_STRING:
6394 				if (IS_CV == IS_CONST) {
6395 					hval = Z_HASH_P(offset);
6396 				} else {
6397 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
6398 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
6399 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
6400 					} else {
6401 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
6402 					}
6403 				}
6404 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
6405 				break;
6406 			case IS_NULL:
6407 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
6408 				break;
6409 			default:
6410 				zend_error(E_WARNING, "Illegal offset type");
6411 				zval_ptr_dtor(&expr_ptr);
6412 				/* do nothing */
6413 				break;
6414 		}
6415 
6416 	} else {
6417 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
6418 	}
6419 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
6420 
6421 	} else {
6422 
6423 	}
6424 	CHECK_EXCEPTION();
6425 	ZEND_VM_NEXT_OPCODE();
6426 }
6427 
ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6428 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6429 {
6430 	USE_OPLINE
6431 
6432 	array_init(&EX_T(opline->result.var).tmp_var);
6433 	if (IS_CONST == IS_UNUSED) {
6434 		ZEND_VM_NEXT_OPCODE();
6435 #if 0 || IS_CONST != IS_UNUSED
6436 	} else {
6437 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6438 #endif
6439 	}
6440 }
6441 
ZEND_BW_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6442 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6443 {
6444 	USE_OPLINE
6445 	zend_free_op free_op1;
6446 
6447 	SAVE_OPLINE();
6448 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
6449 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC) TSRMLS_CC);
6450 	zval_dtor(free_op1.var);
6451 	CHECK_EXCEPTION();
6452 	ZEND_VM_NEXT_OPCODE();
6453 }
6454 
ZEND_BOOL_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6455 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6456 {
6457 	USE_OPLINE
6458 	zend_free_op free_op1;
6459 
6460 	SAVE_OPLINE();
6461 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
6462 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC) TSRMLS_CC);
6463 	zval_dtor(free_op1.var);
6464 	CHECK_EXCEPTION();
6465 	ZEND_VM_NEXT_OPCODE();
6466 }
6467 
ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6468 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6469 {
6470 	USE_OPLINE
6471 	zend_free_op free_op1;
6472 	zval *z;
6473 
6474 	SAVE_OPLINE();
6475 	z = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6476 
6477 	if (IS_TMP_VAR == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
6478 		INIT_PZVAL(z);
6479 	}
6480 	zend_print_variable(z);
6481 
6482 	zval_dtor(free_op1.var);
6483 	CHECK_EXCEPTION();
6484 	ZEND_VM_NEXT_OPCODE();
6485 }
6486 
ZEND_PRINT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6487 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6488 {
6489 	USE_OPLINE
6490 
6491 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
6492 	return ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6493 }
6494 
ZEND_JMPZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6495 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6496 {
6497 	USE_OPLINE
6498 	zend_free_op free_op1;
6499 	zval *val;
6500 	int ret;
6501 
6502 	SAVE_OPLINE();
6503 	val = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6504 
6505 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
6506 		ret = Z_LVAL_P(val);
6507 	} else {
6508 		ret = i_zend_is_true(val);
6509 		zval_dtor(free_op1.var);
6510 		if (UNEXPECTED(EG(exception) != NULL)) {
6511 			HANDLE_EXCEPTION();
6512 		}
6513 	}
6514 	if (!ret) {
6515 #if DEBUG_ZEND>=2
6516 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
6517 #endif
6518 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
6519 		ZEND_VM_CONTINUE();
6520 	}
6521 
6522 	ZEND_VM_NEXT_OPCODE();
6523 }
6524 
ZEND_JMPNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6525 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6526 {
6527 	USE_OPLINE
6528 	zend_free_op free_op1;
6529 	zval *val;
6530 	int ret;
6531 
6532 	SAVE_OPLINE();
6533 	val = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6534 
6535 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
6536 		ret = Z_LVAL_P(val);
6537 	} else {
6538 		ret = i_zend_is_true(val);
6539 		zval_dtor(free_op1.var);
6540 		if (UNEXPECTED(EG(exception) != NULL)) {
6541 			HANDLE_EXCEPTION();
6542 		}
6543 	}
6544 	if (ret) {
6545 #if DEBUG_ZEND>=2
6546 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
6547 #endif
6548 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
6549 		ZEND_VM_CONTINUE();
6550 	}
6551 
6552 	ZEND_VM_NEXT_OPCODE();
6553 }
6554 
ZEND_JMPZNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6555 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6556 {
6557 	USE_OPLINE
6558 	zend_free_op free_op1;
6559 	zval *val;
6560 	int retval;
6561 
6562 	SAVE_OPLINE();
6563 	val = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6564 
6565 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
6566 		retval = Z_LVAL_P(val);
6567 	} else {
6568 		retval = i_zend_is_true(val);
6569 		zval_dtor(free_op1.var);
6570 		if (UNEXPECTED(EG(exception) != NULL)) {
6571 			HANDLE_EXCEPTION();
6572 		}
6573 	}
6574 	if (EXPECTED(retval != 0)) {
6575 #if DEBUG_ZEND>=2
6576 		printf("Conditional jmp on true to %d\n", opline->extended_value);
6577 #endif
6578 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
6579 		ZEND_VM_CONTINUE(); /* CHECK_ME */
6580 	} else {
6581 #if DEBUG_ZEND>=2
6582 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
6583 #endif
6584 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
6585 		ZEND_VM_CONTINUE(); /* CHECK_ME */
6586 	}
6587 }
6588 
ZEND_JMPZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6589 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6590 {
6591 	USE_OPLINE
6592 	zend_free_op free_op1;
6593 	zval *val;
6594 	int retval;
6595 
6596 	SAVE_OPLINE();
6597 	val = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6598 
6599 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
6600 		retval = Z_LVAL_P(val);
6601 	} else {
6602 		retval = i_zend_is_true(val);
6603 		zval_dtor(free_op1.var);
6604 		if (UNEXPECTED(EG(exception) != NULL)) {
6605 			HANDLE_EXCEPTION();
6606 		}
6607 	}
6608 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
6609 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
6610 	if (!retval) {
6611 #if DEBUG_ZEND>=2
6612 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
6613 #endif
6614 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
6615 		ZEND_VM_CONTINUE();
6616 	}
6617 	ZEND_VM_NEXT_OPCODE();
6618 }
6619 
ZEND_JMPNZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6620 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6621 {
6622 	USE_OPLINE
6623 	zend_free_op free_op1;
6624 	zval *val;
6625 	int retval;
6626 
6627 	SAVE_OPLINE();
6628 	val = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6629 
6630 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
6631 		retval = Z_LVAL_P(val);
6632 	} else {
6633 		retval = i_zend_is_true(val);
6634 		zval_dtor(free_op1.var);
6635 		if (UNEXPECTED(EG(exception) != NULL)) {
6636 			HANDLE_EXCEPTION();
6637 		}
6638 	}
6639 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
6640 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
6641 	if (retval) {
6642 #if DEBUG_ZEND>=2
6643 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
6644 #endif
6645 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
6646 		ZEND_VM_CONTINUE();
6647 	}
6648 	ZEND_VM_NEXT_OPCODE();
6649 }
6650 
ZEND_FREE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6651 static int ZEND_FASTCALL  ZEND_FREE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6652 {
6653 	USE_OPLINE
6654 
6655 	SAVE_OPLINE();
6656 	if (IS_TMP_VAR == IS_TMP_VAR) {
6657 		zendi_zval_dtor(EX_T(opline->op1.var).tmp_var);
6658 	} else {
6659 		zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
6660 	}
6661 	CHECK_EXCEPTION();
6662 	ZEND_VM_NEXT_OPCODE();
6663 }
6664 
ZEND_RETURN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6665 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6666 {
6667 	USE_OPLINE
6668 	zval *retval_ptr;
6669 	zend_free_op free_op1;
6670 
6671 	SAVE_OPLINE();
6672 	retval_ptr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6673 
6674 	if (!EG(return_value_ptr_ptr)) {
6675 		if (IS_TMP_VAR == IS_TMP_VAR) {
6676 			zval_dtor(free_op1.var);
6677 		}
6678 	} else if (!1) { /* Not a temp var */
6679 		if (IS_TMP_VAR == IS_CONST ||
6680 		    (PZVAL_IS_REF(retval_ptr) && Z_REFCOUNT_P(retval_ptr) > 0)) {
6681 			zval *ret;
6682 
6683 			ALLOC_ZVAL(ret);
6684 			INIT_PZVAL_COPY(ret, retval_ptr);
6685 			zval_copy_ctor(ret);
6686 			*EG(return_value_ptr_ptr) = ret;
6687 		} else if ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
6688 		           retval_ptr == &EG(uninitialized_zval)) {
6689 			zval *ret;
6690 
6691 			ALLOC_INIT_ZVAL(ret);
6692 			*EG(return_value_ptr_ptr) = ret;
6693 		} else {
6694 			*EG(return_value_ptr_ptr) = retval_ptr;
6695 			Z_ADDREF_P(retval_ptr);
6696 		}
6697 	} else {
6698 		zval *ret;
6699 
6700 		ALLOC_ZVAL(ret);
6701 		INIT_PZVAL_COPY(ret, retval_ptr);
6702 		*EG(return_value_ptr_ptr) = ret;
6703 	}
6704 
6705 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6706 }
6707 
ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6708 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6709 {
6710 	USE_OPLINE
6711 	zval *retval_ptr;
6712 	zval **retval_ptr_ptr;
6713 	zend_free_op free_op1;
6714 
6715 	SAVE_OPLINE();
6716 
6717 	do {
6718 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
6719 			/* Not supposed to happen, but we'll allow it */
6720 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
6721 
6722 			retval_ptr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6723 			if (!EG(return_value_ptr_ptr)) {
6724 				if (IS_TMP_VAR == IS_TMP_VAR) {
6725 					zval_dtor(free_op1.var);
6726 				}
6727 			} else if (!1) { /* Not a temp var */
6728 				zval *ret;
6729 
6730 				ALLOC_ZVAL(ret);
6731 				INIT_PZVAL_COPY(ret, retval_ptr);
6732 				zval_copy_ctor(ret);
6733 				*EG(return_value_ptr_ptr) = ret;
6734 			} else {
6735 				zval *ret;
6736 
6737 				ALLOC_ZVAL(ret);
6738 				INIT_PZVAL_COPY(ret, retval_ptr);
6739 				*EG(return_value_ptr_ptr) = ret;
6740 			}
6741 			break;
6742 		}
6743 
6744 		retval_ptr_ptr = NULL;
6745 
6746 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
6747 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
6748 		}
6749 
6750 		if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
6751 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
6752 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
6753 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
6754 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
6755 				if (EG(return_value_ptr_ptr)) {
6756 					zval *ret;
6757 
6758 					ALLOC_ZVAL(ret);
6759 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
6760 					zval_copy_ctor(ret);
6761 					*EG(return_value_ptr_ptr) = ret;
6762 				}
6763 				break;
6764 			}
6765 		}
6766 
6767 		if (EG(return_value_ptr_ptr)) {
6768 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
6769 			Z_ADDREF_PP(retval_ptr_ptr);
6770 
6771 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
6772 		}
6773 	} while (0);
6774 
6775 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6776 }
6777 
ZEND_THROW_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6778 static int ZEND_FASTCALL  ZEND_THROW_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6779 {
6780 	USE_OPLINE
6781 	zval *value;
6782 	zval *exception;
6783 	zend_free_op free_op1;
6784 
6785 	SAVE_OPLINE();
6786 	value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6787 
6788 	if (IS_TMP_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
6789 		zend_error_noreturn(E_ERROR, "Can only throw objects");
6790 	}
6791 	zend_exception_save(TSRMLS_C);
6792 	/* Not sure if a complete copy is what we want here */
6793 	ALLOC_ZVAL(exception);
6794 	INIT_PZVAL_COPY(exception, value);
6795 	if (!1) {
6796 		zval_copy_ctor(exception);
6797 	}
6798 
6799 	zend_throw_exception_object(exception TSRMLS_CC);
6800 	zend_exception_restore(TSRMLS_C);
6801 
6802 	HANDLE_EXCEPTION();
6803 }
6804 
ZEND_SEND_VAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6805 static int ZEND_FASTCALL  ZEND_SEND_VAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6806 {
6807 	USE_OPLINE
6808 
6809 	SAVE_OPLINE();
6810 	if (opline->extended_value==ZEND_DO_FCALL_BY_NAME
6811 		&& ARG_MUST_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
6812 			zend_error_noreturn(E_ERROR, "Cannot pass parameter %d by reference", opline->op2.opline_num);
6813 	}
6814 	{
6815 		zval *valptr;
6816 		zval *value;
6817 		zend_free_op free_op1;
6818 
6819 		value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6820 
6821 		ALLOC_ZVAL(valptr);
6822 		INIT_PZVAL_COPY(valptr, value);
6823 		if (!1) {
6824 			zval_copy_ctor(valptr);
6825 		}
6826 		zend_vm_stack_push(valptr TSRMLS_CC);
6827 
6828 	}
6829 	CHECK_EXCEPTION();
6830 	ZEND_VM_NEXT_OPCODE();
6831 }
6832 
ZEND_BOOL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6833 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6834 {
6835 	USE_OPLINE
6836 	zend_free_op free_op1;
6837 	zval *retval = &EX_T(opline->result.var).tmp_var;
6838 
6839 	SAVE_OPLINE();
6840 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
6841 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC)));
6842 	zval_dtor(free_op1.var);
6843 
6844 	CHECK_EXCEPTION();
6845 	ZEND_VM_NEXT_OPCODE();
6846 }
6847 
ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6848 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6849 {
6850 	USE_OPLINE
6851 	zend_free_op free_op1;
6852 	zval *obj;
6853 	zend_class_entry *ce;
6854 	zend_function *clone;
6855 	zend_object_clone_obj_t clone_call;
6856 
6857 	SAVE_OPLINE();
6858 	obj = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6859 
6860 	if (IS_TMP_VAR == IS_CONST ||
6861 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
6862 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
6863 	}
6864 
6865 	ce = Z_OBJCE_P(obj);
6866 	clone = ce ? ce->clone : NULL;
6867 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
6868 	if (UNEXPECTED(clone_call == NULL)) {
6869 		if (ce) {
6870 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
6871 		} else {
6872 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
6873 		}
6874 	}
6875 
6876 	if (ce && clone) {
6877 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
6878 			/* Ensure that if we're calling a private function, we're allowed to do so.
6879 			 */
6880 			if (UNEXPECTED(ce != EG(scope))) {
6881 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
6882 			}
6883 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
6884 			/* Ensure that if we're calling a protected function, we're allowed to do so.
6885 			 */
6886 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
6887 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
6888 			}
6889 		}
6890 	}
6891 
6892 	if (EXPECTED(EG(exception) == NULL)) {
6893 		zval *retval;
6894 
6895 		ALLOC_ZVAL(retval);
6896 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
6897 		Z_TYPE_P(retval) = IS_OBJECT;
6898 		Z_SET_REFCOUNT_P(retval, 1);
6899 		Z_SET_ISREF_P(retval);
6900 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
6901 			zval_ptr_dtor(&retval);
6902 		} else {
6903 			AI_SET_PTR(&EX_T(opline->result.var), retval);
6904 		}
6905 	}
6906 
6907 	CHECK_EXCEPTION();
6908 	ZEND_VM_NEXT_OPCODE();
6909 }
6910 
ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6911 static int ZEND_FASTCALL  ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6912 {
6913 	USE_OPLINE
6914 	zend_free_op free_op1;
6915 	zval *expr;
6916 	zval *result = &EX_T(opline->result.var).tmp_var;
6917 
6918 	SAVE_OPLINE();
6919 	expr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6920 
6921 	if (opline->extended_value != IS_STRING) {
6922 		ZVAL_COPY_VALUE(result, expr);
6923 		if (!1) {
6924 			zendi_zval_copy_ctor(*result);
6925 		}
6926 	}
6927 	switch (opline->extended_value) {
6928 		case IS_NULL:
6929 			convert_to_null(result);
6930 			break;
6931 		case IS_BOOL:
6932 			convert_to_boolean(result);
6933 			break;
6934 		case IS_LONG:
6935 			convert_to_long(result);
6936 			break;
6937 		case IS_DOUBLE:
6938 			convert_to_double(result);
6939 			break;
6940 		case IS_STRING: {
6941 			zval var_copy;
6942 			int use_copy;
6943 
6944 			zend_make_printable_zval(expr, &var_copy, &use_copy);
6945 			if (use_copy) {
6946 				ZVAL_COPY_VALUE(result, &var_copy);
6947 				if (1) {
6948 					zval_dtor(free_op1.var);
6949 				}
6950 			} else {
6951 				ZVAL_COPY_VALUE(result, expr);
6952 				if (!1) {
6953 					zendi_zval_copy_ctor(*result);
6954 				}
6955 			}
6956 			break;
6957 		}
6958 		case IS_ARRAY:
6959 			convert_to_array(result);
6960 			break;
6961 		case IS_OBJECT:
6962 			convert_to_object(result);
6963 			break;
6964 	}
6965 
6966 	CHECK_EXCEPTION();
6967 	ZEND_VM_NEXT_OPCODE();
6968 }
6969 
ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6970 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6971 {
6972 	USE_OPLINE
6973 	zend_op_array *new_op_array=NULL;
6974 	zend_free_op free_op1;
6975 	zval *inc_filename;
6976     zval *tmp_inc_filename = NULL;
6977 	zend_bool failure_retval=0;
6978 
6979 	SAVE_OPLINE();
6980 	inc_filename = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
6981 
6982 	if (inc_filename->type!=IS_STRING) {
6983 		MAKE_STD_ZVAL(tmp_inc_filename);
6984 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
6985 		zval_copy_ctor(tmp_inc_filename);
6986 		convert_to_string(tmp_inc_filename);
6987 		inc_filename = tmp_inc_filename;
6988 	}
6989 
6990 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
6991 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
6992 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
6993 		} else {
6994 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
6995 		}
6996 	} else {
6997 		switch (opline->extended_value) {
6998 			case ZEND_INCLUDE_ONCE:
6999 			case ZEND_REQUIRE_ONCE: {
7000 					zend_file_handle file_handle;
7001 					char *resolved_path;
7002 
7003 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
7004 					if (resolved_path) {
7005 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
7006 					} else {
7007 						resolved_path = Z_STRVAL_P(inc_filename);
7008 					}
7009 
7010 					if (failure_retval) {
7011 						/* do nothing, file already included */
7012 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
7013 
7014 						if (!file_handle.opened_path) {
7015 							file_handle.opened_path = estrdup(resolved_path);
7016 						}
7017 
7018 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
7019 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
7020 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
7021 						} else {
7022 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
7023 							failure_retval=1;
7024 						}
7025 					} else {
7026 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
7027 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
7028 						} else {
7029 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
7030 						}
7031 					}
7032 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
7033 						efree(resolved_path);
7034 					}
7035 				}
7036 				break;
7037 			case ZEND_INCLUDE:
7038 			case ZEND_REQUIRE:
7039 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
7040 				break;
7041 			case ZEND_EVAL: {
7042 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
7043 
7044 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
7045 					efree(eval_desc);
7046 				}
7047 				break;
7048 			EMPTY_SWITCH_DEFAULT_CASE()
7049 		}
7050 	}
7051 	if (tmp_inc_filename) {
7052 		zval_ptr_dtor(&tmp_inc_filename);
7053 	}
7054 	zval_dtor(free_op1.var);
7055 	if (UNEXPECTED(EG(exception) != NULL)) {
7056 		HANDLE_EXCEPTION();
7057 	} else if (EXPECTED(new_op_array != NULL)) {
7058 		EX(original_return_value) = EG(return_value_ptr_ptr);
7059 		EG(active_op_array) = new_op_array;
7060 		if (RETURN_VALUE_USED(opline)) {
7061 			EX_T(opline->result.var).var.ptr = NULL;
7062 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
7063 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
7064 		} else {
7065 			EG(return_value_ptr_ptr) = NULL;
7066 		}
7067 
7068 		EX(current_object) = EX(object);
7069 
7070 		EX(function_state).function = (zend_function *) new_op_array;
7071 		EX(object) = NULL;
7072 
7073 		if (!EG(active_symbol_table)) {
7074 			zend_rebuild_symbol_table(TSRMLS_C);
7075 		}
7076 
7077 		if (EXPECTED(zend_execute == execute)) {
7078 			ZEND_VM_ENTER();
7079 		} else {
7080 			zend_execute(new_op_array TSRMLS_CC);
7081 		}
7082 
7083 		EX(function_state).function = (zend_function *) EX(op_array);
7084 		EX(object) = EX(current_object);
7085 
7086 		EG(opline_ptr) = &EX(opline);
7087 		EG(active_op_array) = EX(op_array);
7088 		EG(return_value_ptr_ptr) = EX(original_return_value);
7089 		destroy_op_array(new_op_array TSRMLS_CC);
7090 		efree(new_op_array);
7091 		if (UNEXPECTED(EG(exception) != NULL)) {
7092 			zend_throw_exception_internal(NULL TSRMLS_CC);
7093 			HANDLE_EXCEPTION();
7094 		} else if (RETURN_VALUE_USED(opline)) {
7095 			if (!EX_T(opline->result.var).var.ptr) { /* there was no return statement */
7096 				zval *retval;
7097 
7098 				ALLOC_ZVAL(retval);
7099 				ZVAL_BOOL(retval, 1);
7100 				INIT_PZVAL(retval);
7101 				EX_T(opline->result.var).var.ptr = retval;
7102 			}
7103 		}
7104 
7105 	} else if (RETURN_VALUE_USED(opline)) {
7106 		zval *retval;
7107 
7108 		ALLOC_ZVAL(retval);
7109 		ZVAL_BOOL(retval, failure_retval);
7110 		INIT_PZVAL(retval);
7111 		AI_SET_PTR(&EX_T(opline->result.var), retval);
7112 	}
7113 	ZEND_VM_NEXT_OPCODE();
7114 }
7115 
ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7116 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7117 {
7118 	USE_OPLINE
7119 	zend_free_op free_op1;
7120 	zval *array_ptr, **array_ptr_ptr;
7121 	HashTable *fe_ht;
7122 	zend_object_iterator *iter = NULL;
7123 	zend_class_entry *ce = NULL;
7124 	zend_bool is_empty = 0;
7125 
7126 	SAVE_OPLINE();
7127 
7128 	if ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
7129 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
7130 		array_ptr_ptr = NULL;
7131 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
7132 			MAKE_STD_ZVAL(array_ptr);
7133 			ZVAL_NULL(array_ptr);
7134 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
7135 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
7136 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
7137 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
7138 			}
7139 
7140 			ce = Z_OBJCE_PP(array_ptr_ptr);
7141 			if (!ce || ce->get_iterator == NULL) {
7142 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
7143 				Z_ADDREF_PP(array_ptr_ptr);
7144 			}
7145 			array_ptr = *array_ptr_ptr;
7146 		} else {
7147 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
7148 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
7149 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
7150 					Z_SET_ISREF_PP(array_ptr_ptr);
7151 				}
7152 			}
7153 			array_ptr = *array_ptr_ptr;
7154 			Z_ADDREF_P(array_ptr);
7155 		}
7156 	} else {
7157 		array_ptr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7158 		if (1) { /* IS_TMP_VAR */
7159 			zval *tmp;
7160 
7161 			ALLOC_ZVAL(tmp);
7162 			INIT_PZVAL_COPY(tmp, array_ptr);
7163 			array_ptr = tmp;
7164 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
7165 				ce = Z_OBJCE_P(array_ptr);
7166 				if (ce && ce->get_iterator) {
7167 					Z_DELREF_P(array_ptr);
7168 				}
7169 			}
7170 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
7171 			ce = Z_OBJCE_P(array_ptr);
7172 			if (!ce || !ce->get_iterator) {
7173 				Z_ADDREF_P(array_ptr);
7174 			}
7175 		} else if (IS_TMP_VAR == IS_CONST ||
7176 		           ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
7177 		            !Z_ISREF_P(array_ptr) &&
7178 		            Z_REFCOUNT_P(array_ptr) > 1)) {
7179 			zval *tmp;
7180 
7181 			ALLOC_ZVAL(tmp);
7182 			INIT_PZVAL_COPY(tmp, array_ptr);
7183 			zval_copy_ctor(tmp);
7184 			array_ptr = tmp;
7185 		} else {
7186 			Z_ADDREF_P(array_ptr);
7187 		}
7188 	}
7189 
7190 	if (ce && ce->get_iterator) {
7191 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
7192 
7193 		if (iter && EXPECTED(EG(exception) == NULL)) {
7194 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
7195 		} else {
7196 
7197 			if (!EG(exception)) {
7198 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
7199 			}
7200 			zend_throw_exception_internal(NULL TSRMLS_CC);
7201 			HANDLE_EXCEPTION();
7202 		}
7203 	}
7204 
7205 	EX_T(opline->result.var).fe.ptr = array_ptr;
7206 
7207 	if (iter) {
7208 		iter->index = 0;
7209 		if (iter->funcs->rewind) {
7210 			iter->funcs->rewind(iter TSRMLS_CC);
7211 			if (UNEXPECTED(EG(exception) != NULL)) {
7212 				zval_ptr_dtor(&array_ptr);
7213 
7214 				HANDLE_EXCEPTION();
7215 			}
7216 		}
7217 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
7218 		if (UNEXPECTED(EG(exception) != NULL)) {
7219 			zval_ptr_dtor(&array_ptr);
7220 
7221 			HANDLE_EXCEPTION();
7222 		}
7223 		iter->index = -1; /* will be set to 0 before using next handler */
7224 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
7225 		zend_hash_internal_pointer_reset(fe_ht);
7226 		if (ce) {
7227 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
7228 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
7229 				char *str_key;
7230 				uint str_key_len;
7231 				ulong int_key;
7232 				zend_uchar key_type;
7233 
7234 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
7235 				if (key_type != HASH_KEY_NON_EXISTANT &&
7236 					(key_type == HASH_KEY_IS_LONG ||
7237 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
7238 					break;
7239 				}
7240 				zend_hash_move_forward(fe_ht);
7241 			}
7242 		}
7243 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
7244 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
7245 	} else {
7246 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
7247 		is_empty = 1;
7248 	}
7249 
7250 	if (is_empty) {
7251 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
7252 	} else {
7253 		CHECK_EXCEPTION();
7254 		ZEND_VM_NEXT_OPCODE();
7255 	}
7256 }
7257 
ZEND_EXIT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7258 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7259 {
7260 #if 0 || (IS_TMP_VAR != IS_UNUSED)
7261 	USE_OPLINE
7262 
7263 	SAVE_OPLINE();
7264 	if (IS_TMP_VAR != IS_UNUSED) {
7265 		zend_free_op free_op1;
7266 		zval *ptr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7267 
7268 		if (Z_TYPE_P(ptr) == IS_LONG) {
7269 			EG(exit_status) = Z_LVAL_P(ptr);
7270 		} else {
7271 			zend_print_variable(ptr);
7272 		}
7273 		zval_dtor(free_op1.var);
7274 	}
7275 #endif
7276 	zend_bailout();
7277 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
7278 }
7279 
ZEND_END_SILENCE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7280 static int ZEND_FASTCALL  ZEND_END_SILENCE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7281 {
7282 	USE_OPLINE
7283 	zval restored_error_reporting;
7284 
7285 	SAVE_OPLINE();
7286 	if (!EG(error_reporting) && Z_LVAL(EX_T(opline->op1.var).tmp_var) != 0) {
7287 		Z_TYPE(restored_error_reporting) = IS_LONG;
7288 		Z_LVAL(restored_error_reporting) = Z_LVAL(EX_T(opline->op1.var).tmp_var);
7289 		EG(error_reporting) = Z_LVAL(restored_error_reporting);
7290 		convert_to_string(&restored_error_reporting);
7291 		if (EXPECTED(EG(error_reporting_ini_entry) != NULL)) {
7292 			if (EXPECTED(EG(error_reporting_ini_entry)->modified &&
7293 			    EG(error_reporting_ini_entry)->value != EG(error_reporting_ini_entry)->orig_value)) {
7294 				efree(EG(error_reporting_ini_entry)->value);
7295 			}
7296 			EG(error_reporting_ini_entry)->value = Z_STRVAL(restored_error_reporting);
7297 			EG(error_reporting_ini_entry)->value_length = Z_STRLEN(restored_error_reporting);
7298 		} else {
7299 			zendi_zval_dtor(restored_error_reporting);
7300 		}
7301 	}
7302 	if (EX(old_error_reporting) == &EX_T(opline->op1.var).tmp_var) {
7303 		EX(old_error_reporting) = NULL;
7304 	}
7305 	CHECK_EXCEPTION();
7306 	ZEND_VM_NEXT_OPCODE();
7307 }
7308 
ZEND_JMP_SET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7309 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7310 {
7311 	USE_OPLINE
7312 	zend_free_op free_op1;
7313 	zval *value;
7314 
7315 	SAVE_OPLINE();
7316 	value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7317 
7318 	if (i_zend_is_true(value)) {
7319 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
7320 		if (!1) {
7321 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
7322 		}
7323 
7324 #if DEBUG_ZEND>=2
7325 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7326 #endif
7327 		ZEND_VM_JMP(opline->op2.jmp_addr);
7328 	}
7329 
7330 	zval_dtor(free_op1.var);
7331 	CHECK_EXCEPTION();
7332 	ZEND_VM_NEXT_OPCODE();
7333 }
7334 
ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7335 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7336 {
7337 	USE_OPLINE
7338 	zend_free_op free_op1;
7339 	zval *value, *ret;
7340 
7341 	SAVE_OPLINE();
7342 	value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7343 
7344 	if (i_zend_is_true(value)) {
7345 		if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
7346 			Z_ADDREF_P(value);
7347 			EX_T(opline->result.var).var.ptr = value;
7348 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
7349 		} else {
7350 			ALLOC_ZVAL(ret);
7351 			INIT_PZVAL_COPY(ret, value);
7352 			EX_T(opline->result.var).var.ptr = ret;
7353 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
7354 			if (!1) {
7355 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
7356 			}
7357 		}
7358 
7359 #if DEBUG_ZEND>=2
7360 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7361 #endif
7362 		ZEND_VM_JMP(opline->op2.jmp_addr);
7363 	}
7364 
7365 	zval_dtor(free_op1.var);
7366 	CHECK_EXCEPTION();
7367 	ZEND_VM_NEXT_OPCODE();
7368 }
7369 
ZEND_QM_ASSIGN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7370 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7371 {
7372 	USE_OPLINE
7373 	zend_free_op free_op1;
7374 	zval *value;
7375 
7376 	SAVE_OPLINE();
7377 	value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7378 
7379 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
7380 	if (!1) {
7381 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
7382 	}
7383 
7384 	CHECK_EXCEPTION();
7385 	ZEND_VM_NEXT_OPCODE();
7386 }
7387 
ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7388 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7389 {
7390 	USE_OPLINE
7391 	zend_free_op free_op1;
7392 	zval *value, *ret;
7393 
7394 	SAVE_OPLINE();
7395 	value = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7396 
7397 	if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
7398 		Z_ADDREF_P(value);
7399 		EX_T(opline->result.var).var.ptr = value;
7400 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
7401 	} else {
7402 		ALLOC_ZVAL(ret);
7403 		INIT_PZVAL_COPY(ret, value);
7404 		EX_T(opline->result.var).var.ptr = ret;
7405 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
7406 		if (!1) {
7407 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
7408 		}
7409 	}
7410 
7411 	CHECK_EXCEPTION();
7412 	ZEND_VM_NEXT_OPCODE();
7413 }
7414 
ZEND_INSTANCEOF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7415 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7416 {
7417 	USE_OPLINE
7418 	zend_free_op free_op1;
7419 	zval *expr;
7420 	zend_bool result;
7421 
7422 	SAVE_OPLINE();
7423 	expr = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7424 
7425 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
7426 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
7427 	} else {
7428 		result = 0;
7429 	}
7430 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
7431 	zval_dtor(free_op1.var);
7432 	CHECK_EXCEPTION();
7433 	ZEND_VM_NEXT_OPCODE();
7434 }
7435 
ZEND_ADD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7436 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7437 {
7438 	USE_OPLINE
7439 	zend_free_op free_op1;
7440 
7441 	SAVE_OPLINE();
7442 	fast_add_function(&EX_T(opline->result.var).tmp_var,
7443 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7444 		opline->op2.zv TSRMLS_CC);
7445 	zval_dtor(free_op1.var);
7446 
7447 	CHECK_EXCEPTION();
7448 	ZEND_VM_NEXT_OPCODE();
7449 }
7450 
ZEND_SUB_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7451 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7452 {
7453 	USE_OPLINE
7454 	zend_free_op free_op1;
7455 
7456 	SAVE_OPLINE();
7457 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
7458 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7459 		opline->op2.zv TSRMLS_CC);
7460 	zval_dtor(free_op1.var);
7461 
7462 	CHECK_EXCEPTION();
7463 	ZEND_VM_NEXT_OPCODE();
7464 }
7465 
ZEND_MUL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7466 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7467 {
7468 	USE_OPLINE
7469 	zend_free_op free_op1;
7470 
7471 	SAVE_OPLINE();
7472 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
7473 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7474 		opline->op2.zv TSRMLS_CC);
7475 	zval_dtor(free_op1.var);
7476 
7477 	CHECK_EXCEPTION();
7478 	ZEND_VM_NEXT_OPCODE();
7479 }
7480 
ZEND_DIV_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7481 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7482 {
7483 	USE_OPLINE
7484 	zend_free_op free_op1;
7485 
7486 	SAVE_OPLINE();
7487 	fast_div_function(&EX_T(opline->result.var).tmp_var,
7488 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7489 		opline->op2.zv TSRMLS_CC);
7490 	zval_dtor(free_op1.var);
7491 
7492 	CHECK_EXCEPTION();
7493 	ZEND_VM_NEXT_OPCODE();
7494 }
7495 
ZEND_MOD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7496 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7497 {
7498 	USE_OPLINE
7499 	zend_free_op free_op1;
7500 
7501 	SAVE_OPLINE();
7502 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
7503 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7504 		opline->op2.zv TSRMLS_CC);
7505 	zval_dtor(free_op1.var);
7506 
7507 	CHECK_EXCEPTION();
7508 	ZEND_VM_NEXT_OPCODE();
7509 }
7510 
ZEND_SL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7511 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7512 {
7513 	USE_OPLINE
7514 	zend_free_op free_op1;
7515 
7516 	SAVE_OPLINE();
7517 	shift_left_function(&EX_T(opline->result.var).tmp_var,
7518 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7519 		opline->op2.zv TSRMLS_CC);
7520 	zval_dtor(free_op1.var);
7521 
7522 	CHECK_EXCEPTION();
7523 	ZEND_VM_NEXT_OPCODE();
7524 }
7525 
ZEND_SR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7526 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7527 {
7528 	USE_OPLINE
7529 	zend_free_op free_op1;
7530 
7531 	SAVE_OPLINE();
7532 	shift_right_function(&EX_T(opline->result.var).tmp_var,
7533 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7534 		opline->op2.zv TSRMLS_CC);
7535 	zval_dtor(free_op1.var);
7536 
7537 	CHECK_EXCEPTION();
7538 	ZEND_VM_NEXT_OPCODE();
7539 }
7540 
ZEND_CONCAT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7541 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7542 {
7543 	USE_OPLINE
7544 	zend_free_op free_op1;
7545 
7546 	SAVE_OPLINE();
7547 	concat_function(&EX_T(opline->result.var).tmp_var,
7548 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7549 		opline->op2.zv TSRMLS_CC);
7550 	zval_dtor(free_op1.var);
7551 
7552 	CHECK_EXCEPTION();
7553 	ZEND_VM_NEXT_OPCODE();
7554 }
7555 
ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7556 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7557 {
7558 	USE_OPLINE
7559 	zend_free_op free_op1;
7560 
7561 	SAVE_OPLINE();
7562 	is_identical_function(&EX_T(opline->result.var).tmp_var,
7563 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7564 		opline->op2.zv TSRMLS_CC);
7565 	zval_dtor(free_op1.var);
7566 
7567 	CHECK_EXCEPTION();
7568 	ZEND_VM_NEXT_OPCODE();
7569 }
7570 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7571 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7572 {
7573 	USE_OPLINE
7574 	zend_free_op free_op1;
7575 	zval *result = &EX_T(opline->result.var).tmp_var;
7576 
7577 	SAVE_OPLINE();
7578 	is_identical_function(result,
7579 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7580 		opline->op2.zv TSRMLS_CC);
7581 	Z_LVAL_P(result) = !Z_LVAL_P(result);
7582 	zval_dtor(free_op1.var);
7583 
7584 	CHECK_EXCEPTION();
7585 	ZEND_VM_NEXT_OPCODE();
7586 }
7587 
ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7588 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7589 {
7590 	USE_OPLINE
7591 	zend_free_op free_op1;
7592 	zval *result = &EX_T(opline->result.var).tmp_var;
7593 
7594 	SAVE_OPLINE();
7595 	ZVAL_BOOL(result, fast_equal_function(result,
7596 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7597 		opline->op2.zv TSRMLS_CC));
7598 	zval_dtor(free_op1.var);
7599 
7600 	CHECK_EXCEPTION();
7601 	ZEND_VM_NEXT_OPCODE();
7602 }
7603 
ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7604 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7605 {
7606 	USE_OPLINE
7607 	zend_free_op free_op1;
7608 	zval *result = &EX_T(opline->result.var).tmp_var;
7609 
7610 	SAVE_OPLINE();
7611 	ZVAL_BOOL(result, fast_not_equal_function(result,
7612 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7613 		opline->op2.zv TSRMLS_CC));
7614 	zval_dtor(free_op1.var);
7615 
7616 	CHECK_EXCEPTION();
7617 	ZEND_VM_NEXT_OPCODE();
7618 }
7619 
ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7620 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7621 {
7622 	USE_OPLINE
7623 	zend_free_op free_op1;
7624 	zval *result = &EX_T(opline->result.var).tmp_var;
7625 
7626 	SAVE_OPLINE();
7627 	ZVAL_BOOL(result, fast_is_smaller_function(result,
7628 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7629 		opline->op2.zv TSRMLS_CC));
7630 	zval_dtor(free_op1.var);
7631 
7632 	CHECK_EXCEPTION();
7633 	ZEND_VM_NEXT_OPCODE();
7634 }
7635 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7636 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7637 {
7638 	USE_OPLINE
7639 	zend_free_op free_op1;
7640 	zval *result = &EX_T(opline->result.var).tmp_var;
7641 
7642 	SAVE_OPLINE();
7643 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
7644 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7645 		opline->op2.zv TSRMLS_CC));
7646 	zval_dtor(free_op1.var);
7647 
7648 	CHECK_EXCEPTION();
7649 	ZEND_VM_NEXT_OPCODE();
7650 }
7651 
ZEND_BW_OR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7652 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7653 {
7654 	USE_OPLINE
7655 	zend_free_op free_op1;
7656 
7657 	SAVE_OPLINE();
7658 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
7659 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7660 		opline->op2.zv TSRMLS_CC);
7661 	zval_dtor(free_op1.var);
7662 
7663 	CHECK_EXCEPTION();
7664 	ZEND_VM_NEXT_OPCODE();
7665 }
7666 
ZEND_BW_AND_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7667 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7668 {
7669 	USE_OPLINE
7670 	zend_free_op free_op1;
7671 
7672 	SAVE_OPLINE();
7673 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
7674 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7675 		opline->op2.zv TSRMLS_CC);
7676 	zval_dtor(free_op1.var);
7677 
7678 	CHECK_EXCEPTION();
7679 	ZEND_VM_NEXT_OPCODE();
7680 }
7681 
ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7682 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7683 {
7684 	USE_OPLINE
7685 	zend_free_op free_op1;
7686 
7687 	SAVE_OPLINE();
7688 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
7689 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7690 		opline->op2.zv TSRMLS_CC);
7691 	zval_dtor(free_op1.var);
7692 
7693 	CHECK_EXCEPTION();
7694 	ZEND_VM_NEXT_OPCODE();
7695 }
7696 
ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7697 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7698 {
7699 	USE_OPLINE
7700 	zend_free_op free_op1;
7701 
7702 	SAVE_OPLINE();
7703 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
7704 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
7705 		opline->op2.zv TSRMLS_CC);
7706 	zval_dtor(free_op1.var);
7707 
7708 	CHECK_EXCEPTION();
7709 	ZEND_VM_NEXT_OPCODE();
7710 }
7711 
zend_fetch_var_address_helper_SPEC_TMP_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)7712 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
7713 {
7714 	USE_OPLINE
7715 	zend_free_op free_op1;
7716 	zval *varname;
7717 	zval **retval;
7718 	zval tmp_varname;
7719 	HashTable *target_symbol_table;
7720 	ulong hash_value;
7721 
7722 	SAVE_OPLINE();
7723 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7724 
7725  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
7726 		ZVAL_COPY_VALUE(&tmp_varname, varname);
7727 		zval_copy_ctor(&tmp_varname);
7728 		Z_SET_REFCOUNT(tmp_varname, 1);
7729 		Z_UNSET_ISREF(tmp_varname);
7730 		convert_to_string(&tmp_varname);
7731 		varname = &tmp_varname;
7732 	}
7733 
7734 	if (IS_CONST != IS_UNUSED) {
7735 		zend_class_entry *ce;
7736 
7737 		if (IS_CONST == IS_CONST) {
7738 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
7739 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
7740 			} else {
7741 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
7742 				if (UNEXPECTED(ce == NULL)) {
7743 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
7744 						zval_dtor(&tmp_varname);
7745 					}
7746 					zval_dtor(free_op1.var);
7747 					CHECK_EXCEPTION();
7748 					ZEND_VM_NEXT_OPCODE();
7749 				}
7750 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
7751 			}
7752 		} else {
7753 			ce = EX_T(opline->op2.var).class_entry;
7754 		}
7755 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
7756 		zval_dtor(free_op1.var);
7757 	} else {
7758 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
7759 /*
7760 		if (!target_symbol_table) {
7761 			CHECK_EXCEPTION();
7762 			ZEND_VM_NEXT_OPCODE();
7763 		}
7764 */
7765 		if (IS_TMP_VAR == IS_CONST) {
7766 			hash_value = Z_HASH_P(varname);
7767 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
7768 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
7769 		} else {
7770 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
7771 		}
7772 
7773 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
7774 			switch (type) {
7775 				case BP_VAR_R:
7776 				case BP_VAR_UNSET:
7777 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
7778 					/* break missing intentionally */
7779 				case BP_VAR_IS:
7780 					retval = &EG(uninitialized_zval_ptr);
7781 					break;
7782 				case BP_VAR_RW:
7783 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
7784 					/* break missing intentionally */
7785 				case BP_VAR_W:
7786 					Z_ADDREF_P(&EG(uninitialized_zval));
7787 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
7788 					break;
7789 				EMPTY_SWITCH_DEFAULT_CASE()
7790 			}
7791 		}
7792 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
7793 			case ZEND_FETCH_GLOBAL:
7794 				if (IS_TMP_VAR != IS_TMP_VAR) {
7795 					zval_dtor(free_op1.var);
7796 				}
7797 				break;
7798 			case ZEND_FETCH_LOCAL:
7799 				zval_dtor(free_op1.var);
7800 				break;
7801 			case ZEND_FETCH_STATIC:
7802 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
7803 				break;
7804 			case ZEND_FETCH_GLOBAL_LOCK:
7805 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
7806 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
7807 				}
7808 				break;
7809 		}
7810 	}
7811 
7812 
7813 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
7814 		zval_dtor(&tmp_varname);
7815 	}
7816 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
7817 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
7818 	}
7819 	PZVAL_LOCK(*retval);
7820 	switch (type) {
7821 		case BP_VAR_R:
7822 		case BP_VAR_IS:
7823 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
7824 			break;
7825 		case BP_VAR_UNSET: {
7826 			zend_free_op free_res;
7827 
7828 			PZVAL_UNLOCK(*retval, &free_res);
7829 			if (retval != &EG(uninitialized_zval_ptr)) {
7830 				SEPARATE_ZVAL_IF_NOT_REF(retval);
7831 			}
7832 			PZVAL_LOCK(*retval);
7833 			FREE_OP_VAR_PTR(free_res);
7834 		}
7835 		/* break missing intentionally */
7836 		default:
7837 			EX_T(opline->result.var).var.ptr_ptr = retval;
7838 			break;
7839 	}
7840 	CHECK_EXCEPTION();
7841 	ZEND_VM_NEXT_OPCODE();
7842 }
7843 
ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7844 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7845 {
7846 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7847 }
7848 
ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7849 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7850 {
7851 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7852 }
7853 
ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7854 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7855 {
7856 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7857 }
7858 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7859 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7860 {
7861 	USE_OPLINE
7862 
7863 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7864 }
7865 
ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7866 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7867 {
7868 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7869 }
7870 
ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7871 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7872 {
7873 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7874 }
7875 
ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7876 static int ZEND_FASTCALL  ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7877 {
7878 	USE_OPLINE
7879 	zend_free_op free_op1;
7880 	zval *container;
7881 
7882 	SAVE_OPLINE();
7883 	container = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7884 
7885 	if (UNEXPECTED(Z_TYPE_P(container) != IS_ARRAY)) {
7886 		PZVAL_LOCK(&EG(uninitialized_zval));
7887 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
7888 	} else {
7889 
7890 		zval *value = *zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
7891 
7892 		PZVAL_LOCK(value);
7893 		AI_SET_PTR(&EX_T(opline->result.var), value);
7894 
7895 	}
7896 	CHECK_EXCEPTION();
7897 	ZEND_VM_NEXT_OPCODE();
7898 }
7899 
ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7900 static int ZEND_FASTCALL  ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7901 {
7902 	USE_OPLINE
7903 	zval *str = &EX_T(opline->result.var).tmp_var;
7904 
7905 	SAVE_OPLINE();
7906 
7907 	if (IS_TMP_VAR == IS_UNUSED) {
7908 		/* Initialize for erealloc in add_char_to_string */
7909 		Z_STRVAL_P(str) = NULL;
7910 		Z_STRLEN_P(str) = 0;
7911 		Z_TYPE_P(str) = IS_STRING;
7912 
7913 		INIT_PZVAL(str);
7914 	}
7915 
7916 	add_char_to_string(str, str, opline->op2.zv);
7917 
7918 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
7919 	/*CHECK_EXCEPTION();*/
7920 	ZEND_VM_NEXT_OPCODE();
7921 }
7922 
ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7923 static int ZEND_FASTCALL  ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7924 {
7925 	USE_OPLINE
7926 	zval *str = &EX_T(opline->result.var).tmp_var;
7927 
7928 	SAVE_OPLINE();
7929 
7930 	if (IS_TMP_VAR == IS_UNUSED) {
7931 		/* Initialize for erealloc in add_string_to_string */
7932 		Z_STRVAL_P(str) = NULL;
7933 		Z_STRLEN_P(str) = 0;
7934 		Z_TYPE_P(str) = IS_STRING;
7935 
7936 		INIT_PZVAL(str);
7937 	}
7938 
7939 	add_string_to_string(str, str, opline->op2.zv);
7940 
7941 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
7942 	/*CHECK_EXCEPTION();*/
7943 	ZEND_VM_NEXT_OPCODE();
7944 }
7945 
ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7946 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7947 {
7948 	USE_OPLINE
7949 	zval *function_name;
7950 	char *function_name_strval;
7951 	int function_name_strlen;
7952 	zend_free_op free_op1;
7953 
7954 	SAVE_OPLINE();
7955 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
7956 
7957 	function_name = opline->op2.zv;
7958 
7959 	if (IS_CONST != IS_CONST &&
7960 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
7961 		zend_error_noreturn(E_ERROR, "Method name must be a string");
7962 	}
7963 
7964 	function_name_strval = Z_STRVAL_P(function_name);
7965 	function_name_strlen = Z_STRLEN_P(function_name);
7966 
7967 	EX(object) = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
7968 
7969 	if (EXPECTED(EX(object) != NULL) &&
7970 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
7971 		EX(called_scope) = Z_OBJCE_P(EX(object));
7972 
7973 		if (IS_CONST != IS_CONST ||
7974 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
7975 		    zval *object = EX(object);
7976 
7977 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
7978 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
7979 			}
7980 
7981 			/* First, locate the function. */
7982 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
7983 			if (UNEXPECTED(EX(fbc) == NULL)) {
7984 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
7985 			}
7986 			if (IS_CONST == IS_CONST &&
7987 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
7988 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
7989 			    EXPECTED(EX(object) == object)) {
7990 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
7991 			}
7992 		}
7993 	} else {
7994 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
7995 	}
7996 
7997 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
7998 		EX(object) = NULL;
7999 	} else {
8000 		if (!PZVAL_IS_REF(EX(object))) {
8001 			Z_ADDREF_P(EX(object)); /* For $this pointer */
8002 		} else {
8003 			zval *this_ptr;
8004 			ALLOC_ZVAL(this_ptr);
8005 			INIT_PZVAL_COPY(this_ptr, EX(object));
8006 			zval_copy_ctor(this_ptr);
8007 			EX(object) = this_ptr;
8008 		}
8009 	}
8010 
8011 
8012 	CHECK_EXCEPTION();
8013 	ZEND_VM_NEXT_OPCODE();
8014 }
8015 
ZEND_CASE_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8016 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8017 {
8018 	USE_OPLINE
8019 	zend_free_op free_op1;
8020 
8021 	SAVE_OPLINE();
8022 	if (IS_TMP_VAR==IS_VAR) {
8023 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
8024 	}
8025 	is_equal_function(&EX_T(opline->result.var).tmp_var,
8026 				 _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8027 				 opline->op2.zv TSRMLS_CC);
8028 
8029 	CHECK_EXCEPTION();
8030 	ZEND_VM_NEXT_OPCODE();
8031 }
8032 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8033 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8034 {
8035 	USE_OPLINE
8036 	zend_free_op free_op1;
8037 	zval *expr_ptr;
8038 
8039 	SAVE_OPLINE();
8040 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
8041 		zval **expr_ptr_ptr = NULL;
8042 
8043 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
8044 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
8045 		}
8046 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
8047 		expr_ptr = *expr_ptr_ptr;
8048 		Z_ADDREF_P(expr_ptr);
8049 	} else {
8050 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
8051 		if (1) { /* temporary variable */
8052 			zval *new_expr;
8053 
8054 			ALLOC_ZVAL(new_expr);
8055 			INIT_PZVAL_COPY(new_expr, expr_ptr);
8056 			expr_ptr = new_expr;
8057 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
8058 			zval *new_expr;
8059 
8060 			ALLOC_ZVAL(new_expr);
8061 			INIT_PZVAL_COPY(new_expr, expr_ptr);
8062 			expr_ptr = new_expr;
8063 			zendi_zval_copy_ctor(*expr_ptr);
8064 		} else {
8065 			Z_ADDREF_P(expr_ptr);
8066 		}
8067 	}
8068 
8069 	if (IS_CONST != IS_UNUSED) {
8070 
8071 		zval *offset = opline->op2.zv;
8072 		ulong hval;
8073 
8074 		switch (Z_TYPE_P(offset)) {
8075 			case IS_DOUBLE:
8076 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
8077 				goto num_index;
8078 			case IS_LONG:
8079 			case IS_BOOL:
8080 				hval = Z_LVAL_P(offset);
8081 num_index:
8082 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
8083 				break;
8084 			case IS_STRING:
8085 				if (IS_CONST == IS_CONST) {
8086 					hval = Z_HASH_P(offset);
8087 				} else {
8088 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
8089 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
8090 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
8091 					} else {
8092 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
8093 					}
8094 				}
8095 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
8096 				break;
8097 			case IS_NULL:
8098 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
8099 				break;
8100 			default:
8101 				zend_error(E_WARNING, "Illegal offset type");
8102 				zval_ptr_dtor(&expr_ptr);
8103 				/* do nothing */
8104 				break;
8105 		}
8106 
8107 	} else {
8108 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
8109 	}
8110 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
8111 
8112 	} else {
8113 
8114 	}
8115 	CHECK_EXCEPTION();
8116 	ZEND_VM_NEXT_OPCODE();
8117 }
8118 
ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8119 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8120 {
8121 	USE_OPLINE
8122 
8123 	array_init(&EX_T(opline->result.var).tmp_var);
8124 	if (IS_TMP_VAR == IS_UNUSED) {
8125 		ZEND_VM_NEXT_OPCODE();
8126 #if 0 || IS_TMP_VAR != IS_UNUSED
8127 	} else {
8128 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8129 #endif
8130 	}
8131 }
8132 
ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8133 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8134 {
8135 	USE_OPLINE
8136 	zval tmp, *varname;
8137 	HashTable *target_symbol_table;
8138 	zend_free_op free_op1;
8139 
8140 	SAVE_OPLINE();
8141 	if (IS_TMP_VAR == IS_CV &&
8142 	    IS_CONST == IS_UNUSED &&
8143 	    (opline->extended_value & ZEND_QUICK_SET)) {
8144 		if (EG(active_symbol_table)) {
8145 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
8146 
8147 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
8148 			EX_CV(opline->op1.var) = NULL;
8149 		} else if (EX_CV(opline->op1.var)) {
8150 			zval_ptr_dtor(EX_CV(opline->op1.var));
8151 			EX_CV(opline->op1.var) = NULL;
8152 		}
8153 		CHECK_EXCEPTION();
8154 		ZEND_VM_NEXT_OPCODE();
8155 	}
8156 
8157 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
8158 
8159 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
8160 		ZVAL_COPY_VALUE(&tmp, varname);
8161 		zval_copy_ctor(&tmp);
8162 		convert_to_string(&tmp);
8163 		varname = &tmp;
8164 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
8165 		Z_ADDREF_P(varname);
8166 	}
8167 
8168 	if (IS_CONST != IS_UNUSED) {
8169 		zend_class_entry *ce;
8170 
8171 		if (IS_CONST == IS_CONST) {
8172 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
8173 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
8174 			} else {
8175 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
8176 				if (UNEXPECTED(EG(exception) != NULL)) {
8177 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
8178 						zval_dtor(&tmp);
8179 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
8180 						zval_ptr_dtor(&varname);
8181 					}
8182 					zval_dtor(free_op1.var);
8183 					HANDLE_EXCEPTION();
8184 				}
8185 				if (UNEXPECTED(ce == NULL)) {
8186 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
8187 				}
8188 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
8189 			}
8190 		} else {
8191 			ce = EX_T(opline->op2.var).class_entry;
8192 		}
8193 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
8194 	} else {
8195 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
8196 
8197 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
8198 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
8199 	}
8200 
8201 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
8202 		zval_dtor(&tmp);
8203 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
8204 		zval_ptr_dtor(&varname);
8205 	}
8206 	zval_dtor(free_op1.var);
8207 	CHECK_EXCEPTION();
8208 	ZEND_VM_NEXT_OPCODE();
8209 }
8210 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8211 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8212 {
8213 	USE_OPLINE
8214 	zval **value;
8215 	zend_bool isset = 1;
8216 
8217 	SAVE_OPLINE();
8218 	if (IS_TMP_VAR == IS_CV &&
8219 	    IS_CONST == IS_UNUSED &&
8220 	    (opline->extended_value & ZEND_QUICK_SET)) {
8221 		if (EX_CV(opline->op1.var)) {
8222 			value = EX_CV(opline->op1.var);
8223 		} else if (EG(active_symbol_table)) {
8224 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
8225 
8226 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
8227 				isset = 0;
8228 			}
8229 		} else {
8230 			isset = 0;
8231 		}
8232 	} else {
8233 		HashTable *target_symbol_table;
8234 		zend_free_op free_op1;
8235 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
8236 
8237 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
8238 			ZVAL_COPY_VALUE(&tmp, varname);
8239 			zval_copy_ctor(&tmp);
8240 			convert_to_string(&tmp);
8241 			varname = &tmp;
8242 		}
8243 
8244 		if (IS_CONST != IS_UNUSED) {
8245 			zend_class_entry *ce;
8246 
8247 			if (IS_CONST == IS_CONST) {
8248 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
8249 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
8250 				} else {
8251 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
8252 					if (UNEXPECTED(ce == NULL)) {
8253 						CHECK_EXCEPTION();
8254 						ZEND_VM_NEXT_OPCODE();
8255 					}
8256 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
8257 				}
8258 			} else {
8259 				ce = EX_T(opline->op2.var).class_entry;
8260 			}
8261 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
8262 			if (!value) {
8263 				isset = 0;
8264 			}
8265 		} else {
8266 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
8267 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
8268 				isset = 0;
8269 			}
8270 		}
8271 
8272 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
8273 			zval_dtor(&tmp);
8274 		}
8275 		zval_dtor(free_op1.var);
8276 	}
8277 
8278 	if (opline->extended_value & ZEND_ISSET) {
8279 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
8280 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
8281 		} else {
8282 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
8283 		}
8284 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
8285 		if (!isset || !i_zend_is_true(*value)) {
8286 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
8287 		} else {
8288 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
8289 		}
8290 	}
8291 
8292 	CHECK_EXCEPTION();
8293 	ZEND_VM_NEXT_OPCODE();
8294 }
8295 
ZEND_ADD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8296 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8297 {
8298 	USE_OPLINE
8299 	zend_free_op free_op1, free_op2;
8300 
8301 	SAVE_OPLINE();
8302 	fast_add_function(&EX_T(opline->result.var).tmp_var,
8303 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8304 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8305 	zval_dtor(free_op1.var);
8306 	zval_dtor(free_op2.var);
8307 	CHECK_EXCEPTION();
8308 	ZEND_VM_NEXT_OPCODE();
8309 }
8310 
ZEND_SUB_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8311 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8312 {
8313 	USE_OPLINE
8314 	zend_free_op free_op1, free_op2;
8315 
8316 	SAVE_OPLINE();
8317 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
8318 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8319 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8320 	zval_dtor(free_op1.var);
8321 	zval_dtor(free_op2.var);
8322 	CHECK_EXCEPTION();
8323 	ZEND_VM_NEXT_OPCODE();
8324 }
8325 
ZEND_MUL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8326 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8327 {
8328 	USE_OPLINE
8329 	zend_free_op free_op1, free_op2;
8330 
8331 	SAVE_OPLINE();
8332 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
8333 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8334 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8335 	zval_dtor(free_op1.var);
8336 	zval_dtor(free_op2.var);
8337 	CHECK_EXCEPTION();
8338 	ZEND_VM_NEXT_OPCODE();
8339 }
8340 
ZEND_DIV_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8341 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8342 {
8343 	USE_OPLINE
8344 	zend_free_op free_op1, free_op2;
8345 
8346 	SAVE_OPLINE();
8347 	fast_div_function(&EX_T(opline->result.var).tmp_var,
8348 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8349 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8350 	zval_dtor(free_op1.var);
8351 	zval_dtor(free_op2.var);
8352 	CHECK_EXCEPTION();
8353 	ZEND_VM_NEXT_OPCODE();
8354 }
8355 
ZEND_MOD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8356 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8357 {
8358 	USE_OPLINE
8359 	zend_free_op free_op1, free_op2;
8360 
8361 	SAVE_OPLINE();
8362 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
8363 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8364 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8365 	zval_dtor(free_op1.var);
8366 	zval_dtor(free_op2.var);
8367 	CHECK_EXCEPTION();
8368 	ZEND_VM_NEXT_OPCODE();
8369 }
8370 
ZEND_SL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8371 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8372 {
8373 	USE_OPLINE
8374 	zend_free_op free_op1, free_op2;
8375 
8376 	SAVE_OPLINE();
8377 	shift_left_function(&EX_T(opline->result.var).tmp_var,
8378 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8379 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8380 	zval_dtor(free_op1.var);
8381 	zval_dtor(free_op2.var);
8382 	CHECK_EXCEPTION();
8383 	ZEND_VM_NEXT_OPCODE();
8384 }
8385 
ZEND_SR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8386 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8387 {
8388 	USE_OPLINE
8389 	zend_free_op free_op1, free_op2;
8390 
8391 	SAVE_OPLINE();
8392 	shift_right_function(&EX_T(opline->result.var).tmp_var,
8393 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8394 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8395 	zval_dtor(free_op1.var);
8396 	zval_dtor(free_op2.var);
8397 	CHECK_EXCEPTION();
8398 	ZEND_VM_NEXT_OPCODE();
8399 }
8400 
ZEND_CONCAT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8401 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8402 {
8403 	USE_OPLINE
8404 	zend_free_op free_op1, free_op2;
8405 
8406 	SAVE_OPLINE();
8407 	concat_function(&EX_T(opline->result.var).tmp_var,
8408 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8409 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8410 	zval_dtor(free_op1.var);
8411 	zval_dtor(free_op2.var);
8412 	CHECK_EXCEPTION();
8413 	ZEND_VM_NEXT_OPCODE();
8414 }
8415 
ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8416 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8417 {
8418 	USE_OPLINE
8419 	zend_free_op free_op1, free_op2;
8420 
8421 	SAVE_OPLINE();
8422 	is_identical_function(&EX_T(opline->result.var).tmp_var,
8423 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8424 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8425 	zval_dtor(free_op1.var);
8426 	zval_dtor(free_op2.var);
8427 	CHECK_EXCEPTION();
8428 	ZEND_VM_NEXT_OPCODE();
8429 }
8430 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8431 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8432 {
8433 	USE_OPLINE
8434 	zend_free_op free_op1, free_op2;
8435 	zval *result = &EX_T(opline->result.var).tmp_var;
8436 
8437 	SAVE_OPLINE();
8438 	is_identical_function(result,
8439 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8440 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8441 	Z_LVAL_P(result) = !Z_LVAL_P(result);
8442 	zval_dtor(free_op1.var);
8443 	zval_dtor(free_op2.var);
8444 	CHECK_EXCEPTION();
8445 	ZEND_VM_NEXT_OPCODE();
8446 }
8447 
ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8448 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8449 {
8450 	USE_OPLINE
8451 	zend_free_op free_op1, free_op2;
8452 	zval *result = &EX_T(opline->result.var).tmp_var;
8453 
8454 	SAVE_OPLINE();
8455 	ZVAL_BOOL(result, fast_equal_function(result,
8456 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8457 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8458 	zval_dtor(free_op1.var);
8459 	zval_dtor(free_op2.var);
8460 	CHECK_EXCEPTION();
8461 	ZEND_VM_NEXT_OPCODE();
8462 }
8463 
ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8464 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8465 {
8466 	USE_OPLINE
8467 	zend_free_op free_op1, free_op2;
8468 	zval *result = &EX_T(opline->result.var).tmp_var;
8469 
8470 	SAVE_OPLINE();
8471 	ZVAL_BOOL(result, fast_not_equal_function(result,
8472 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8473 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8474 	zval_dtor(free_op1.var);
8475 	zval_dtor(free_op2.var);
8476 	CHECK_EXCEPTION();
8477 	ZEND_VM_NEXT_OPCODE();
8478 }
8479 
ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8480 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8481 {
8482 	USE_OPLINE
8483 	zend_free_op free_op1, free_op2;
8484 	zval *result = &EX_T(opline->result.var).tmp_var;
8485 
8486 	SAVE_OPLINE();
8487 	ZVAL_BOOL(result, fast_is_smaller_function(result,
8488 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8489 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8490 	zval_dtor(free_op1.var);
8491 	zval_dtor(free_op2.var);
8492 	CHECK_EXCEPTION();
8493 	ZEND_VM_NEXT_OPCODE();
8494 }
8495 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8496 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8497 {
8498 	USE_OPLINE
8499 	zend_free_op free_op1, free_op2;
8500 	zval *result = &EX_T(opline->result.var).tmp_var;
8501 
8502 	SAVE_OPLINE();
8503 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
8504 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8505 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8506 	zval_dtor(free_op1.var);
8507 	zval_dtor(free_op2.var);
8508 	CHECK_EXCEPTION();
8509 	ZEND_VM_NEXT_OPCODE();
8510 }
8511 
ZEND_BW_OR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8512 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8513 {
8514 	USE_OPLINE
8515 	zend_free_op free_op1, free_op2;
8516 
8517 	SAVE_OPLINE();
8518 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
8519 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8520 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8521 	zval_dtor(free_op1.var);
8522 	zval_dtor(free_op2.var);
8523 	CHECK_EXCEPTION();
8524 	ZEND_VM_NEXT_OPCODE();
8525 }
8526 
ZEND_BW_AND_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8527 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8528 {
8529 	USE_OPLINE
8530 	zend_free_op free_op1, free_op2;
8531 
8532 	SAVE_OPLINE();
8533 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
8534 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8535 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8536 	zval_dtor(free_op1.var);
8537 	zval_dtor(free_op2.var);
8538 	CHECK_EXCEPTION();
8539 	ZEND_VM_NEXT_OPCODE();
8540 }
8541 
ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8542 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8543 {
8544 	USE_OPLINE
8545 	zend_free_op free_op1, free_op2;
8546 
8547 	SAVE_OPLINE();
8548 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
8549 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8550 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8551 	zval_dtor(free_op1.var);
8552 	zval_dtor(free_op2.var);
8553 	CHECK_EXCEPTION();
8554 	ZEND_VM_NEXT_OPCODE();
8555 }
8556 
ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8557 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8558 {
8559 	USE_OPLINE
8560 	zend_free_op free_op1, free_op2;
8561 
8562 	SAVE_OPLINE();
8563 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
8564 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8565 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8566 	zval_dtor(free_op1.var);
8567 	zval_dtor(free_op2.var);
8568 	CHECK_EXCEPTION();
8569 	ZEND_VM_NEXT_OPCODE();
8570 }
8571 
ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8572 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8573 {
8574 	USE_OPLINE
8575 	zend_free_op free_op2;
8576 	zval *str = &EX_T(opline->result.var).tmp_var;
8577 	zval *var;
8578 	zval var_copy;
8579 	int use_copy = 0;
8580 
8581 	SAVE_OPLINE();
8582 	var = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
8583 
8584 	if (IS_TMP_VAR == IS_UNUSED) {
8585 		/* Initialize for erealloc in add_string_to_string */
8586 		Z_STRVAL_P(str) = NULL;
8587 		Z_STRLEN_P(str) = 0;
8588 		Z_TYPE_P(str) = IS_STRING;
8589 
8590 		INIT_PZVAL(str);
8591 	}
8592 
8593 	if (Z_TYPE_P(var) != IS_STRING) {
8594 		zend_make_printable_zval(var, &var_copy, &use_copy);
8595 
8596 		if (use_copy) {
8597 			var = &var_copy;
8598 		}
8599 	}
8600 	add_string_to_string(str, str, var);
8601 
8602 	if (use_copy) {
8603 		zval_dtor(var);
8604 	}
8605 	/* original comment, possibly problematic:
8606 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
8607 	 * (Zeev):  I don't think it's problematic, we only use variables
8608 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
8609 	 * string offsets or overloaded objects
8610 	 */
8611 	zval_dtor(free_op2.var);
8612 
8613 	CHECK_EXCEPTION();
8614 	ZEND_VM_NEXT_OPCODE();
8615 }
8616 
ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8617 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8618 {
8619 	USE_OPLINE
8620 	zval *function_name;
8621 	char *function_name_strval;
8622 	int function_name_strlen;
8623 	zend_free_op free_op1, free_op2;
8624 
8625 	SAVE_OPLINE();
8626 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
8627 
8628 	function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
8629 
8630 	if (IS_TMP_VAR != IS_CONST &&
8631 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
8632 		zend_error_noreturn(E_ERROR, "Method name must be a string");
8633 	}
8634 
8635 	function_name_strval = Z_STRVAL_P(function_name);
8636 	function_name_strlen = Z_STRLEN_P(function_name);
8637 
8638 	EX(object) = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
8639 
8640 	if (EXPECTED(EX(object) != NULL) &&
8641 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
8642 		EX(called_scope) = Z_OBJCE_P(EX(object));
8643 
8644 		if (IS_TMP_VAR != IS_CONST ||
8645 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
8646 		    zval *object = EX(object);
8647 
8648 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
8649 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
8650 			}
8651 
8652 			/* First, locate the function. */
8653 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
8654 			if (UNEXPECTED(EX(fbc) == NULL)) {
8655 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
8656 			}
8657 			if (IS_TMP_VAR == IS_CONST &&
8658 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
8659 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
8660 			    EXPECTED(EX(object) == object)) {
8661 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
8662 			}
8663 		}
8664 	} else {
8665 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
8666 	}
8667 
8668 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
8669 		EX(object) = NULL;
8670 	} else {
8671 		if (!PZVAL_IS_REF(EX(object))) {
8672 			Z_ADDREF_P(EX(object)); /* For $this pointer */
8673 		} else {
8674 			zval *this_ptr;
8675 			ALLOC_ZVAL(this_ptr);
8676 			INIT_PZVAL_COPY(this_ptr, EX(object));
8677 			zval_copy_ctor(this_ptr);
8678 			EX(object) = this_ptr;
8679 		}
8680 	}
8681 
8682 	zval_dtor(free_op2.var);
8683 
8684 	CHECK_EXCEPTION();
8685 	ZEND_VM_NEXT_OPCODE();
8686 }
8687 
ZEND_CASE_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8688 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8689 {
8690 	USE_OPLINE
8691 	zend_free_op free_op1, free_op2;
8692 
8693 	SAVE_OPLINE();
8694 	if (IS_TMP_VAR==IS_VAR) {
8695 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
8696 	}
8697 	is_equal_function(&EX_T(opline->result.var).tmp_var,
8698 				 _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8699 				 _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8700 
8701 	zval_dtor(free_op2.var);
8702 	CHECK_EXCEPTION();
8703 	ZEND_VM_NEXT_OPCODE();
8704 }
8705 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8706 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8707 {
8708 	USE_OPLINE
8709 	zend_free_op free_op1;
8710 	zval *expr_ptr;
8711 
8712 	SAVE_OPLINE();
8713 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
8714 		zval **expr_ptr_ptr = NULL;
8715 
8716 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
8717 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
8718 		}
8719 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
8720 		expr_ptr = *expr_ptr_ptr;
8721 		Z_ADDREF_P(expr_ptr);
8722 	} else {
8723 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
8724 		if (1) { /* temporary variable */
8725 			zval *new_expr;
8726 
8727 			ALLOC_ZVAL(new_expr);
8728 			INIT_PZVAL_COPY(new_expr, expr_ptr);
8729 			expr_ptr = new_expr;
8730 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
8731 			zval *new_expr;
8732 
8733 			ALLOC_ZVAL(new_expr);
8734 			INIT_PZVAL_COPY(new_expr, expr_ptr);
8735 			expr_ptr = new_expr;
8736 			zendi_zval_copy_ctor(*expr_ptr);
8737 		} else {
8738 			Z_ADDREF_P(expr_ptr);
8739 		}
8740 	}
8741 
8742 	if (IS_TMP_VAR != IS_UNUSED) {
8743 		zend_free_op free_op2;
8744 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
8745 		ulong hval;
8746 
8747 		switch (Z_TYPE_P(offset)) {
8748 			case IS_DOUBLE:
8749 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
8750 				goto num_index;
8751 			case IS_LONG:
8752 			case IS_BOOL:
8753 				hval = Z_LVAL_P(offset);
8754 num_index:
8755 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
8756 				break;
8757 			case IS_STRING:
8758 				if (IS_TMP_VAR == IS_CONST) {
8759 					hval = Z_HASH_P(offset);
8760 				} else {
8761 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
8762 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
8763 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
8764 					} else {
8765 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
8766 					}
8767 				}
8768 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
8769 				break;
8770 			case IS_NULL:
8771 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
8772 				break;
8773 			default:
8774 				zend_error(E_WARNING, "Illegal offset type");
8775 				zval_ptr_dtor(&expr_ptr);
8776 				/* do nothing */
8777 				break;
8778 		}
8779 		zval_dtor(free_op2.var);
8780 	} else {
8781 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
8782 	}
8783 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
8784 
8785 	} else {
8786 
8787 	}
8788 	CHECK_EXCEPTION();
8789 	ZEND_VM_NEXT_OPCODE();
8790 }
8791 
ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8792 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8793 {
8794 	USE_OPLINE
8795 
8796 	array_init(&EX_T(opline->result.var).tmp_var);
8797 	if (IS_TMP_VAR == IS_UNUSED) {
8798 		ZEND_VM_NEXT_OPCODE();
8799 #if 0 || IS_TMP_VAR != IS_UNUSED
8800 	} else {
8801 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8802 #endif
8803 	}
8804 }
8805 
ZEND_ADD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8806 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8807 {
8808 	USE_OPLINE
8809 	zend_free_op free_op1, free_op2;
8810 
8811 	SAVE_OPLINE();
8812 	fast_add_function(&EX_T(opline->result.var).tmp_var,
8813 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8814 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8815 	zval_dtor(free_op1.var);
8816 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8817 	CHECK_EXCEPTION();
8818 	ZEND_VM_NEXT_OPCODE();
8819 }
8820 
ZEND_SUB_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8821 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8822 {
8823 	USE_OPLINE
8824 	zend_free_op free_op1, free_op2;
8825 
8826 	SAVE_OPLINE();
8827 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
8828 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8829 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8830 	zval_dtor(free_op1.var);
8831 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8832 	CHECK_EXCEPTION();
8833 	ZEND_VM_NEXT_OPCODE();
8834 }
8835 
ZEND_MUL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8836 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8837 {
8838 	USE_OPLINE
8839 	zend_free_op free_op1, free_op2;
8840 
8841 	SAVE_OPLINE();
8842 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
8843 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8844 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8845 	zval_dtor(free_op1.var);
8846 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8847 	CHECK_EXCEPTION();
8848 	ZEND_VM_NEXT_OPCODE();
8849 }
8850 
ZEND_DIV_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8851 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8852 {
8853 	USE_OPLINE
8854 	zend_free_op free_op1, free_op2;
8855 
8856 	SAVE_OPLINE();
8857 	fast_div_function(&EX_T(opline->result.var).tmp_var,
8858 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8859 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8860 	zval_dtor(free_op1.var);
8861 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8862 	CHECK_EXCEPTION();
8863 	ZEND_VM_NEXT_OPCODE();
8864 }
8865 
ZEND_MOD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8866 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8867 {
8868 	USE_OPLINE
8869 	zend_free_op free_op1, free_op2;
8870 
8871 	SAVE_OPLINE();
8872 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
8873 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8874 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8875 	zval_dtor(free_op1.var);
8876 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8877 	CHECK_EXCEPTION();
8878 	ZEND_VM_NEXT_OPCODE();
8879 }
8880 
ZEND_SL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8881 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8882 {
8883 	USE_OPLINE
8884 	zend_free_op free_op1, free_op2;
8885 
8886 	SAVE_OPLINE();
8887 	shift_left_function(&EX_T(opline->result.var).tmp_var,
8888 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8889 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8890 	zval_dtor(free_op1.var);
8891 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8892 	CHECK_EXCEPTION();
8893 	ZEND_VM_NEXT_OPCODE();
8894 }
8895 
ZEND_SR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8896 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8897 {
8898 	USE_OPLINE
8899 	zend_free_op free_op1, free_op2;
8900 
8901 	SAVE_OPLINE();
8902 	shift_right_function(&EX_T(opline->result.var).tmp_var,
8903 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8904 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8905 	zval_dtor(free_op1.var);
8906 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8907 	CHECK_EXCEPTION();
8908 	ZEND_VM_NEXT_OPCODE();
8909 }
8910 
ZEND_CONCAT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8911 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8912 {
8913 	USE_OPLINE
8914 	zend_free_op free_op1, free_op2;
8915 
8916 	SAVE_OPLINE();
8917 	concat_function(&EX_T(opline->result.var).tmp_var,
8918 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8919 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8920 	zval_dtor(free_op1.var);
8921 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8922 	CHECK_EXCEPTION();
8923 	ZEND_VM_NEXT_OPCODE();
8924 }
8925 
ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8926 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8927 {
8928 	USE_OPLINE
8929 	zend_free_op free_op1, free_op2;
8930 
8931 	SAVE_OPLINE();
8932 	is_identical_function(&EX_T(opline->result.var).tmp_var,
8933 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8934 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8935 	zval_dtor(free_op1.var);
8936 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8937 	CHECK_EXCEPTION();
8938 	ZEND_VM_NEXT_OPCODE();
8939 }
8940 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8941 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8942 {
8943 	USE_OPLINE
8944 	zend_free_op free_op1, free_op2;
8945 	zval *result = &EX_T(opline->result.var).tmp_var;
8946 
8947 	SAVE_OPLINE();
8948 	is_identical_function(result,
8949 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8950 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
8951 	Z_LVAL_P(result) = !Z_LVAL_P(result);
8952 	zval_dtor(free_op1.var);
8953 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8954 	CHECK_EXCEPTION();
8955 	ZEND_VM_NEXT_OPCODE();
8956 }
8957 
ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8958 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8959 {
8960 	USE_OPLINE
8961 	zend_free_op free_op1, free_op2;
8962 	zval *result = &EX_T(opline->result.var).tmp_var;
8963 
8964 	SAVE_OPLINE();
8965 	ZVAL_BOOL(result, fast_equal_function(result,
8966 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8967 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8968 	zval_dtor(free_op1.var);
8969 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8970 	CHECK_EXCEPTION();
8971 	ZEND_VM_NEXT_OPCODE();
8972 }
8973 
ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8974 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8975 {
8976 	USE_OPLINE
8977 	zend_free_op free_op1, free_op2;
8978 	zval *result = &EX_T(opline->result.var).tmp_var;
8979 
8980 	SAVE_OPLINE();
8981 	ZVAL_BOOL(result, fast_not_equal_function(result,
8982 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8983 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
8984 	zval_dtor(free_op1.var);
8985 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
8986 	CHECK_EXCEPTION();
8987 	ZEND_VM_NEXT_OPCODE();
8988 }
8989 
ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8990 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8991 {
8992 	USE_OPLINE
8993 	zend_free_op free_op1, free_op2;
8994 	zval *result = &EX_T(opline->result.var).tmp_var;
8995 
8996 	SAVE_OPLINE();
8997 	ZVAL_BOOL(result, fast_is_smaller_function(result,
8998 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
8999 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
9000 	zval_dtor(free_op1.var);
9001 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9002 	CHECK_EXCEPTION();
9003 	ZEND_VM_NEXT_OPCODE();
9004 }
9005 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9006 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9007 {
9008 	USE_OPLINE
9009 	zend_free_op free_op1, free_op2;
9010 	zval *result = &EX_T(opline->result.var).tmp_var;
9011 
9012 	SAVE_OPLINE();
9013 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
9014 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9015 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
9016 	zval_dtor(free_op1.var);
9017 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9018 	CHECK_EXCEPTION();
9019 	ZEND_VM_NEXT_OPCODE();
9020 }
9021 
ZEND_BW_OR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9022 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9023 {
9024 	USE_OPLINE
9025 	zend_free_op free_op1, free_op2;
9026 
9027 	SAVE_OPLINE();
9028 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
9029 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9030 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
9031 	zval_dtor(free_op1.var);
9032 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9033 	CHECK_EXCEPTION();
9034 	ZEND_VM_NEXT_OPCODE();
9035 }
9036 
ZEND_BW_AND_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9037 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9038 {
9039 	USE_OPLINE
9040 	zend_free_op free_op1, free_op2;
9041 
9042 	SAVE_OPLINE();
9043 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
9044 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9045 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
9046 	zval_dtor(free_op1.var);
9047 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9048 	CHECK_EXCEPTION();
9049 	ZEND_VM_NEXT_OPCODE();
9050 }
9051 
ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9052 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9053 {
9054 	USE_OPLINE
9055 	zend_free_op free_op1, free_op2;
9056 
9057 	SAVE_OPLINE();
9058 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
9059 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9060 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
9061 	zval_dtor(free_op1.var);
9062 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9063 	CHECK_EXCEPTION();
9064 	ZEND_VM_NEXT_OPCODE();
9065 }
9066 
ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9067 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9068 {
9069 	USE_OPLINE
9070 	zend_free_op free_op1, free_op2;
9071 
9072 	SAVE_OPLINE();
9073 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
9074 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9075 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
9076 	zval_dtor(free_op1.var);
9077 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9078 	CHECK_EXCEPTION();
9079 	ZEND_VM_NEXT_OPCODE();
9080 }
9081 
zend_fetch_var_address_helper_SPEC_TMP_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)9082 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
9083 {
9084 	USE_OPLINE
9085 	zend_free_op free_op1;
9086 	zval *varname;
9087 	zval **retval;
9088 	zval tmp_varname;
9089 	HashTable *target_symbol_table;
9090 	ulong hash_value;
9091 
9092 	SAVE_OPLINE();
9093 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9094 
9095  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
9096 		ZVAL_COPY_VALUE(&tmp_varname, varname);
9097 		zval_copy_ctor(&tmp_varname);
9098 		Z_SET_REFCOUNT(tmp_varname, 1);
9099 		Z_UNSET_ISREF(tmp_varname);
9100 		convert_to_string(&tmp_varname);
9101 		varname = &tmp_varname;
9102 	}
9103 
9104 	if (IS_VAR != IS_UNUSED) {
9105 		zend_class_entry *ce;
9106 
9107 		if (IS_VAR == IS_CONST) {
9108 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9109 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
9110 			} else {
9111 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9112 				if (UNEXPECTED(ce == NULL)) {
9113 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
9114 						zval_dtor(&tmp_varname);
9115 					}
9116 					zval_dtor(free_op1.var);
9117 					CHECK_EXCEPTION();
9118 					ZEND_VM_NEXT_OPCODE();
9119 				}
9120 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
9121 			}
9122 		} else {
9123 			ce = EX_T(opline->op2.var).class_entry;
9124 		}
9125 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9126 		zval_dtor(free_op1.var);
9127 	} else {
9128 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9129 /*
9130 		if (!target_symbol_table) {
9131 			CHECK_EXCEPTION();
9132 			ZEND_VM_NEXT_OPCODE();
9133 		}
9134 */
9135 		if (IS_TMP_VAR == IS_CONST) {
9136 			hash_value = Z_HASH_P(varname);
9137 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
9138 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
9139 		} else {
9140 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
9141 		}
9142 
9143 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
9144 			switch (type) {
9145 				case BP_VAR_R:
9146 				case BP_VAR_UNSET:
9147 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
9148 					/* break missing intentionally */
9149 				case BP_VAR_IS:
9150 					retval = &EG(uninitialized_zval_ptr);
9151 					break;
9152 				case BP_VAR_RW:
9153 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
9154 					/* break missing intentionally */
9155 				case BP_VAR_W:
9156 					Z_ADDREF_P(&EG(uninitialized_zval));
9157 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
9158 					break;
9159 				EMPTY_SWITCH_DEFAULT_CASE()
9160 			}
9161 		}
9162 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
9163 			case ZEND_FETCH_GLOBAL:
9164 				if (IS_TMP_VAR != IS_TMP_VAR) {
9165 					zval_dtor(free_op1.var);
9166 				}
9167 				break;
9168 			case ZEND_FETCH_LOCAL:
9169 				zval_dtor(free_op1.var);
9170 				break;
9171 			case ZEND_FETCH_STATIC:
9172 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
9173 				break;
9174 			case ZEND_FETCH_GLOBAL_LOCK:
9175 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
9176 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
9177 				}
9178 				break;
9179 		}
9180 	}
9181 
9182 
9183 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
9184 		zval_dtor(&tmp_varname);
9185 	}
9186 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
9187 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
9188 	}
9189 	PZVAL_LOCK(*retval);
9190 	switch (type) {
9191 		case BP_VAR_R:
9192 		case BP_VAR_IS:
9193 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
9194 			break;
9195 		case BP_VAR_UNSET: {
9196 			zend_free_op free_res;
9197 
9198 			PZVAL_UNLOCK(*retval, &free_res);
9199 			if (retval != &EG(uninitialized_zval_ptr)) {
9200 				SEPARATE_ZVAL_IF_NOT_REF(retval);
9201 			}
9202 			PZVAL_LOCK(*retval);
9203 			FREE_OP_VAR_PTR(free_res);
9204 		}
9205 		/* break missing intentionally */
9206 		default:
9207 			EX_T(opline->result.var).var.ptr_ptr = retval;
9208 			break;
9209 	}
9210 	CHECK_EXCEPTION();
9211 	ZEND_VM_NEXT_OPCODE();
9212 }
9213 
ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9214 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9215 {
9216 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9217 }
9218 
ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9219 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9220 {
9221 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9222 }
9223 
ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9224 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9225 {
9226 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9227 }
9228 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9229 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9230 {
9231 	USE_OPLINE
9232 
9233 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9234 }
9235 
ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9236 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9237 {
9238 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9239 }
9240 
ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9241 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9242 {
9243 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9244 }
9245 
ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9246 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9247 {
9248 	USE_OPLINE
9249 	zend_free_op free_op2;
9250 	zval *str = &EX_T(opline->result.var).tmp_var;
9251 	zval *var;
9252 	zval var_copy;
9253 	int use_copy = 0;
9254 
9255 	SAVE_OPLINE();
9256 	var = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
9257 
9258 	if (IS_TMP_VAR == IS_UNUSED) {
9259 		/* Initialize for erealloc in add_string_to_string */
9260 		Z_STRVAL_P(str) = NULL;
9261 		Z_STRLEN_P(str) = 0;
9262 		Z_TYPE_P(str) = IS_STRING;
9263 
9264 		INIT_PZVAL(str);
9265 	}
9266 
9267 	if (Z_TYPE_P(var) != IS_STRING) {
9268 		zend_make_printable_zval(var, &var_copy, &use_copy);
9269 
9270 		if (use_copy) {
9271 			var = &var_copy;
9272 		}
9273 	}
9274 	add_string_to_string(str, str, var);
9275 
9276 	if (use_copy) {
9277 		zval_dtor(var);
9278 	}
9279 	/* original comment, possibly problematic:
9280 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
9281 	 * (Zeev):  I don't think it's problematic, we only use variables
9282 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
9283 	 * string offsets or overloaded objects
9284 	 */
9285 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9286 
9287 	CHECK_EXCEPTION();
9288 	ZEND_VM_NEXT_OPCODE();
9289 }
9290 
ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9291 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9292 {
9293 	USE_OPLINE
9294 	zval *function_name;
9295 	char *function_name_strval;
9296 	int function_name_strlen;
9297 	zend_free_op free_op1, free_op2;
9298 
9299 	SAVE_OPLINE();
9300 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
9301 
9302 	function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
9303 
9304 	if (IS_VAR != IS_CONST &&
9305 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
9306 		zend_error_noreturn(E_ERROR, "Method name must be a string");
9307 	}
9308 
9309 	function_name_strval = Z_STRVAL_P(function_name);
9310 	function_name_strlen = Z_STRLEN_P(function_name);
9311 
9312 	EX(object) = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9313 
9314 	if (EXPECTED(EX(object) != NULL) &&
9315 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
9316 		EX(called_scope) = Z_OBJCE_P(EX(object));
9317 
9318 		if (IS_VAR != IS_CONST ||
9319 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
9320 		    zval *object = EX(object);
9321 
9322 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
9323 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
9324 			}
9325 
9326 			/* First, locate the function. */
9327 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
9328 			if (UNEXPECTED(EX(fbc) == NULL)) {
9329 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
9330 			}
9331 			if (IS_VAR == IS_CONST &&
9332 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
9333 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
9334 			    EXPECTED(EX(object) == object)) {
9335 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
9336 			}
9337 		}
9338 	} else {
9339 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
9340 	}
9341 
9342 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
9343 		EX(object) = NULL;
9344 	} else {
9345 		if (!PZVAL_IS_REF(EX(object))) {
9346 			Z_ADDREF_P(EX(object)); /* For $this pointer */
9347 		} else {
9348 			zval *this_ptr;
9349 			ALLOC_ZVAL(this_ptr);
9350 			INIT_PZVAL_COPY(this_ptr, EX(object));
9351 			zval_copy_ctor(this_ptr);
9352 			EX(object) = this_ptr;
9353 		}
9354 	}
9355 
9356 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9357 
9358 	CHECK_EXCEPTION();
9359 	ZEND_VM_NEXT_OPCODE();
9360 }
9361 
ZEND_CASE_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9362 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9363 {
9364 	USE_OPLINE
9365 	zend_free_op free_op1, free_op2;
9366 
9367 	SAVE_OPLINE();
9368 	if (IS_TMP_VAR==IS_VAR) {
9369 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
9370 	}
9371 	is_equal_function(&EX_T(opline->result.var).tmp_var,
9372 				 _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
9373 				 _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
9374 
9375 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9376 	CHECK_EXCEPTION();
9377 	ZEND_VM_NEXT_OPCODE();
9378 }
9379 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9380 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9381 {
9382 	USE_OPLINE
9383 	zend_free_op free_op1;
9384 	zval *expr_ptr;
9385 
9386 	SAVE_OPLINE();
9387 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9388 		zval **expr_ptr_ptr = NULL;
9389 
9390 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
9391 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
9392 		}
9393 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
9394 		expr_ptr = *expr_ptr_ptr;
9395 		Z_ADDREF_P(expr_ptr);
9396 	} else {
9397 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9398 		if (1) { /* temporary variable */
9399 			zval *new_expr;
9400 
9401 			ALLOC_ZVAL(new_expr);
9402 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9403 			expr_ptr = new_expr;
9404 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
9405 			zval *new_expr;
9406 
9407 			ALLOC_ZVAL(new_expr);
9408 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9409 			expr_ptr = new_expr;
9410 			zendi_zval_copy_ctor(*expr_ptr);
9411 		} else {
9412 			Z_ADDREF_P(expr_ptr);
9413 		}
9414 	}
9415 
9416 	if (IS_VAR != IS_UNUSED) {
9417 		zend_free_op free_op2;
9418 		zval *offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
9419 		ulong hval;
9420 
9421 		switch (Z_TYPE_P(offset)) {
9422 			case IS_DOUBLE:
9423 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
9424 				goto num_index;
9425 			case IS_LONG:
9426 			case IS_BOOL:
9427 				hval = Z_LVAL_P(offset);
9428 num_index:
9429 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
9430 				break;
9431 			case IS_STRING:
9432 				if (IS_VAR == IS_CONST) {
9433 					hval = Z_HASH_P(offset);
9434 				} else {
9435 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
9436 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
9437 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
9438 					} else {
9439 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
9440 					}
9441 				}
9442 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
9443 				break;
9444 			case IS_NULL:
9445 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
9446 				break;
9447 			default:
9448 				zend_error(E_WARNING, "Illegal offset type");
9449 				zval_ptr_dtor(&expr_ptr);
9450 				/* do nothing */
9451 				break;
9452 		}
9453 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
9454 	} else {
9455 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
9456 	}
9457 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9458 
9459 	} else {
9460 
9461 	}
9462 	CHECK_EXCEPTION();
9463 	ZEND_VM_NEXT_OPCODE();
9464 }
9465 
ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9466 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9467 {
9468 	USE_OPLINE
9469 
9470 	array_init(&EX_T(opline->result.var).tmp_var);
9471 	if (IS_TMP_VAR == IS_UNUSED) {
9472 		ZEND_VM_NEXT_OPCODE();
9473 #if 0 || IS_TMP_VAR != IS_UNUSED
9474 	} else {
9475 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9476 #endif
9477 	}
9478 }
9479 
ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9480 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9481 {
9482 	USE_OPLINE
9483 	zval tmp, *varname;
9484 	HashTable *target_symbol_table;
9485 	zend_free_op free_op1;
9486 
9487 	SAVE_OPLINE();
9488 	if (IS_TMP_VAR == IS_CV &&
9489 	    IS_VAR == IS_UNUSED &&
9490 	    (opline->extended_value & ZEND_QUICK_SET)) {
9491 		if (EG(active_symbol_table)) {
9492 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9493 
9494 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
9495 			EX_CV(opline->op1.var) = NULL;
9496 		} else if (EX_CV(opline->op1.var)) {
9497 			zval_ptr_dtor(EX_CV(opline->op1.var));
9498 			EX_CV(opline->op1.var) = NULL;
9499 		}
9500 		CHECK_EXCEPTION();
9501 		ZEND_VM_NEXT_OPCODE();
9502 	}
9503 
9504 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9505 
9506 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
9507 		ZVAL_COPY_VALUE(&tmp, varname);
9508 		zval_copy_ctor(&tmp);
9509 		convert_to_string(&tmp);
9510 		varname = &tmp;
9511 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9512 		Z_ADDREF_P(varname);
9513 	}
9514 
9515 	if (IS_VAR != IS_UNUSED) {
9516 		zend_class_entry *ce;
9517 
9518 		if (IS_VAR == IS_CONST) {
9519 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9520 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
9521 			} else {
9522 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9523 				if (UNEXPECTED(EG(exception) != NULL)) {
9524 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9525 						zval_dtor(&tmp);
9526 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9527 						zval_ptr_dtor(&varname);
9528 					}
9529 					zval_dtor(free_op1.var);
9530 					HANDLE_EXCEPTION();
9531 				}
9532 				if (UNEXPECTED(ce == NULL)) {
9533 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
9534 				}
9535 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
9536 			}
9537 		} else {
9538 			ce = EX_T(opline->op2.var).class_entry;
9539 		}
9540 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9541 	} else {
9542 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
9543 
9544 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9545 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
9546 	}
9547 
9548 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9549 		zval_dtor(&tmp);
9550 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9551 		zval_ptr_dtor(&varname);
9552 	}
9553 	zval_dtor(free_op1.var);
9554 	CHECK_EXCEPTION();
9555 	ZEND_VM_NEXT_OPCODE();
9556 }
9557 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9558 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9559 {
9560 	USE_OPLINE
9561 	zval **value;
9562 	zend_bool isset = 1;
9563 
9564 	SAVE_OPLINE();
9565 	if (IS_TMP_VAR == IS_CV &&
9566 	    IS_VAR == IS_UNUSED &&
9567 	    (opline->extended_value & ZEND_QUICK_SET)) {
9568 		if (EX_CV(opline->op1.var)) {
9569 			value = EX_CV(opline->op1.var);
9570 		} else if (EG(active_symbol_table)) {
9571 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9572 
9573 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
9574 				isset = 0;
9575 			}
9576 		} else {
9577 			isset = 0;
9578 		}
9579 	} else {
9580 		HashTable *target_symbol_table;
9581 		zend_free_op free_op1;
9582 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9583 
9584 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
9585 			ZVAL_COPY_VALUE(&tmp, varname);
9586 			zval_copy_ctor(&tmp);
9587 			convert_to_string(&tmp);
9588 			varname = &tmp;
9589 		}
9590 
9591 		if (IS_VAR != IS_UNUSED) {
9592 			zend_class_entry *ce;
9593 
9594 			if (IS_VAR == IS_CONST) {
9595 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9596 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
9597 				} else {
9598 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9599 					if (UNEXPECTED(ce == NULL)) {
9600 						CHECK_EXCEPTION();
9601 						ZEND_VM_NEXT_OPCODE();
9602 					}
9603 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
9604 				}
9605 			} else {
9606 				ce = EX_T(opline->op2.var).class_entry;
9607 			}
9608 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9609 			if (!value) {
9610 				isset = 0;
9611 			}
9612 		} else {
9613 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9614 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
9615 				isset = 0;
9616 			}
9617 		}
9618 
9619 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9620 			zval_dtor(&tmp);
9621 		}
9622 		zval_dtor(free_op1.var);
9623 	}
9624 
9625 	if (opline->extended_value & ZEND_ISSET) {
9626 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
9627 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
9628 		} else {
9629 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
9630 		}
9631 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
9632 		if (!isset || !i_zend_is_true(*value)) {
9633 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
9634 		} else {
9635 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
9636 		}
9637 	}
9638 
9639 	CHECK_EXCEPTION();
9640 	ZEND_VM_NEXT_OPCODE();
9641 }
9642 
zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)9643 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
9644 {
9645 	USE_OPLINE
9646 	zend_free_op free_op1;
9647 	zval *varname;
9648 	zval **retval;
9649 	zval tmp_varname;
9650 	HashTable *target_symbol_table;
9651 	ulong hash_value;
9652 
9653 	SAVE_OPLINE();
9654 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9655 
9656  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
9657 		ZVAL_COPY_VALUE(&tmp_varname, varname);
9658 		zval_copy_ctor(&tmp_varname);
9659 		Z_SET_REFCOUNT(tmp_varname, 1);
9660 		Z_UNSET_ISREF(tmp_varname);
9661 		convert_to_string(&tmp_varname);
9662 		varname = &tmp_varname;
9663 	}
9664 
9665 	if (IS_UNUSED != IS_UNUSED) {
9666 		zend_class_entry *ce;
9667 
9668 		if (IS_UNUSED == IS_CONST) {
9669 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9670 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
9671 			} else {
9672 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9673 				if (UNEXPECTED(ce == NULL)) {
9674 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
9675 						zval_dtor(&tmp_varname);
9676 					}
9677 					zval_dtor(free_op1.var);
9678 					CHECK_EXCEPTION();
9679 					ZEND_VM_NEXT_OPCODE();
9680 				}
9681 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
9682 			}
9683 		} else {
9684 			ce = EX_T(opline->op2.var).class_entry;
9685 		}
9686 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9687 		zval_dtor(free_op1.var);
9688 	} else {
9689 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9690 /*
9691 		if (!target_symbol_table) {
9692 			CHECK_EXCEPTION();
9693 			ZEND_VM_NEXT_OPCODE();
9694 		}
9695 */
9696 		if (IS_TMP_VAR == IS_CONST) {
9697 			hash_value = Z_HASH_P(varname);
9698 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
9699 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
9700 		} else {
9701 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
9702 		}
9703 
9704 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
9705 			switch (type) {
9706 				case BP_VAR_R:
9707 				case BP_VAR_UNSET:
9708 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
9709 					/* break missing intentionally */
9710 				case BP_VAR_IS:
9711 					retval = &EG(uninitialized_zval_ptr);
9712 					break;
9713 				case BP_VAR_RW:
9714 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
9715 					/* break missing intentionally */
9716 				case BP_VAR_W:
9717 					Z_ADDREF_P(&EG(uninitialized_zval));
9718 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
9719 					break;
9720 				EMPTY_SWITCH_DEFAULT_CASE()
9721 			}
9722 		}
9723 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
9724 			case ZEND_FETCH_GLOBAL:
9725 				if (IS_TMP_VAR != IS_TMP_VAR) {
9726 					zval_dtor(free_op1.var);
9727 				}
9728 				break;
9729 			case ZEND_FETCH_LOCAL:
9730 				zval_dtor(free_op1.var);
9731 				break;
9732 			case ZEND_FETCH_STATIC:
9733 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
9734 				break;
9735 			case ZEND_FETCH_GLOBAL_LOCK:
9736 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
9737 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
9738 				}
9739 				break;
9740 		}
9741 	}
9742 
9743 
9744 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
9745 		zval_dtor(&tmp_varname);
9746 	}
9747 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
9748 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
9749 	}
9750 	PZVAL_LOCK(*retval);
9751 	switch (type) {
9752 		case BP_VAR_R:
9753 		case BP_VAR_IS:
9754 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
9755 			break;
9756 		case BP_VAR_UNSET: {
9757 			zend_free_op free_res;
9758 
9759 			PZVAL_UNLOCK(*retval, &free_res);
9760 			if (retval != &EG(uninitialized_zval_ptr)) {
9761 				SEPARATE_ZVAL_IF_NOT_REF(retval);
9762 			}
9763 			PZVAL_LOCK(*retval);
9764 			FREE_OP_VAR_PTR(free_res);
9765 		}
9766 		/* break missing intentionally */
9767 		default:
9768 			EX_T(opline->result.var).var.ptr_ptr = retval;
9769 			break;
9770 	}
9771 	CHECK_EXCEPTION();
9772 	ZEND_VM_NEXT_OPCODE();
9773 }
9774 
ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9775 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9776 {
9777 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9778 }
9779 
ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9780 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9781 {
9782 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9783 }
9784 
ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9785 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9786 {
9787 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9788 }
9789 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9790 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9791 {
9792 	USE_OPLINE
9793 
9794 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9795 }
9796 
ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9797 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9798 {
9799 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9800 }
9801 
ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9802 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9803 {
9804 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9805 }
9806 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9807 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9808 {
9809 	USE_OPLINE
9810 	zend_free_op free_op1;
9811 	zval *expr_ptr;
9812 
9813 	SAVE_OPLINE();
9814 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9815 		zval **expr_ptr_ptr = NULL;
9816 
9817 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
9818 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
9819 		}
9820 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
9821 		expr_ptr = *expr_ptr_ptr;
9822 		Z_ADDREF_P(expr_ptr);
9823 	} else {
9824 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9825 		if (1) { /* temporary variable */
9826 			zval *new_expr;
9827 
9828 			ALLOC_ZVAL(new_expr);
9829 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9830 			expr_ptr = new_expr;
9831 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
9832 			zval *new_expr;
9833 
9834 			ALLOC_ZVAL(new_expr);
9835 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9836 			expr_ptr = new_expr;
9837 			zendi_zval_copy_ctor(*expr_ptr);
9838 		} else {
9839 			Z_ADDREF_P(expr_ptr);
9840 		}
9841 	}
9842 
9843 	if (IS_UNUSED != IS_UNUSED) {
9844 
9845 		zval *offset = NULL;
9846 		ulong hval;
9847 
9848 		switch (Z_TYPE_P(offset)) {
9849 			case IS_DOUBLE:
9850 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
9851 				goto num_index;
9852 			case IS_LONG:
9853 			case IS_BOOL:
9854 				hval = Z_LVAL_P(offset);
9855 num_index:
9856 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
9857 				break;
9858 			case IS_STRING:
9859 				if (IS_UNUSED == IS_CONST) {
9860 					hval = Z_HASH_P(offset);
9861 				} else {
9862 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
9863 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
9864 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
9865 					} else {
9866 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
9867 					}
9868 				}
9869 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
9870 				break;
9871 			case IS_NULL:
9872 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
9873 				break;
9874 			default:
9875 				zend_error(E_WARNING, "Illegal offset type");
9876 				zval_ptr_dtor(&expr_ptr);
9877 				/* do nothing */
9878 				break;
9879 		}
9880 
9881 	} else {
9882 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
9883 	}
9884 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9885 
9886 	} else {
9887 
9888 	}
9889 	CHECK_EXCEPTION();
9890 	ZEND_VM_NEXT_OPCODE();
9891 }
9892 
ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9893 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9894 {
9895 	USE_OPLINE
9896 
9897 	array_init(&EX_T(opline->result.var).tmp_var);
9898 	if (IS_TMP_VAR == IS_UNUSED) {
9899 		ZEND_VM_NEXT_OPCODE();
9900 #if 0 || IS_TMP_VAR != IS_UNUSED
9901 	} else {
9902 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9903 #endif
9904 	}
9905 }
9906 
ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9907 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9908 {
9909 	USE_OPLINE
9910 	zval tmp, *varname;
9911 	HashTable *target_symbol_table;
9912 	zend_free_op free_op1;
9913 
9914 	SAVE_OPLINE();
9915 	if (IS_TMP_VAR == IS_CV &&
9916 	    IS_UNUSED == IS_UNUSED &&
9917 	    (opline->extended_value & ZEND_QUICK_SET)) {
9918 		if (EG(active_symbol_table)) {
9919 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9920 
9921 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
9922 			EX_CV(opline->op1.var) = NULL;
9923 		} else if (EX_CV(opline->op1.var)) {
9924 			zval_ptr_dtor(EX_CV(opline->op1.var));
9925 			EX_CV(opline->op1.var) = NULL;
9926 		}
9927 		CHECK_EXCEPTION();
9928 		ZEND_VM_NEXT_OPCODE();
9929 	}
9930 
9931 	varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
9932 
9933 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
9934 		ZVAL_COPY_VALUE(&tmp, varname);
9935 		zval_copy_ctor(&tmp);
9936 		convert_to_string(&tmp);
9937 		varname = &tmp;
9938 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9939 		Z_ADDREF_P(varname);
9940 	}
9941 
9942 	if (IS_UNUSED != IS_UNUSED) {
9943 		zend_class_entry *ce;
9944 
9945 		if (IS_UNUSED == IS_CONST) {
9946 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9947 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
9948 			} else {
9949 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9950 				if (UNEXPECTED(EG(exception) != NULL)) {
9951 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9952 						zval_dtor(&tmp);
9953 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9954 						zval_ptr_dtor(&varname);
9955 					}
9956 					zval_dtor(free_op1.var);
9957 					HANDLE_EXCEPTION();
9958 				}
9959 				if (UNEXPECTED(ce == NULL)) {
9960 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
9961 				}
9962 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
9963 			}
9964 		} else {
9965 			ce = EX_T(opline->op2.var).class_entry;
9966 		}
9967 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9968 	} else {
9969 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
9970 
9971 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9972 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
9973 	}
9974 
9975 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9976 		zval_dtor(&tmp);
9977 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9978 		zval_ptr_dtor(&varname);
9979 	}
9980 	zval_dtor(free_op1.var);
9981 	CHECK_EXCEPTION();
9982 	ZEND_VM_NEXT_OPCODE();
9983 }
9984 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9985 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9986 {
9987 	USE_OPLINE
9988 	zval **value;
9989 	zend_bool isset = 1;
9990 
9991 	SAVE_OPLINE();
9992 	if (IS_TMP_VAR == IS_CV &&
9993 	    IS_UNUSED == IS_UNUSED &&
9994 	    (opline->extended_value & ZEND_QUICK_SET)) {
9995 		if (EX_CV(opline->op1.var)) {
9996 			value = EX_CV(opline->op1.var);
9997 		} else if (EG(active_symbol_table)) {
9998 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9999 
10000 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
10001 				isset = 0;
10002 			}
10003 		} else {
10004 			isset = 0;
10005 		}
10006 	} else {
10007 		HashTable *target_symbol_table;
10008 		zend_free_op free_op1;
10009 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10010 
10011 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
10012 			ZVAL_COPY_VALUE(&tmp, varname);
10013 			zval_copy_ctor(&tmp);
10014 			convert_to_string(&tmp);
10015 			varname = &tmp;
10016 		}
10017 
10018 		if (IS_UNUSED != IS_UNUSED) {
10019 			zend_class_entry *ce;
10020 
10021 			if (IS_UNUSED == IS_CONST) {
10022 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
10023 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
10024 				} else {
10025 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
10026 					if (UNEXPECTED(ce == NULL)) {
10027 						CHECK_EXCEPTION();
10028 						ZEND_VM_NEXT_OPCODE();
10029 					}
10030 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
10031 				}
10032 			} else {
10033 				ce = EX_T(opline->op2.var).class_entry;
10034 			}
10035 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
10036 			if (!value) {
10037 				isset = 0;
10038 			}
10039 		} else {
10040 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
10041 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
10042 				isset = 0;
10043 			}
10044 		}
10045 
10046 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
10047 			zval_dtor(&tmp);
10048 		}
10049 		zval_dtor(free_op1.var);
10050 	}
10051 
10052 	if (opline->extended_value & ZEND_ISSET) {
10053 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
10054 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
10055 		} else {
10056 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
10057 		}
10058 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
10059 		if (!isset || !i_zend_is_true(*value)) {
10060 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
10061 		} else {
10062 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
10063 		}
10064 	}
10065 
10066 	CHECK_EXCEPTION();
10067 	ZEND_VM_NEXT_OPCODE();
10068 }
10069 
ZEND_ADD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10070 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10071 {
10072 	USE_OPLINE
10073 	zend_free_op free_op1;
10074 
10075 	SAVE_OPLINE();
10076 	fast_add_function(&EX_T(opline->result.var).tmp_var,
10077 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10078 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10079 	zval_dtor(free_op1.var);
10080 
10081 	CHECK_EXCEPTION();
10082 	ZEND_VM_NEXT_OPCODE();
10083 }
10084 
ZEND_SUB_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10085 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10086 {
10087 	USE_OPLINE
10088 	zend_free_op free_op1;
10089 
10090 	SAVE_OPLINE();
10091 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
10092 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10093 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10094 	zval_dtor(free_op1.var);
10095 
10096 	CHECK_EXCEPTION();
10097 	ZEND_VM_NEXT_OPCODE();
10098 }
10099 
ZEND_MUL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10100 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10101 {
10102 	USE_OPLINE
10103 	zend_free_op free_op1;
10104 
10105 	SAVE_OPLINE();
10106 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
10107 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10108 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10109 	zval_dtor(free_op1.var);
10110 
10111 	CHECK_EXCEPTION();
10112 	ZEND_VM_NEXT_OPCODE();
10113 }
10114 
ZEND_DIV_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10115 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10116 {
10117 	USE_OPLINE
10118 	zend_free_op free_op1;
10119 
10120 	SAVE_OPLINE();
10121 	fast_div_function(&EX_T(opline->result.var).tmp_var,
10122 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10123 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10124 	zval_dtor(free_op1.var);
10125 
10126 	CHECK_EXCEPTION();
10127 	ZEND_VM_NEXT_OPCODE();
10128 }
10129 
ZEND_MOD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10130 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10131 {
10132 	USE_OPLINE
10133 	zend_free_op free_op1;
10134 
10135 	SAVE_OPLINE();
10136 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
10137 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10138 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10139 	zval_dtor(free_op1.var);
10140 
10141 	CHECK_EXCEPTION();
10142 	ZEND_VM_NEXT_OPCODE();
10143 }
10144 
ZEND_SL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10145 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10146 {
10147 	USE_OPLINE
10148 	zend_free_op free_op1;
10149 
10150 	SAVE_OPLINE();
10151 	shift_left_function(&EX_T(opline->result.var).tmp_var,
10152 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10153 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10154 	zval_dtor(free_op1.var);
10155 
10156 	CHECK_EXCEPTION();
10157 	ZEND_VM_NEXT_OPCODE();
10158 }
10159 
ZEND_SR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10160 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10161 {
10162 	USE_OPLINE
10163 	zend_free_op free_op1;
10164 
10165 	SAVE_OPLINE();
10166 	shift_right_function(&EX_T(opline->result.var).tmp_var,
10167 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10168 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10169 	zval_dtor(free_op1.var);
10170 
10171 	CHECK_EXCEPTION();
10172 	ZEND_VM_NEXT_OPCODE();
10173 }
10174 
ZEND_CONCAT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10175 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10176 {
10177 	USE_OPLINE
10178 	zend_free_op free_op1;
10179 
10180 	SAVE_OPLINE();
10181 	concat_function(&EX_T(opline->result.var).tmp_var,
10182 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10183 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10184 	zval_dtor(free_op1.var);
10185 
10186 	CHECK_EXCEPTION();
10187 	ZEND_VM_NEXT_OPCODE();
10188 }
10189 
ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10190 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10191 {
10192 	USE_OPLINE
10193 	zend_free_op free_op1;
10194 
10195 	SAVE_OPLINE();
10196 	is_identical_function(&EX_T(opline->result.var).tmp_var,
10197 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10198 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10199 	zval_dtor(free_op1.var);
10200 
10201 	CHECK_EXCEPTION();
10202 	ZEND_VM_NEXT_OPCODE();
10203 }
10204 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10205 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10206 {
10207 	USE_OPLINE
10208 	zend_free_op free_op1;
10209 	zval *result = &EX_T(opline->result.var).tmp_var;
10210 
10211 	SAVE_OPLINE();
10212 	is_identical_function(result,
10213 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10214 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10215 	Z_LVAL_P(result) = !Z_LVAL_P(result);
10216 	zval_dtor(free_op1.var);
10217 
10218 	CHECK_EXCEPTION();
10219 	ZEND_VM_NEXT_OPCODE();
10220 }
10221 
ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10222 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10223 {
10224 	USE_OPLINE
10225 	zend_free_op free_op1;
10226 	zval *result = &EX_T(opline->result.var).tmp_var;
10227 
10228 	SAVE_OPLINE();
10229 	ZVAL_BOOL(result, fast_equal_function(result,
10230 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10231 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
10232 	zval_dtor(free_op1.var);
10233 
10234 	CHECK_EXCEPTION();
10235 	ZEND_VM_NEXT_OPCODE();
10236 }
10237 
ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10238 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10239 {
10240 	USE_OPLINE
10241 	zend_free_op free_op1;
10242 	zval *result = &EX_T(opline->result.var).tmp_var;
10243 
10244 	SAVE_OPLINE();
10245 	ZVAL_BOOL(result, fast_not_equal_function(result,
10246 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10247 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
10248 	zval_dtor(free_op1.var);
10249 
10250 	CHECK_EXCEPTION();
10251 	ZEND_VM_NEXT_OPCODE();
10252 }
10253 
ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10254 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10255 {
10256 	USE_OPLINE
10257 	zend_free_op free_op1;
10258 	zval *result = &EX_T(opline->result.var).tmp_var;
10259 
10260 	SAVE_OPLINE();
10261 	ZVAL_BOOL(result, fast_is_smaller_function(result,
10262 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10263 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
10264 	zval_dtor(free_op1.var);
10265 
10266 	CHECK_EXCEPTION();
10267 	ZEND_VM_NEXT_OPCODE();
10268 }
10269 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10270 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10271 {
10272 	USE_OPLINE
10273 	zend_free_op free_op1;
10274 	zval *result = &EX_T(opline->result.var).tmp_var;
10275 
10276 	SAVE_OPLINE();
10277 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
10278 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10279 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
10280 	zval_dtor(free_op1.var);
10281 
10282 	CHECK_EXCEPTION();
10283 	ZEND_VM_NEXT_OPCODE();
10284 }
10285 
ZEND_BW_OR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10286 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10287 {
10288 	USE_OPLINE
10289 	zend_free_op free_op1;
10290 
10291 	SAVE_OPLINE();
10292 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
10293 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10294 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10295 	zval_dtor(free_op1.var);
10296 
10297 	CHECK_EXCEPTION();
10298 	ZEND_VM_NEXT_OPCODE();
10299 }
10300 
ZEND_BW_AND_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10301 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10302 {
10303 	USE_OPLINE
10304 	zend_free_op free_op1;
10305 
10306 	SAVE_OPLINE();
10307 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
10308 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10309 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10310 	zval_dtor(free_op1.var);
10311 
10312 	CHECK_EXCEPTION();
10313 	ZEND_VM_NEXT_OPCODE();
10314 }
10315 
ZEND_BW_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10316 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10317 {
10318 	USE_OPLINE
10319 	zend_free_op free_op1;
10320 
10321 	SAVE_OPLINE();
10322 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
10323 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10324 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10325 	zval_dtor(free_op1.var);
10326 
10327 	CHECK_EXCEPTION();
10328 	ZEND_VM_NEXT_OPCODE();
10329 }
10330 
ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10331 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10332 {
10333 	USE_OPLINE
10334 	zend_free_op free_op1;
10335 
10336 	SAVE_OPLINE();
10337 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
10338 		_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10339 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10340 	zval_dtor(free_op1.var);
10341 
10342 	CHECK_EXCEPTION();
10343 	ZEND_VM_NEXT_OPCODE();
10344 }
10345 
ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10346 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10347 {
10348 	USE_OPLINE
10349 
10350 	zval *str = &EX_T(opline->result.var).tmp_var;
10351 	zval *var;
10352 	zval var_copy;
10353 	int use_copy = 0;
10354 
10355 	SAVE_OPLINE();
10356 	var = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
10357 
10358 	if (IS_TMP_VAR == IS_UNUSED) {
10359 		/* Initialize for erealloc in add_string_to_string */
10360 		Z_STRVAL_P(str) = NULL;
10361 		Z_STRLEN_P(str) = 0;
10362 		Z_TYPE_P(str) = IS_STRING;
10363 
10364 		INIT_PZVAL(str);
10365 	}
10366 
10367 	if (Z_TYPE_P(var) != IS_STRING) {
10368 		zend_make_printable_zval(var, &var_copy, &use_copy);
10369 
10370 		if (use_copy) {
10371 			var = &var_copy;
10372 		}
10373 	}
10374 	add_string_to_string(str, str, var);
10375 
10376 	if (use_copy) {
10377 		zval_dtor(var);
10378 	}
10379 	/* original comment, possibly problematic:
10380 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
10381 	 * (Zeev):  I don't think it's problematic, we only use variables
10382 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
10383 	 * string offsets or overloaded objects
10384 	 */
10385 
10386 	CHECK_EXCEPTION();
10387 	ZEND_VM_NEXT_OPCODE();
10388 }
10389 
ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10390 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10391 {
10392 	USE_OPLINE
10393 	zval *function_name;
10394 	char *function_name_strval;
10395 	int function_name_strlen;
10396 	zend_free_op free_op1;
10397 
10398 	SAVE_OPLINE();
10399 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
10400 
10401 	function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
10402 
10403 	if (IS_CV != IS_CONST &&
10404 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
10405 		zend_error_noreturn(E_ERROR, "Method name must be a string");
10406 	}
10407 
10408 	function_name_strval = Z_STRVAL_P(function_name);
10409 	function_name_strlen = Z_STRLEN_P(function_name);
10410 
10411 	EX(object) = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10412 
10413 	if (EXPECTED(EX(object) != NULL) &&
10414 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
10415 		EX(called_scope) = Z_OBJCE_P(EX(object));
10416 
10417 		if (IS_CV != IS_CONST ||
10418 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
10419 		    zval *object = EX(object);
10420 
10421 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
10422 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
10423 			}
10424 
10425 			/* First, locate the function. */
10426 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
10427 			if (UNEXPECTED(EX(fbc) == NULL)) {
10428 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
10429 			}
10430 			if (IS_CV == IS_CONST &&
10431 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
10432 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
10433 			    EXPECTED(EX(object) == object)) {
10434 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
10435 			}
10436 		}
10437 	} else {
10438 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
10439 	}
10440 
10441 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
10442 		EX(object) = NULL;
10443 	} else {
10444 		if (!PZVAL_IS_REF(EX(object))) {
10445 			Z_ADDREF_P(EX(object)); /* For $this pointer */
10446 		} else {
10447 			zval *this_ptr;
10448 			ALLOC_ZVAL(this_ptr);
10449 			INIT_PZVAL_COPY(this_ptr, EX(object));
10450 			zval_copy_ctor(this_ptr);
10451 			EX(object) = this_ptr;
10452 		}
10453 	}
10454 
10455 
10456 	CHECK_EXCEPTION();
10457 	ZEND_VM_NEXT_OPCODE();
10458 }
10459 
ZEND_CASE_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10460 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10461 {
10462 	USE_OPLINE
10463 	zend_free_op free_op1;
10464 
10465 	SAVE_OPLINE();
10466 	if (IS_TMP_VAR==IS_VAR) {
10467 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
10468 	}
10469 	is_equal_function(&EX_T(opline->result.var).tmp_var,
10470 				 _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
10471 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
10472 
10473 	CHECK_EXCEPTION();
10474 	ZEND_VM_NEXT_OPCODE();
10475 }
10476 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10477 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10478 {
10479 	USE_OPLINE
10480 	zend_free_op free_op1;
10481 	zval *expr_ptr;
10482 
10483 	SAVE_OPLINE();
10484 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
10485 		zval **expr_ptr_ptr = NULL;
10486 
10487 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
10488 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
10489 		}
10490 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
10491 		expr_ptr = *expr_ptr_ptr;
10492 		Z_ADDREF_P(expr_ptr);
10493 	} else {
10494 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10495 		if (1) { /* temporary variable */
10496 			zval *new_expr;
10497 
10498 			ALLOC_ZVAL(new_expr);
10499 			INIT_PZVAL_COPY(new_expr, expr_ptr);
10500 			expr_ptr = new_expr;
10501 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
10502 			zval *new_expr;
10503 
10504 			ALLOC_ZVAL(new_expr);
10505 			INIT_PZVAL_COPY(new_expr, expr_ptr);
10506 			expr_ptr = new_expr;
10507 			zendi_zval_copy_ctor(*expr_ptr);
10508 		} else {
10509 			Z_ADDREF_P(expr_ptr);
10510 		}
10511 	}
10512 
10513 	if (IS_CV != IS_UNUSED) {
10514 
10515 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
10516 		ulong hval;
10517 
10518 		switch (Z_TYPE_P(offset)) {
10519 			case IS_DOUBLE:
10520 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
10521 				goto num_index;
10522 			case IS_LONG:
10523 			case IS_BOOL:
10524 				hval = Z_LVAL_P(offset);
10525 num_index:
10526 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
10527 				break;
10528 			case IS_STRING:
10529 				if (IS_CV == IS_CONST) {
10530 					hval = Z_HASH_P(offset);
10531 				} else {
10532 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
10533 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
10534 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
10535 					} else {
10536 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
10537 					}
10538 				}
10539 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
10540 				break;
10541 			case IS_NULL:
10542 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
10543 				break;
10544 			default:
10545 				zend_error(E_WARNING, "Illegal offset type");
10546 				zval_ptr_dtor(&expr_ptr);
10547 				/* do nothing */
10548 				break;
10549 		}
10550 
10551 	} else {
10552 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
10553 	}
10554 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
10555 
10556 	} else {
10557 
10558 	}
10559 	CHECK_EXCEPTION();
10560 	ZEND_VM_NEXT_OPCODE();
10561 }
10562 
ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10563 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10564 {
10565 	USE_OPLINE
10566 
10567 	array_init(&EX_T(opline->result.var).tmp_var);
10568 	if (IS_TMP_VAR == IS_UNUSED) {
10569 		ZEND_VM_NEXT_OPCODE();
10570 #if 0 || IS_TMP_VAR != IS_UNUSED
10571 	} else {
10572 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10573 #endif
10574 	}
10575 }
10576 
ZEND_BW_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10577 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10578 {
10579 	USE_OPLINE
10580 	zend_free_op free_op1;
10581 
10582 	SAVE_OPLINE();
10583 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
10584 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC) TSRMLS_CC);
10585 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10586 	CHECK_EXCEPTION();
10587 	ZEND_VM_NEXT_OPCODE();
10588 }
10589 
ZEND_BOOL_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10590 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10591 {
10592 	USE_OPLINE
10593 	zend_free_op free_op1;
10594 
10595 	SAVE_OPLINE();
10596 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
10597 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC) TSRMLS_CC);
10598 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10599 	CHECK_EXCEPTION();
10600 	ZEND_VM_NEXT_OPCODE();
10601 }
10602 
ZEND_PRE_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10603 static int ZEND_FASTCALL  ZEND_PRE_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10604 {
10605 	USE_OPLINE
10606 	zend_free_op free_op1;
10607 	zval **var_ptr;
10608 
10609 	SAVE_OPLINE();
10610 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10611 
10612 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
10613 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
10614 	}
10615 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
10616 		if (RETURN_VALUE_USED(opline)) {
10617 			PZVAL_LOCK(&EG(uninitialized_zval));
10618 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
10619 		}
10620 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10621 		CHECK_EXCEPTION();
10622 		ZEND_VM_NEXT_OPCODE();
10623 	}
10624 
10625 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
10626 
10627 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
10628 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
10629 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
10630 		/* proxy object */
10631 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
10632 		Z_ADDREF_P(val);
10633 		fast_increment_function(val);
10634 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
10635 		zval_ptr_dtor(&val);
10636 	} else {
10637 		fast_increment_function(*var_ptr);
10638 	}
10639 
10640 	if (RETURN_VALUE_USED(opline)) {
10641 		PZVAL_LOCK(*var_ptr);
10642 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
10643 	}
10644 
10645 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10646 	CHECK_EXCEPTION();
10647 	ZEND_VM_NEXT_OPCODE();
10648 }
10649 
ZEND_PRE_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10650 static int ZEND_FASTCALL  ZEND_PRE_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10651 {
10652 	USE_OPLINE
10653 	zend_free_op free_op1;
10654 	zval **var_ptr;
10655 
10656 	SAVE_OPLINE();
10657 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10658 
10659 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
10660 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
10661 	}
10662 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
10663 		if (RETURN_VALUE_USED(opline)) {
10664 			PZVAL_LOCK(&EG(uninitialized_zval));
10665 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
10666 		}
10667 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10668 		CHECK_EXCEPTION();
10669 		ZEND_VM_NEXT_OPCODE();
10670 	}
10671 
10672 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
10673 
10674 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
10675 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
10676 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
10677 		/* proxy object */
10678 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
10679 		Z_ADDREF_P(val);
10680 		fast_decrement_function(val);
10681 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
10682 		zval_ptr_dtor(&val);
10683 	} else {
10684 		fast_decrement_function(*var_ptr);
10685 	}
10686 
10687 	if (RETURN_VALUE_USED(opline)) {
10688 		PZVAL_LOCK(*var_ptr);
10689 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
10690 	}
10691 
10692 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10693 	CHECK_EXCEPTION();
10694 	ZEND_VM_NEXT_OPCODE();
10695 }
10696 
ZEND_POST_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10697 static int ZEND_FASTCALL  ZEND_POST_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10698 {
10699 	USE_OPLINE
10700 	zend_free_op free_op1;
10701 	zval **var_ptr, *retval;
10702 
10703 	SAVE_OPLINE();
10704 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10705 
10706 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
10707 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
10708 	}
10709 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
10710 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
10711 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10712 		CHECK_EXCEPTION();
10713 		ZEND_VM_NEXT_OPCODE();
10714 	}
10715 
10716 	retval = &EX_T(opline->result.var).tmp_var;
10717 	ZVAL_COPY_VALUE(retval, *var_ptr);
10718 	zendi_zval_copy_ctor(*retval);
10719 
10720 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
10721 
10722 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
10723 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
10724 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
10725 		/* proxy object */
10726 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
10727 		Z_ADDREF_P(val);
10728 		fast_increment_function(val);
10729 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
10730 		zval_ptr_dtor(&val);
10731 	} else {
10732 		fast_increment_function(*var_ptr);
10733 	}
10734 
10735 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10736 	CHECK_EXCEPTION();
10737 	ZEND_VM_NEXT_OPCODE();
10738 }
10739 
ZEND_POST_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10740 static int ZEND_FASTCALL  ZEND_POST_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10741 {
10742 	USE_OPLINE
10743 	zend_free_op free_op1;
10744 	zval **var_ptr, *retval;
10745 
10746 	SAVE_OPLINE();
10747 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10748 
10749 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
10750 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
10751 	}
10752 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
10753 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
10754 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10755 		CHECK_EXCEPTION();
10756 		ZEND_VM_NEXT_OPCODE();
10757 	}
10758 
10759 	retval = &EX_T(opline->result.var).tmp_var;
10760 	ZVAL_COPY_VALUE(retval, *var_ptr);
10761 	zendi_zval_copy_ctor(*retval);
10762 
10763 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
10764 
10765 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
10766 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
10767 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
10768 		/* proxy object */
10769 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
10770 		Z_ADDREF_P(val);
10771 		fast_decrement_function(val);
10772 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
10773 		zval_ptr_dtor(&val);
10774 	} else {
10775 		fast_decrement_function(*var_ptr);
10776 	}
10777 
10778 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10779 	CHECK_EXCEPTION();
10780 	ZEND_VM_NEXT_OPCODE();
10781 }
10782 
ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10783 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10784 {
10785 	USE_OPLINE
10786 	zend_free_op free_op1;
10787 	zval *z;
10788 
10789 	SAVE_OPLINE();
10790 	z = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10791 
10792 	if (IS_VAR == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
10793 		INIT_PZVAL(z);
10794 	}
10795 	zend_print_variable(z);
10796 
10797 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10798 	CHECK_EXCEPTION();
10799 	ZEND_VM_NEXT_OPCODE();
10800 }
10801 
ZEND_PRINT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10802 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10803 {
10804 	USE_OPLINE
10805 
10806 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
10807 	return ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10808 }
10809 
ZEND_JMPZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10810 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10811 {
10812 	USE_OPLINE
10813 	zend_free_op free_op1;
10814 	zval *val;
10815 	int ret;
10816 
10817 	SAVE_OPLINE();
10818 	val = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10819 
10820 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
10821 		ret = Z_LVAL_P(val);
10822 	} else {
10823 		ret = i_zend_is_true(val);
10824 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10825 		if (UNEXPECTED(EG(exception) != NULL)) {
10826 			HANDLE_EXCEPTION();
10827 		}
10828 	}
10829 	if (!ret) {
10830 #if DEBUG_ZEND>=2
10831 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
10832 #endif
10833 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
10834 		ZEND_VM_CONTINUE();
10835 	}
10836 
10837 	ZEND_VM_NEXT_OPCODE();
10838 }
10839 
ZEND_JMPNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10840 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10841 {
10842 	USE_OPLINE
10843 	zend_free_op free_op1;
10844 	zval *val;
10845 	int ret;
10846 
10847 	SAVE_OPLINE();
10848 	val = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10849 
10850 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
10851 		ret = Z_LVAL_P(val);
10852 	} else {
10853 		ret = i_zend_is_true(val);
10854 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10855 		if (UNEXPECTED(EG(exception) != NULL)) {
10856 			HANDLE_EXCEPTION();
10857 		}
10858 	}
10859 	if (ret) {
10860 #if DEBUG_ZEND>=2
10861 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
10862 #endif
10863 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
10864 		ZEND_VM_CONTINUE();
10865 	}
10866 
10867 	ZEND_VM_NEXT_OPCODE();
10868 }
10869 
ZEND_JMPZNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10870 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10871 {
10872 	USE_OPLINE
10873 	zend_free_op free_op1;
10874 	zval *val;
10875 	int retval;
10876 
10877 	SAVE_OPLINE();
10878 	val = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10879 
10880 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
10881 		retval = Z_LVAL_P(val);
10882 	} else {
10883 		retval = i_zend_is_true(val);
10884 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10885 		if (UNEXPECTED(EG(exception) != NULL)) {
10886 			HANDLE_EXCEPTION();
10887 		}
10888 	}
10889 	if (EXPECTED(retval != 0)) {
10890 #if DEBUG_ZEND>=2
10891 		printf("Conditional jmp on true to %d\n", opline->extended_value);
10892 #endif
10893 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
10894 		ZEND_VM_CONTINUE(); /* CHECK_ME */
10895 	} else {
10896 #if DEBUG_ZEND>=2
10897 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
10898 #endif
10899 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
10900 		ZEND_VM_CONTINUE(); /* CHECK_ME */
10901 	}
10902 }
10903 
ZEND_JMPZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10904 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10905 {
10906 	USE_OPLINE
10907 	zend_free_op free_op1;
10908 	zval *val;
10909 	int retval;
10910 
10911 	SAVE_OPLINE();
10912 	val = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10913 
10914 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
10915 		retval = Z_LVAL_P(val);
10916 	} else {
10917 		retval = i_zend_is_true(val);
10918 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10919 		if (UNEXPECTED(EG(exception) != NULL)) {
10920 			HANDLE_EXCEPTION();
10921 		}
10922 	}
10923 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
10924 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
10925 	if (!retval) {
10926 #if DEBUG_ZEND>=2
10927 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
10928 #endif
10929 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
10930 		ZEND_VM_CONTINUE();
10931 	}
10932 	ZEND_VM_NEXT_OPCODE();
10933 }
10934 
ZEND_JMPNZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10935 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10936 {
10937 	USE_OPLINE
10938 	zend_free_op free_op1;
10939 	zval *val;
10940 	int retval;
10941 
10942 	SAVE_OPLINE();
10943 	val = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10944 
10945 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
10946 		retval = Z_LVAL_P(val);
10947 	} else {
10948 		retval = i_zend_is_true(val);
10949 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10950 		if (UNEXPECTED(EG(exception) != NULL)) {
10951 			HANDLE_EXCEPTION();
10952 		}
10953 	}
10954 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
10955 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
10956 	if (retval) {
10957 #if DEBUG_ZEND>=2
10958 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
10959 #endif
10960 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
10961 		ZEND_VM_CONTINUE();
10962 	}
10963 	ZEND_VM_NEXT_OPCODE();
10964 }
10965 
ZEND_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10966 static int ZEND_FASTCALL  ZEND_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10967 {
10968 	USE_OPLINE
10969 
10970 	SAVE_OPLINE();
10971 	if (IS_VAR == IS_TMP_VAR) {
10972 		zendi_zval_dtor(EX_T(opline->op1.var).tmp_var);
10973 	} else {
10974 		zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
10975 	}
10976 	CHECK_EXCEPTION();
10977 	ZEND_VM_NEXT_OPCODE();
10978 }
10979 
ZEND_RETURN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10980 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10981 {
10982 	USE_OPLINE
10983 	zval *retval_ptr;
10984 	zend_free_op free_op1;
10985 
10986 	SAVE_OPLINE();
10987 	retval_ptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
10988 
10989 	if (!EG(return_value_ptr_ptr)) {
10990 		if (IS_VAR == IS_TMP_VAR) {
10991 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
10992 		}
10993 	} else if (!0) { /* Not a temp var */
10994 		if (IS_VAR == IS_CONST ||
10995 		    (PZVAL_IS_REF(retval_ptr) && Z_REFCOUNT_P(retval_ptr) > 0)) {
10996 			zval *ret;
10997 
10998 			ALLOC_ZVAL(ret);
10999 			INIT_PZVAL_COPY(ret, retval_ptr);
11000 			zval_copy_ctor(ret);
11001 			*EG(return_value_ptr_ptr) = ret;
11002 		} else if ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
11003 		           retval_ptr == &EG(uninitialized_zval)) {
11004 			zval *ret;
11005 
11006 			ALLOC_INIT_ZVAL(ret);
11007 			*EG(return_value_ptr_ptr) = ret;
11008 		} else {
11009 			*EG(return_value_ptr_ptr) = retval_ptr;
11010 			Z_ADDREF_P(retval_ptr);
11011 		}
11012 	} else {
11013 		zval *ret;
11014 
11015 		ALLOC_ZVAL(ret);
11016 		INIT_PZVAL_COPY(ret, retval_ptr);
11017 		*EG(return_value_ptr_ptr) = ret;
11018 	}
11019 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11020 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11021 }
11022 
ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11023 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11024 {
11025 	USE_OPLINE
11026 	zval *retval_ptr;
11027 	zval **retval_ptr_ptr;
11028 	zend_free_op free_op1;
11029 
11030 	SAVE_OPLINE();
11031 
11032 	do {
11033 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
11034 			/* Not supposed to happen, but we'll allow it */
11035 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
11036 
11037 			retval_ptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11038 			if (!EG(return_value_ptr_ptr)) {
11039 				if (IS_VAR == IS_TMP_VAR) {
11040 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11041 				}
11042 			} else if (!0) { /* Not a temp var */
11043 				zval *ret;
11044 
11045 				ALLOC_ZVAL(ret);
11046 				INIT_PZVAL_COPY(ret, retval_ptr);
11047 				zval_copy_ctor(ret);
11048 				*EG(return_value_ptr_ptr) = ret;
11049 			} else {
11050 				zval *ret;
11051 
11052 				ALLOC_ZVAL(ret);
11053 				INIT_PZVAL_COPY(ret, retval_ptr);
11054 				*EG(return_value_ptr_ptr) = ret;
11055 			}
11056 			break;
11057 		}
11058 
11059 		retval_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11060 
11061 		if (IS_VAR == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
11062 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
11063 		}
11064 
11065 		if (IS_VAR == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
11066 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
11067 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
11068 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
11069 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
11070 				if (EG(return_value_ptr_ptr)) {
11071 					zval *ret;
11072 
11073 					ALLOC_ZVAL(ret);
11074 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
11075 					zval_copy_ctor(ret);
11076 					*EG(return_value_ptr_ptr) = ret;
11077 				}
11078 				break;
11079 			}
11080 		}
11081 
11082 		if (EG(return_value_ptr_ptr)) {
11083 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
11084 			Z_ADDREF_PP(retval_ptr_ptr);
11085 
11086 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
11087 		}
11088 	} while (0);
11089 
11090 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11091 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11092 }
11093 
ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11094 static int ZEND_FASTCALL  ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11095 {
11096 	USE_OPLINE
11097 	zval *value;
11098 	zval *exception;
11099 	zend_free_op free_op1;
11100 
11101 	SAVE_OPLINE();
11102 	value = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11103 
11104 	if (IS_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
11105 		zend_error_noreturn(E_ERROR, "Can only throw objects");
11106 	}
11107 	zend_exception_save(TSRMLS_C);
11108 	/* Not sure if a complete copy is what we want here */
11109 	ALLOC_ZVAL(exception);
11110 	INIT_PZVAL_COPY(exception, value);
11111 	if (!0) {
11112 		zval_copy_ctor(exception);
11113 	}
11114 
11115 	zend_throw_exception_object(exception TSRMLS_CC);
11116 	zend_exception_restore(TSRMLS_C);
11117 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11118 	HANDLE_EXCEPTION();
11119 }
11120 
zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS)11121 static int ZEND_FASTCALL zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS)
11122 {
11123 	USE_OPLINE
11124 	zval *varptr;
11125 	zend_free_op free_op1;
11126 	varptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11127 
11128 	if (varptr == &EG(uninitialized_zval)) {
11129 		ALLOC_ZVAL(varptr);
11130 		INIT_ZVAL(*varptr);
11131 		Z_SET_REFCOUNT_P(varptr, 0);
11132 	} else if (PZVAL_IS_REF(varptr)) {
11133 		zval *original_var = varptr;
11134 
11135 		ALLOC_ZVAL(varptr);
11136 		ZVAL_COPY_VALUE(varptr, original_var);
11137 		Z_UNSET_ISREF_P(varptr);
11138 		Z_SET_REFCOUNT_P(varptr, 0);
11139 		zval_copy_ctor(varptr);
11140 	}
11141 	Z_ADDREF_P(varptr);
11142 	zend_vm_stack_push(varptr TSRMLS_CC);
11143 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};  /* for string offsets */
11144 
11145 	CHECK_EXCEPTION();
11146 	ZEND_VM_NEXT_OPCODE();
11147 }
11148 
ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11149 static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11150 {
11151 	USE_OPLINE
11152 	zend_free_op free_op1;
11153 	zval *varptr;
11154 
11155 	SAVE_OPLINE();
11156 	if (opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) { /* Had function_ptr at compile_time */
11157 		if (!(opline->extended_value & ZEND_ARG_SEND_BY_REF)) {
11158 			return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11159 		}
11160 	} else if (!ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
11161 		return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11162 	}
11163 
11164 	if (IS_VAR == IS_VAR &&
11165 		(opline->extended_value & ZEND_ARG_SEND_FUNCTION) &&
11166 		EX_T(opline->op1.var).var.fcall_returned_reference &&
11167 		EX_T(opline->op1.var).var.ptr) {
11168 		varptr = EX_T(opline->op1.var).var.ptr;
11169 		PZVAL_UNLOCK_EX(varptr, &free_op1, 0);
11170 	} else {
11171 		varptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11172 	}
11173 	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
11174 	     EX_T(opline->op1.var).var.fcall_returned_reference) &&
11175 	    varptr != &EG(uninitialized_zval) &&
11176 	    (PZVAL_IS_REF(varptr) ||
11177 	     (Z_REFCOUNT_P(varptr) == 1 && (IS_VAR == IS_CV || free_op1.var)))) {
11178 		Z_SET_ISREF_P(varptr);
11179 		Z_ADDREF_P(varptr);
11180 		zend_vm_stack_push(varptr TSRMLS_CC);
11181 	} else {
11182 		zval *valptr;
11183 
11184 		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
11185 			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
11186 			!ARG_MAY_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
11187 			zend_error(E_STRICT, "Only variables should be passed by reference");
11188 		}
11189 		ALLOC_ZVAL(valptr);
11190 		INIT_PZVAL_COPY(valptr, varptr);
11191 		if (!0) {
11192 			zval_copy_ctor(valptr);
11193 		}
11194 		zend_vm_stack_push(valptr TSRMLS_CC);
11195 	}
11196 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11197 	CHECK_EXCEPTION();
11198 	ZEND_VM_NEXT_OPCODE();
11199 }
11200 
ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11201 static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11202 {
11203 	USE_OPLINE
11204 	zend_free_op free_op1;
11205 	zval **varptr_ptr;
11206 	zval *varptr;
11207 
11208 	SAVE_OPLINE();
11209 	varptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11210 
11211 	if (IS_VAR == IS_VAR && UNEXPECTED(varptr_ptr == NULL)) {
11212 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
11213 	}
11214 
11215 	if (IS_VAR == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
11216 		ALLOC_INIT_ZVAL(varptr);
11217 		zend_vm_stack_push(varptr TSRMLS_CC);
11218 		CHECK_EXCEPTION();
11219 		ZEND_VM_NEXT_OPCODE();
11220 	}
11221 
11222 	if (opline->extended_value == ZEND_DO_FCALL_BY_NAME &&
11223 	    EX(function_state).function->type == ZEND_INTERNAL_FUNCTION &&
11224 	    !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
11225 		return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11226 	}
11227 
11228 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
11229 	varptr = *varptr_ptr;
11230 	Z_ADDREF_P(varptr);
11231 	zend_vm_stack_push(varptr TSRMLS_CC);
11232 
11233 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11234 	CHECK_EXCEPTION();
11235 	ZEND_VM_NEXT_OPCODE();
11236 }
11237 
ZEND_SEND_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11238 static int ZEND_FASTCALL  ZEND_SEND_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11239 {
11240 	USE_OPLINE
11241 
11242 	if ((opline->extended_value == ZEND_DO_FCALL_BY_NAME)
11243 		&& ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
11244 		return ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11245 	}
11246 	SAVE_OPLINE();
11247 	return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11248 }
11249 
ZEND_BOOL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11250 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11251 {
11252 	USE_OPLINE
11253 	zend_free_op free_op1;
11254 	zval *retval = &EX_T(opline->result.var).tmp_var;
11255 
11256 	SAVE_OPLINE();
11257 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
11258 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC)));
11259 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11260 
11261 	CHECK_EXCEPTION();
11262 	ZEND_VM_NEXT_OPCODE();
11263 }
11264 
ZEND_SWITCH_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11265 static int ZEND_FASTCALL  ZEND_SWITCH_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11266 {
11267 	USE_OPLINE
11268 
11269 	SAVE_OPLINE();
11270 	zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
11271 	CHECK_EXCEPTION();
11272 	ZEND_VM_NEXT_OPCODE();
11273 }
11274 
ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11275 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11276 {
11277 	USE_OPLINE
11278 	zend_free_op free_op1;
11279 	zval *obj;
11280 	zend_class_entry *ce;
11281 	zend_function *clone;
11282 	zend_object_clone_obj_t clone_call;
11283 
11284 	SAVE_OPLINE();
11285 	obj = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11286 
11287 	if (IS_VAR == IS_CONST ||
11288 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
11289 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
11290 	}
11291 
11292 	ce = Z_OBJCE_P(obj);
11293 	clone = ce ? ce->clone : NULL;
11294 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
11295 	if (UNEXPECTED(clone_call == NULL)) {
11296 		if (ce) {
11297 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
11298 		} else {
11299 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
11300 		}
11301 	}
11302 
11303 	if (ce && clone) {
11304 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
11305 			/* Ensure that if we're calling a private function, we're allowed to do so.
11306 			 */
11307 			if (UNEXPECTED(ce != EG(scope))) {
11308 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
11309 			}
11310 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
11311 			/* Ensure that if we're calling a protected function, we're allowed to do so.
11312 			 */
11313 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
11314 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
11315 			}
11316 		}
11317 	}
11318 
11319 	if (EXPECTED(EG(exception) == NULL)) {
11320 		zval *retval;
11321 
11322 		ALLOC_ZVAL(retval);
11323 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
11324 		Z_TYPE_P(retval) = IS_OBJECT;
11325 		Z_SET_REFCOUNT_P(retval, 1);
11326 		Z_SET_ISREF_P(retval);
11327 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
11328 			zval_ptr_dtor(&retval);
11329 		} else {
11330 			AI_SET_PTR(&EX_T(opline->result.var), retval);
11331 		}
11332 	}
11333 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11334 	CHECK_EXCEPTION();
11335 	ZEND_VM_NEXT_OPCODE();
11336 }
11337 
ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11338 static int ZEND_FASTCALL  ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11339 {
11340 	USE_OPLINE
11341 	zend_free_op free_op1;
11342 	zval *expr;
11343 	zval *result = &EX_T(opline->result.var).tmp_var;
11344 
11345 	SAVE_OPLINE();
11346 	expr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11347 
11348 	if (opline->extended_value != IS_STRING) {
11349 		ZVAL_COPY_VALUE(result, expr);
11350 		if (!0) {
11351 			zendi_zval_copy_ctor(*result);
11352 		}
11353 	}
11354 	switch (opline->extended_value) {
11355 		case IS_NULL:
11356 			convert_to_null(result);
11357 			break;
11358 		case IS_BOOL:
11359 			convert_to_boolean(result);
11360 			break;
11361 		case IS_LONG:
11362 			convert_to_long(result);
11363 			break;
11364 		case IS_DOUBLE:
11365 			convert_to_double(result);
11366 			break;
11367 		case IS_STRING: {
11368 			zval var_copy;
11369 			int use_copy;
11370 
11371 			zend_make_printable_zval(expr, &var_copy, &use_copy);
11372 			if (use_copy) {
11373 				ZVAL_COPY_VALUE(result, &var_copy);
11374 				if (0) {
11375 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11376 				}
11377 			} else {
11378 				ZVAL_COPY_VALUE(result, expr);
11379 				if (!0) {
11380 					zendi_zval_copy_ctor(*result);
11381 				}
11382 			}
11383 			break;
11384 		}
11385 		case IS_ARRAY:
11386 			convert_to_array(result);
11387 			break;
11388 		case IS_OBJECT:
11389 			convert_to_object(result);
11390 			break;
11391 	}
11392 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11393 	CHECK_EXCEPTION();
11394 	ZEND_VM_NEXT_OPCODE();
11395 }
11396 
ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11397 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11398 {
11399 	USE_OPLINE
11400 	zend_op_array *new_op_array=NULL;
11401 	zend_free_op free_op1;
11402 	zval *inc_filename;
11403     zval *tmp_inc_filename = NULL;
11404 	zend_bool failure_retval=0;
11405 
11406 	SAVE_OPLINE();
11407 	inc_filename = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11408 
11409 	if (inc_filename->type!=IS_STRING) {
11410 		MAKE_STD_ZVAL(tmp_inc_filename);
11411 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
11412 		zval_copy_ctor(tmp_inc_filename);
11413 		convert_to_string(tmp_inc_filename);
11414 		inc_filename = tmp_inc_filename;
11415 	}
11416 
11417 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
11418 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
11419 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
11420 		} else {
11421 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
11422 		}
11423 	} else {
11424 		switch (opline->extended_value) {
11425 			case ZEND_INCLUDE_ONCE:
11426 			case ZEND_REQUIRE_ONCE: {
11427 					zend_file_handle file_handle;
11428 					char *resolved_path;
11429 
11430 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
11431 					if (resolved_path) {
11432 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
11433 					} else {
11434 						resolved_path = Z_STRVAL_P(inc_filename);
11435 					}
11436 
11437 					if (failure_retval) {
11438 						/* do nothing, file already included */
11439 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
11440 
11441 						if (!file_handle.opened_path) {
11442 							file_handle.opened_path = estrdup(resolved_path);
11443 						}
11444 
11445 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
11446 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
11447 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
11448 						} else {
11449 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
11450 							failure_retval=1;
11451 						}
11452 					} else {
11453 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
11454 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
11455 						} else {
11456 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
11457 						}
11458 					}
11459 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
11460 						efree(resolved_path);
11461 					}
11462 				}
11463 				break;
11464 			case ZEND_INCLUDE:
11465 			case ZEND_REQUIRE:
11466 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
11467 				break;
11468 			case ZEND_EVAL: {
11469 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
11470 
11471 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
11472 					efree(eval_desc);
11473 				}
11474 				break;
11475 			EMPTY_SWITCH_DEFAULT_CASE()
11476 		}
11477 	}
11478 	if (tmp_inc_filename) {
11479 		zval_ptr_dtor(&tmp_inc_filename);
11480 	}
11481 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11482 	if (UNEXPECTED(EG(exception) != NULL)) {
11483 		HANDLE_EXCEPTION();
11484 	} else if (EXPECTED(new_op_array != NULL)) {
11485 		EX(original_return_value) = EG(return_value_ptr_ptr);
11486 		EG(active_op_array) = new_op_array;
11487 		if (RETURN_VALUE_USED(opline)) {
11488 			EX_T(opline->result.var).var.ptr = NULL;
11489 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
11490 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
11491 		} else {
11492 			EG(return_value_ptr_ptr) = NULL;
11493 		}
11494 
11495 		EX(current_object) = EX(object);
11496 
11497 		EX(function_state).function = (zend_function *) new_op_array;
11498 		EX(object) = NULL;
11499 
11500 		if (!EG(active_symbol_table)) {
11501 			zend_rebuild_symbol_table(TSRMLS_C);
11502 		}
11503 
11504 		if (EXPECTED(zend_execute == execute)) {
11505 			ZEND_VM_ENTER();
11506 		} else {
11507 			zend_execute(new_op_array TSRMLS_CC);
11508 		}
11509 
11510 		EX(function_state).function = (zend_function *) EX(op_array);
11511 		EX(object) = EX(current_object);
11512 
11513 		EG(opline_ptr) = &EX(opline);
11514 		EG(active_op_array) = EX(op_array);
11515 		EG(return_value_ptr_ptr) = EX(original_return_value);
11516 		destroy_op_array(new_op_array TSRMLS_CC);
11517 		efree(new_op_array);
11518 		if (UNEXPECTED(EG(exception) != NULL)) {
11519 			zend_throw_exception_internal(NULL TSRMLS_CC);
11520 			HANDLE_EXCEPTION();
11521 		} else if (RETURN_VALUE_USED(opline)) {
11522 			if (!EX_T(opline->result.var).var.ptr) { /* there was no return statement */
11523 				zval *retval;
11524 
11525 				ALLOC_ZVAL(retval);
11526 				ZVAL_BOOL(retval, 1);
11527 				INIT_PZVAL(retval);
11528 				EX_T(opline->result.var).var.ptr = retval;
11529 			}
11530 		}
11531 
11532 	} else if (RETURN_VALUE_USED(opline)) {
11533 		zval *retval;
11534 
11535 		ALLOC_ZVAL(retval);
11536 		ZVAL_BOOL(retval, failure_retval);
11537 		INIT_PZVAL(retval);
11538 		AI_SET_PTR(&EX_T(opline->result.var), retval);
11539 	}
11540 	ZEND_VM_NEXT_OPCODE();
11541 }
11542 
ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11543 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11544 {
11545 	USE_OPLINE
11546 	zend_free_op free_op1;
11547 	zval *array_ptr, **array_ptr_ptr;
11548 	HashTable *fe_ht;
11549 	zend_object_iterator *iter = NULL;
11550 	zend_class_entry *ce = NULL;
11551 	zend_bool is_empty = 0;
11552 
11553 	SAVE_OPLINE();
11554 
11555 	if ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
11556 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
11557 		array_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11558 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
11559 			MAKE_STD_ZVAL(array_ptr);
11560 			ZVAL_NULL(array_ptr);
11561 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
11562 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
11563 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
11564 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11565 			}
11566 
11567 			ce = Z_OBJCE_PP(array_ptr_ptr);
11568 			if (!ce || ce->get_iterator == NULL) {
11569 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
11570 				Z_ADDREF_PP(array_ptr_ptr);
11571 			}
11572 			array_ptr = *array_ptr_ptr;
11573 		} else {
11574 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
11575 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
11576 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
11577 					Z_SET_ISREF_PP(array_ptr_ptr);
11578 				}
11579 			}
11580 			array_ptr = *array_ptr_ptr;
11581 			Z_ADDREF_P(array_ptr);
11582 		}
11583 	} else {
11584 		array_ptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11585 		if (0) { /* IS_TMP_VAR */
11586 			zval *tmp;
11587 
11588 			ALLOC_ZVAL(tmp);
11589 			INIT_PZVAL_COPY(tmp, array_ptr);
11590 			array_ptr = tmp;
11591 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
11592 				ce = Z_OBJCE_P(array_ptr);
11593 				if (ce && ce->get_iterator) {
11594 					Z_DELREF_P(array_ptr);
11595 				}
11596 			}
11597 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
11598 			ce = Z_OBJCE_P(array_ptr);
11599 			if (!ce || !ce->get_iterator) {
11600 				Z_ADDREF_P(array_ptr);
11601 			}
11602 		} else if (IS_VAR == IS_CONST ||
11603 		           ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
11604 		            !Z_ISREF_P(array_ptr) &&
11605 		            Z_REFCOUNT_P(array_ptr) > 1)) {
11606 			zval *tmp;
11607 
11608 			ALLOC_ZVAL(tmp);
11609 			INIT_PZVAL_COPY(tmp, array_ptr);
11610 			zval_copy_ctor(tmp);
11611 			array_ptr = tmp;
11612 		} else {
11613 			Z_ADDREF_P(array_ptr);
11614 		}
11615 	}
11616 
11617 	if (ce && ce->get_iterator) {
11618 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
11619 
11620 		if (iter && EXPECTED(EG(exception) == NULL)) {
11621 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
11622 		} else {
11623 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11624 			if (!EG(exception)) {
11625 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
11626 			}
11627 			zend_throw_exception_internal(NULL TSRMLS_CC);
11628 			HANDLE_EXCEPTION();
11629 		}
11630 	}
11631 
11632 	EX_T(opline->result.var).fe.ptr = array_ptr;
11633 
11634 	if (iter) {
11635 		iter->index = 0;
11636 		if (iter->funcs->rewind) {
11637 			iter->funcs->rewind(iter TSRMLS_CC);
11638 			if (UNEXPECTED(EG(exception) != NULL)) {
11639 				zval_ptr_dtor(&array_ptr);
11640 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11641 				HANDLE_EXCEPTION();
11642 			}
11643 		}
11644 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
11645 		if (UNEXPECTED(EG(exception) != NULL)) {
11646 			zval_ptr_dtor(&array_ptr);
11647 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11648 			HANDLE_EXCEPTION();
11649 		}
11650 		iter->index = -1; /* will be set to 0 before using next handler */
11651 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
11652 		zend_hash_internal_pointer_reset(fe_ht);
11653 		if (ce) {
11654 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
11655 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
11656 				char *str_key;
11657 				uint str_key_len;
11658 				ulong int_key;
11659 				zend_uchar key_type;
11660 
11661 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
11662 				if (key_type != HASH_KEY_NON_EXISTANT &&
11663 					(key_type == HASH_KEY_IS_LONG ||
11664 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
11665 					break;
11666 				}
11667 				zend_hash_move_forward(fe_ht);
11668 			}
11669 		}
11670 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
11671 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
11672 	} else {
11673 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
11674 		is_empty = 1;
11675 	}
11676 
11677 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11678 	if (is_empty) {
11679 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11680 	} else {
11681 		CHECK_EXCEPTION();
11682 		ZEND_VM_NEXT_OPCODE();
11683 	}
11684 }
11685 
ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11686 static int ZEND_FASTCALL  ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11687 {
11688 	USE_OPLINE
11689 
11690 	zval *array = EX_T(opline->op1.var).fe.ptr;
11691 	zval **value;
11692 	char *str_key;
11693 	uint str_key_len;
11694 	ulong int_key;
11695 	HashTable *fe_ht;
11696 	zend_object_iterator *iter = NULL;
11697 	int key_type = 0;
11698 	zend_bool use_key = (zend_bool)(opline->extended_value & ZEND_FE_FETCH_WITH_KEY);
11699 
11700 	SAVE_OPLINE();
11701 
11702 	switch (zend_iterator_unwrap(array, &iter TSRMLS_CC)) {
11703 		default:
11704 		case ZEND_ITER_INVALID:
11705 			zend_error(E_WARNING, "Invalid argument supplied for foreach()");
11706 			ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11707 
11708 		case ZEND_ITER_PLAIN_OBJECT: {
11709 			const char *class_name, *prop_name;
11710 			zend_object *zobj = zend_objects_get_address(array TSRMLS_CC);
11711 
11712 			fe_ht = Z_OBJPROP_P(array);
11713 			zend_hash_set_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
11714 			do {
11715 				if (zend_hash_get_current_data(fe_ht, (void **) &value)==FAILURE) {
11716 					/* reached end of iteration */
11717 					ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11718 				}
11719 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
11720 
11721 				zend_hash_move_forward(fe_ht);
11722 			} while (key_type == HASH_KEY_NON_EXISTANT ||
11723 			         (key_type != HASH_KEY_IS_LONG &&
11724 			          zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) != SUCCESS));
11725 			zend_hash_get_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
11726 			if (use_key && key_type != HASH_KEY_IS_LONG) {
11727 				zend_unmangle_property_name(str_key, str_key_len-1, &class_name, &prop_name);
11728 				str_key_len = strlen(prop_name);
11729 				str_key = estrndup(prop_name, str_key_len);
11730 				str_key_len++;
11731 			}
11732 			break;
11733 		}
11734 
11735 		case ZEND_ITER_PLAIN_ARRAY:
11736 			fe_ht = Z_ARRVAL_P(array);
11737 			zend_hash_set_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
11738 			if (zend_hash_get_current_data(fe_ht, (void **) &value)==FAILURE) {
11739 				/* reached end of iteration */
11740 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11741 			}
11742 			if (use_key) {
11743 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 1, NULL);
11744 			}
11745 			zend_hash_move_forward(fe_ht);
11746 			zend_hash_get_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
11747 			break;
11748 
11749 		case ZEND_ITER_OBJECT:
11750 			/* !iter happens from exception */
11751 			if (iter && ++iter->index > 0) {
11752 				/* This could cause an endless loop if index becomes zero again.
11753 				 * In case that ever happens we need an additional flag. */
11754 				iter->funcs->move_forward(iter TSRMLS_CC);
11755 				if (UNEXPECTED(EG(exception) != NULL)) {
11756 					zval_ptr_dtor(&array);
11757 					HANDLE_EXCEPTION();
11758 				}
11759 			}
11760 			/* If index is zero we come from FE_RESET and checked valid() already. */
11761 			if (!iter || (iter->index > 0 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
11762 				/* reached end of iteration */
11763 				if (UNEXPECTED(EG(exception) != NULL)) {
11764 					zval_ptr_dtor(&array);
11765 					HANDLE_EXCEPTION();
11766 				}
11767 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11768 			}
11769 			iter->funcs->get_current_data(iter, &value TSRMLS_CC);
11770 			if (UNEXPECTED(EG(exception) != NULL)) {
11771 				zval_ptr_dtor(&array);
11772 				HANDLE_EXCEPTION();
11773 			}
11774 			if (!value) {
11775 				/* failure in get_current_data */
11776 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
11777 			}
11778 			if (use_key) {
11779 				if (iter->funcs->get_current_key) {
11780 					key_type = iter->funcs->get_current_key(iter, &str_key, &str_key_len, &int_key TSRMLS_CC);
11781 					if (UNEXPECTED(EG(exception) != NULL)) {
11782 						zval_ptr_dtor(&array);
11783 						HANDLE_EXCEPTION();
11784 					}
11785 				} else {
11786 					key_type = HASH_KEY_IS_LONG;
11787 					int_key = iter->index;
11788 				}
11789 			}
11790 			break;
11791 	}
11792 
11793 	if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
11794 		SEPARATE_ZVAL_IF_NOT_REF(value);
11795 		Z_SET_ISREF_PP(value);
11796 		EX_T(opline->result.var).var.ptr_ptr = value;
11797 		Z_ADDREF_PP(value);
11798 	} else {
11799 		PZVAL_LOCK(*value);
11800 		AI_SET_PTR(&EX_T(opline->result.var), *value);
11801 	}
11802 
11803 	if (use_key) {
11804 		zval *key = &EX_T((opline+1)->result.var).tmp_var;
11805 
11806 		switch (key_type) {
11807 			case HASH_KEY_IS_STRING:
11808 				Z_STRVAL_P(key) = (char*)str_key;
11809 				Z_STRLEN_P(key) = str_key_len-1;
11810 				Z_TYPE_P(key) = IS_STRING;
11811 				break;
11812 			case HASH_KEY_IS_LONG:
11813 				Z_LVAL_P(key) = int_key;
11814 				Z_TYPE_P(key) = IS_LONG;
11815 				break;
11816 			default:
11817 			case HASH_KEY_NON_EXISTANT:
11818 				ZVAL_NULL(key);
11819 				break;
11820 		}
11821 	}
11822 
11823 	CHECK_EXCEPTION();
11824 	ZEND_VM_INC_OPCODE();
11825 	ZEND_VM_NEXT_OPCODE();
11826 }
11827 
ZEND_EXIT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11828 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11829 {
11830 #if 0 || (IS_VAR != IS_UNUSED)
11831 	USE_OPLINE
11832 
11833 	SAVE_OPLINE();
11834 	if (IS_VAR != IS_UNUSED) {
11835 		zend_free_op free_op1;
11836 		zval *ptr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11837 
11838 		if (Z_TYPE_P(ptr) == IS_LONG) {
11839 			EG(exit_status) = Z_LVAL_P(ptr);
11840 		} else {
11841 			zend_print_variable(ptr);
11842 		}
11843 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11844 	}
11845 #endif
11846 	zend_bailout();
11847 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
11848 }
11849 
ZEND_JMP_SET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11850 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11851 {
11852 	USE_OPLINE
11853 	zend_free_op free_op1;
11854 	zval *value;
11855 
11856 	SAVE_OPLINE();
11857 	value = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11858 
11859 	if (i_zend_is_true(value)) {
11860 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
11861 		if (!0) {
11862 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
11863 		}
11864 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11865 #if DEBUG_ZEND>=2
11866 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
11867 #endif
11868 		ZEND_VM_JMP(opline->op2.jmp_addr);
11869 	}
11870 
11871 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11872 	CHECK_EXCEPTION();
11873 	ZEND_VM_NEXT_OPCODE();
11874 }
11875 
ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11876 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11877 {
11878 	USE_OPLINE
11879 	zend_free_op free_op1;
11880 	zval *value, *ret;
11881 
11882 	SAVE_OPLINE();
11883 	value = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11884 
11885 	if (i_zend_is_true(value)) {
11886 		if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
11887 			Z_ADDREF_P(value);
11888 			EX_T(opline->result.var).var.ptr = value;
11889 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
11890 		} else {
11891 			ALLOC_ZVAL(ret);
11892 			INIT_PZVAL_COPY(ret, value);
11893 			EX_T(opline->result.var).var.ptr = ret;
11894 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
11895 			if (!0) {
11896 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
11897 			}
11898 		}
11899 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11900 #if DEBUG_ZEND>=2
11901 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
11902 #endif
11903 		ZEND_VM_JMP(opline->op2.jmp_addr);
11904 	}
11905 
11906 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11907 	CHECK_EXCEPTION();
11908 	ZEND_VM_NEXT_OPCODE();
11909 }
11910 
ZEND_QM_ASSIGN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11911 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11912 {
11913 	USE_OPLINE
11914 	zend_free_op free_op1;
11915 	zval *value;
11916 
11917 	SAVE_OPLINE();
11918 	value = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11919 
11920 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
11921 	if (!0) {
11922 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
11923 	}
11924 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11925 	CHECK_EXCEPTION();
11926 	ZEND_VM_NEXT_OPCODE();
11927 }
11928 
ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11929 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11930 {
11931 	USE_OPLINE
11932 	zend_free_op free_op1;
11933 	zval *value, *ret;
11934 
11935 	SAVE_OPLINE();
11936 	value = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11937 
11938 	if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
11939 		Z_ADDREF_P(value);
11940 		EX_T(opline->result.var).var.ptr = value;
11941 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
11942 	} else {
11943 		ALLOC_ZVAL(ret);
11944 		INIT_PZVAL_COPY(ret, value);
11945 		EX_T(opline->result.var).var.ptr = ret;
11946 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
11947 		if (!0) {
11948 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
11949 		}
11950 	}
11951 
11952 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11953 	CHECK_EXCEPTION();
11954 	ZEND_VM_NEXT_OPCODE();
11955 }
11956 
ZEND_INSTANCEOF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11957 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11958 {
11959 	USE_OPLINE
11960 	zend_free_op free_op1;
11961 	zval *expr;
11962 	zend_bool result;
11963 
11964 	SAVE_OPLINE();
11965 	expr = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
11966 
11967 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
11968 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
11969 	} else {
11970 		result = 0;
11971 	}
11972 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
11973 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11974 	CHECK_EXCEPTION();
11975 	ZEND_VM_NEXT_OPCODE();
11976 }
11977 
ZEND_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11978 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11979 {
11980 	USE_OPLINE
11981 	zend_free_op free_op1;
11982 
11983 	SAVE_OPLINE();
11984 	fast_add_function(&EX_T(opline->result.var).tmp_var,
11985 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
11986 		opline->op2.zv TSRMLS_CC);
11987 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
11988 
11989 	CHECK_EXCEPTION();
11990 	ZEND_VM_NEXT_OPCODE();
11991 }
11992 
ZEND_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11993 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11994 {
11995 	USE_OPLINE
11996 	zend_free_op free_op1;
11997 
11998 	SAVE_OPLINE();
11999 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
12000 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12001 		opline->op2.zv TSRMLS_CC);
12002 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12003 
12004 	CHECK_EXCEPTION();
12005 	ZEND_VM_NEXT_OPCODE();
12006 }
12007 
ZEND_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12008 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12009 {
12010 	USE_OPLINE
12011 	zend_free_op free_op1;
12012 
12013 	SAVE_OPLINE();
12014 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
12015 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12016 		opline->op2.zv TSRMLS_CC);
12017 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12018 
12019 	CHECK_EXCEPTION();
12020 	ZEND_VM_NEXT_OPCODE();
12021 }
12022 
ZEND_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12023 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12024 {
12025 	USE_OPLINE
12026 	zend_free_op free_op1;
12027 
12028 	SAVE_OPLINE();
12029 	fast_div_function(&EX_T(opline->result.var).tmp_var,
12030 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12031 		opline->op2.zv TSRMLS_CC);
12032 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12033 
12034 	CHECK_EXCEPTION();
12035 	ZEND_VM_NEXT_OPCODE();
12036 }
12037 
ZEND_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12038 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12039 {
12040 	USE_OPLINE
12041 	zend_free_op free_op1;
12042 
12043 	SAVE_OPLINE();
12044 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
12045 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12046 		opline->op2.zv TSRMLS_CC);
12047 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12048 
12049 	CHECK_EXCEPTION();
12050 	ZEND_VM_NEXT_OPCODE();
12051 }
12052 
ZEND_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12053 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12054 {
12055 	USE_OPLINE
12056 	zend_free_op free_op1;
12057 
12058 	SAVE_OPLINE();
12059 	shift_left_function(&EX_T(opline->result.var).tmp_var,
12060 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12061 		opline->op2.zv TSRMLS_CC);
12062 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12063 
12064 	CHECK_EXCEPTION();
12065 	ZEND_VM_NEXT_OPCODE();
12066 }
12067 
ZEND_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12068 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12069 {
12070 	USE_OPLINE
12071 	zend_free_op free_op1;
12072 
12073 	SAVE_OPLINE();
12074 	shift_right_function(&EX_T(opline->result.var).tmp_var,
12075 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12076 		opline->op2.zv TSRMLS_CC);
12077 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12078 
12079 	CHECK_EXCEPTION();
12080 	ZEND_VM_NEXT_OPCODE();
12081 }
12082 
ZEND_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12083 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12084 {
12085 	USE_OPLINE
12086 	zend_free_op free_op1;
12087 
12088 	SAVE_OPLINE();
12089 	concat_function(&EX_T(opline->result.var).tmp_var,
12090 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12091 		opline->op2.zv TSRMLS_CC);
12092 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12093 
12094 	CHECK_EXCEPTION();
12095 	ZEND_VM_NEXT_OPCODE();
12096 }
12097 
ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12098 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12099 {
12100 	USE_OPLINE
12101 	zend_free_op free_op1;
12102 
12103 	SAVE_OPLINE();
12104 	is_identical_function(&EX_T(opline->result.var).tmp_var,
12105 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12106 		opline->op2.zv TSRMLS_CC);
12107 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12108 
12109 	CHECK_EXCEPTION();
12110 	ZEND_VM_NEXT_OPCODE();
12111 }
12112 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12113 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12114 {
12115 	USE_OPLINE
12116 	zend_free_op free_op1;
12117 	zval *result = &EX_T(opline->result.var).tmp_var;
12118 
12119 	SAVE_OPLINE();
12120 	is_identical_function(result,
12121 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12122 		opline->op2.zv TSRMLS_CC);
12123 	Z_LVAL_P(result) = !Z_LVAL_P(result);
12124 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12125 
12126 	CHECK_EXCEPTION();
12127 	ZEND_VM_NEXT_OPCODE();
12128 }
12129 
ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12130 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12131 {
12132 	USE_OPLINE
12133 	zend_free_op free_op1;
12134 	zval *result = &EX_T(opline->result.var).tmp_var;
12135 
12136 	SAVE_OPLINE();
12137 	ZVAL_BOOL(result, fast_equal_function(result,
12138 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12139 		opline->op2.zv TSRMLS_CC));
12140 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12141 
12142 	CHECK_EXCEPTION();
12143 	ZEND_VM_NEXT_OPCODE();
12144 }
12145 
ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12146 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12147 {
12148 	USE_OPLINE
12149 	zend_free_op free_op1;
12150 	zval *result = &EX_T(opline->result.var).tmp_var;
12151 
12152 	SAVE_OPLINE();
12153 	ZVAL_BOOL(result, fast_not_equal_function(result,
12154 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12155 		opline->op2.zv TSRMLS_CC));
12156 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12157 
12158 	CHECK_EXCEPTION();
12159 	ZEND_VM_NEXT_OPCODE();
12160 }
12161 
ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12162 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12163 {
12164 	USE_OPLINE
12165 	zend_free_op free_op1;
12166 	zval *result = &EX_T(opline->result.var).tmp_var;
12167 
12168 	SAVE_OPLINE();
12169 	ZVAL_BOOL(result, fast_is_smaller_function(result,
12170 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12171 		opline->op2.zv TSRMLS_CC));
12172 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12173 
12174 	CHECK_EXCEPTION();
12175 	ZEND_VM_NEXT_OPCODE();
12176 }
12177 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12178 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12179 {
12180 	USE_OPLINE
12181 	zend_free_op free_op1;
12182 	zval *result = &EX_T(opline->result.var).tmp_var;
12183 
12184 	SAVE_OPLINE();
12185 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
12186 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12187 		opline->op2.zv TSRMLS_CC));
12188 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12189 
12190 	CHECK_EXCEPTION();
12191 	ZEND_VM_NEXT_OPCODE();
12192 }
12193 
ZEND_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12194 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12195 {
12196 	USE_OPLINE
12197 	zend_free_op free_op1;
12198 
12199 	SAVE_OPLINE();
12200 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
12201 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12202 		opline->op2.zv TSRMLS_CC);
12203 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12204 
12205 	CHECK_EXCEPTION();
12206 	ZEND_VM_NEXT_OPCODE();
12207 }
12208 
ZEND_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12209 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12210 {
12211 	USE_OPLINE
12212 	zend_free_op free_op1;
12213 
12214 	SAVE_OPLINE();
12215 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
12216 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12217 		opline->op2.zv TSRMLS_CC);
12218 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12219 
12220 	CHECK_EXCEPTION();
12221 	ZEND_VM_NEXT_OPCODE();
12222 }
12223 
ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12224 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12225 {
12226 	USE_OPLINE
12227 	zend_free_op free_op1;
12228 
12229 	SAVE_OPLINE();
12230 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
12231 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12232 		opline->op2.zv TSRMLS_CC);
12233 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12234 
12235 	CHECK_EXCEPTION();
12236 	ZEND_VM_NEXT_OPCODE();
12237 }
12238 
ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12239 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12240 {
12241 	USE_OPLINE
12242 	zend_free_op free_op1;
12243 
12244 	SAVE_OPLINE();
12245 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
12246 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
12247 		opline->op2.zv TSRMLS_CC);
12248 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12249 
12250 	CHECK_EXCEPTION();
12251 	ZEND_VM_NEXT_OPCODE();
12252 }
12253 
zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)12254 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
12255 {
12256 	USE_OPLINE
12257 	zend_free_op free_op1, free_op_data1;
12258 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12259 	zval *object;
12260 	zval *property = opline->op2.zv;
12261 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
12262 	int have_get_ptr = 0;
12263 
12264 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
12265 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
12266 	}
12267 
12268 	make_real_object(object_ptr TSRMLS_CC);
12269 	object = *object_ptr;
12270 
12271 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
12272 		zend_error(E_WARNING, "Attempt to assign property of non-object");
12273 
12274 		FREE_OP(free_op_data1);
12275 
12276 		if (RETURN_VALUE_USED(opline)) {
12277 			PZVAL_LOCK(&EG(uninitialized_zval));
12278 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
12279 			EX_T(opline->result.var).var.ptr_ptr = NULL;
12280 		}
12281 	} else {
12282 		/* here we are sure we are dealing with an object */
12283 		if (0) {
12284 			MAKE_REAL_ZVAL_PTR(property);
12285 		}
12286 
12287 		/* here property is a string */
12288 		if (opline->extended_value == ZEND_ASSIGN_OBJ
12289 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
12290 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12291 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
12292 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
12293 
12294 				have_get_ptr = 1;
12295 				binary_op(*zptr, *zptr, value TSRMLS_CC);
12296 				if (RETURN_VALUE_USED(opline)) {
12297 					PZVAL_LOCK(*zptr);
12298 					EX_T(opline->result.var).var.ptr = *zptr;
12299 					EX_T(opline->result.var).var.ptr_ptr = NULL;
12300 				}
12301 			}
12302 		}
12303 
12304 		if (!have_get_ptr) {
12305 			zval *z = NULL;
12306 
12307 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
12308 				if (Z_OBJ_HT_P(object)->read_property) {
12309 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12310 				}
12311 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
12312 				if (Z_OBJ_HT_P(object)->read_dimension) {
12313 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
12314 				}
12315 			}
12316 			if (z) {
12317 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
12318 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
12319 
12320 					if (Z_REFCOUNT_P(z) == 0) {
12321 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
12322 						zval_dtor(z);
12323 						FREE_ZVAL(z);
12324 					}
12325 					z = value;
12326 				}
12327 				Z_ADDREF_P(z);
12328 				SEPARATE_ZVAL_IF_NOT_REF(&z);
12329 				binary_op(z, z, value TSRMLS_CC);
12330 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
12331 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12332 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
12333 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
12334 				}
12335 				if (RETURN_VALUE_USED(opline)) {
12336 					PZVAL_LOCK(z);
12337 					EX_T(opline->result.var).var.ptr = z;
12338 					EX_T(opline->result.var).var.ptr_ptr = NULL;
12339 				}
12340 				zval_ptr_dtor(&z);
12341 			} else {
12342 				zend_error(E_WARNING, "Attempt to assign property of non-object");
12343 				if (RETURN_VALUE_USED(opline)) {
12344 					PZVAL_LOCK(&EG(uninitialized_zval));
12345 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
12346 					EX_T(opline->result.var).var.ptr_ptr = NULL;
12347 				}
12348 			}
12349 		}
12350 
12351 		if (0) {
12352 			zval_ptr_dtor(&property);
12353 		} else {
12354 
12355 		}
12356 		FREE_OP(free_op_data1);
12357 	}
12358 
12359 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12360 	/* assign_obj has two opcodes! */
12361 	CHECK_EXCEPTION();
12362 	ZEND_VM_INC_OPCODE();
12363 	ZEND_VM_NEXT_OPCODE();
12364 }
12365 
zend_binary_assign_op_helper_SPEC_VAR_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)12366 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
12367 {
12368 	USE_OPLINE
12369 	zend_free_op free_op1, free_op_data2, free_op_data1;
12370 	zval **var_ptr;
12371 	zval *value;
12372 
12373 	SAVE_OPLINE();
12374 	switch (opline->extended_value) {
12375 		case ZEND_ASSIGN_OBJ:
12376 			return zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12377 			break;
12378 		case ZEND_ASSIGN_DIM: {
12379 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12380 
12381 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
12382 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
12383 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
12384 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
12385 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
12386 					}
12387 					return zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12388 				} else {
12389 					zval *dim = opline->op2.zv;
12390 
12391 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
12392 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
12393 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
12394 				}
12395 			}
12396 			break;
12397 		default:
12398 			value = opline->op2.zv;
12399 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12400 			/* do nothing */
12401 			break;
12402 	}
12403 
12404 	if (UNEXPECTED(var_ptr == NULL)) {
12405 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
12406 	}
12407 
12408 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
12409 		if (RETURN_VALUE_USED(opline)) {
12410 			PZVAL_LOCK(&EG(uninitialized_zval));
12411 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
12412 		}
12413 
12414 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12415 		CHECK_EXCEPTION();
12416 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
12417 			ZEND_VM_INC_OPCODE();
12418 		}
12419 		ZEND_VM_NEXT_OPCODE();
12420 	}
12421 
12422 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
12423 
12424 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
12425 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
12426 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
12427 		/* proxy object */
12428 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
12429 		Z_ADDREF_P(objval);
12430 		binary_op(objval, objval, value TSRMLS_CC);
12431 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
12432 		zval_ptr_dtor(&objval);
12433 	} else {
12434 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
12435 	}
12436 
12437 	if (RETURN_VALUE_USED(opline)) {
12438 		PZVAL_LOCK(*var_ptr);
12439 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
12440 	}
12441 
12442 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
12443 		FREE_OP(free_op_data1);
12444 		FREE_OP_VAR_PTR(free_op_data2);
12445 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12446 		CHECK_EXCEPTION();
12447 		ZEND_VM_INC_OPCODE();
12448 	} else {
12449 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12450 		CHECK_EXCEPTION();
12451 	}
12452 	ZEND_VM_NEXT_OPCODE();
12453 }
12454 
ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12455 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12456 {
12457 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12458 }
12459 
ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12460 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12461 {
12462 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12463 }
12464 
ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12465 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12466 {
12467 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12468 }
12469 
ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12470 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12471 {
12472 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12473 }
12474 
ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12475 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12476 {
12477 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12478 }
12479 
ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12480 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12481 {
12482 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12483 }
12484 
ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12485 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12486 {
12487 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12488 }
12489 
ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12490 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12491 {
12492 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12493 }
12494 
ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12495 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12496 {
12497 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12498 }
12499 
ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12500 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12501 {
12502 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12503 }
12504 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12505 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12506 {
12507 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12508 }
12509 
zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)12510 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
12511 {
12512 	USE_OPLINE
12513 	zend_free_op free_op1;
12514 	zval **object_ptr;
12515 	zval *object;
12516 	zval *property;
12517 	zval **retval;
12518 	int have_get_ptr = 0;
12519 
12520 	SAVE_OPLINE();
12521 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12522 	property = opline->op2.zv;
12523 	retval = &EX_T(opline->result.var).var.ptr;
12524 
12525 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
12526 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12527 	}
12528 
12529 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
12530 	object = *object_ptr;
12531 
12532 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
12533 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
12534 
12535 		if (RETURN_VALUE_USED(opline)) {
12536 			PZVAL_LOCK(&EG(uninitialized_zval));
12537 			*retval = &EG(uninitialized_zval);
12538 		}
12539 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12540 		CHECK_EXCEPTION();
12541 		ZEND_VM_NEXT_OPCODE();
12542 	}
12543 
12544 	/* here we are sure we are dealing with an object */
12545 
12546 	if (0) {
12547 		MAKE_REAL_ZVAL_PTR(property);
12548 	}
12549 
12550 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
12551 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12552 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
12553 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
12554 
12555 			have_get_ptr = 1;
12556 			incdec_op(*zptr);
12557 			if (RETURN_VALUE_USED(opline)) {
12558 				*retval = *zptr;
12559 				PZVAL_LOCK(*retval);
12560 			}
12561 		}
12562 	}
12563 
12564 	if (!have_get_ptr) {
12565 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
12566 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12567 
12568 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
12569 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
12570 
12571 				if (Z_REFCOUNT_P(z) == 0) {
12572 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
12573 					zval_dtor(z);
12574 					FREE_ZVAL(z);
12575 				}
12576 				z = value;
12577 			}
12578 			Z_ADDREF_P(z);
12579 			SEPARATE_ZVAL_IF_NOT_REF(&z);
12580 			incdec_op(z);
12581 			*retval = z;
12582 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12583 			SELECTIVE_PZVAL_LOCK(*retval, opline);
12584 			zval_ptr_dtor(&z);
12585 		} else {
12586 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
12587 			if (RETURN_VALUE_USED(opline)) {
12588 				PZVAL_LOCK(&EG(uninitialized_zval));
12589 				*retval = &EG(uninitialized_zval);
12590 			}
12591 		}
12592 	}
12593 
12594 	if (0) {
12595 		zval_ptr_dtor(&property);
12596 	} else {
12597 
12598 	}
12599 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12600 	CHECK_EXCEPTION();
12601 	ZEND_VM_NEXT_OPCODE();
12602 }
12603 
ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12604 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12605 {
12606 	return zend_pre_incdec_property_helper_SPEC_VAR_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12607 }
12608 
ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12609 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12610 {
12611 	return zend_pre_incdec_property_helper_SPEC_VAR_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12612 }
12613 
zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)12614 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
12615 {
12616 	USE_OPLINE
12617 	zend_free_op free_op1;
12618 	zval **object_ptr;
12619 	zval *object;
12620 	zval *property;
12621 	zval *retval;
12622 	int have_get_ptr = 0;
12623 
12624 	SAVE_OPLINE();
12625 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12626 	property = opline->op2.zv;
12627 	retval = &EX_T(opline->result.var).tmp_var;
12628 
12629 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
12630 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12631 	}
12632 
12633 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
12634 	object = *object_ptr;
12635 
12636 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
12637 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
12638 
12639 		ZVAL_NULL(retval);
12640 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12641 		CHECK_EXCEPTION();
12642 		ZEND_VM_NEXT_OPCODE();
12643 	}
12644 
12645 	/* here we are sure we are dealing with an object */
12646 
12647 	if (0) {
12648 		MAKE_REAL_ZVAL_PTR(property);
12649 	}
12650 
12651 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
12652 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12653 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
12654 			have_get_ptr = 1;
12655 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
12656 
12657 			ZVAL_COPY_VALUE(retval, *zptr);
12658 			zendi_zval_copy_ctor(*retval);
12659 
12660 			incdec_op(*zptr);
12661 
12662 		}
12663 	}
12664 
12665 	if (!have_get_ptr) {
12666 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
12667 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12668 			zval *z_copy;
12669 
12670 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
12671 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
12672 
12673 				if (Z_REFCOUNT_P(z) == 0) {
12674 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
12675 					zval_dtor(z);
12676 					FREE_ZVAL(z);
12677 				}
12678 				z = value;
12679 			}
12680 			ZVAL_COPY_VALUE(retval, z);
12681 			zendi_zval_copy_ctor(*retval);
12682 			ALLOC_ZVAL(z_copy);
12683 			INIT_PZVAL_COPY(z_copy, z);
12684 			zendi_zval_copy_ctor(*z_copy);
12685 			incdec_op(z_copy);
12686 			Z_ADDREF_P(z);
12687 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
12688 			zval_ptr_dtor(&z_copy);
12689 			zval_ptr_dtor(&z);
12690 		} else {
12691 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
12692 			ZVAL_NULL(retval);
12693 		}
12694 	}
12695 
12696 	if (0) {
12697 		zval_ptr_dtor(&property);
12698 	} else {
12699 
12700 	}
12701 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12702 	CHECK_EXCEPTION();
12703 	ZEND_VM_NEXT_OPCODE();
12704 }
12705 
ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12706 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12707 {
12708 	return zend_post_incdec_property_helper_SPEC_VAR_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12709 }
12710 
ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12711 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12712 {
12713 	return zend_post_incdec_property_helper_SPEC_VAR_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12714 }
12715 
zend_fetch_var_address_helper_SPEC_VAR_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)12716 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
12717 {
12718 	USE_OPLINE
12719 	zend_free_op free_op1;
12720 	zval *varname;
12721 	zval **retval;
12722 	zval tmp_varname;
12723 	HashTable *target_symbol_table;
12724 	ulong hash_value;
12725 
12726 	SAVE_OPLINE();
12727 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12728 
12729  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
12730 		ZVAL_COPY_VALUE(&tmp_varname, varname);
12731 		zval_copy_ctor(&tmp_varname);
12732 		Z_SET_REFCOUNT(tmp_varname, 1);
12733 		Z_UNSET_ISREF(tmp_varname);
12734 		convert_to_string(&tmp_varname);
12735 		varname = &tmp_varname;
12736 	}
12737 
12738 	if (IS_CONST != IS_UNUSED) {
12739 		zend_class_entry *ce;
12740 
12741 		if (IS_CONST == IS_CONST) {
12742 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
12743 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
12744 			} else {
12745 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
12746 				if (UNEXPECTED(ce == NULL)) {
12747 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
12748 						zval_dtor(&tmp_varname);
12749 					}
12750 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12751 					CHECK_EXCEPTION();
12752 					ZEND_VM_NEXT_OPCODE();
12753 				}
12754 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
12755 			}
12756 		} else {
12757 			ce = EX_T(opline->op2.var).class_entry;
12758 		}
12759 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
12760 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12761 	} else {
12762 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
12763 /*
12764 		if (!target_symbol_table) {
12765 			CHECK_EXCEPTION();
12766 			ZEND_VM_NEXT_OPCODE();
12767 		}
12768 */
12769 		if (IS_VAR == IS_CONST) {
12770 			hash_value = Z_HASH_P(varname);
12771 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
12772 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
12773 		} else {
12774 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
12775 		}
12776 
12777 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
12778 			switch (type) {
12779 				case BP_VAR_R:
12780 				case BP_VAR_UNSET:
12781 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
12782 					/* break missing intentionally */
12783 				case BP_VAR_IS:
12784 					retval = &EG(uninitialized_zval_ptr);
12785 					break;
12786 				case BP_VAR_RW:
12787 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
12788 					/* break missing intentionally */
12789 				case BP_VAR_W:
12790 					Z_ADDREF_P(&EG(uninitialized_zval));
12791 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
12792 					break;
12793 				EMPTY_SWITCH_DEFAULT_CASE()
12794 			}
12795 		}
12796 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
12797 			case ZEND_FETCH_GLOBAL:
12798 				if (IS_VAR != IS_TMP_VAR) {
12799 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12800 				}
12801 				break;
12802 			case ZEND_FETCH_LOCAL:
12803 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12804 				break;
12805 			case ZEND_FETCH_STATIC:
12806 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
12807 				break;
12808 			case ZEND_FETCH_GLOBAL_LOCK:
12809 				if (IS_VAR == IS_VAR && !free_op1.var) {
12810 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
12811 				}
12812 				break;
12813 		}
12814 	}
12815 
12816 
12817 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
12818 		zval_dtor(&tmp_varname);
12819 	}
12820 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
12821 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
12822 	}
12823 	PZVAL_LOCK(*retval);
12824 	switch (type) {
12825 		case BP_VAR_R:
12826 		case BP_VAR_IS:
12827 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
12828 			break;
12829 		case BP_VAR_UNSET: {
12830 			zend_free_op free_res;
12831 
12832 			PZVAL_UNLOCK(*retval, &free_res);
12833 			if (retval != &EG(uninitialized_zval_ptr)) {
12834 				SEPARATE_ZVAL_IF_NOT_REF(retval);
12835 			}
12836 			PZVAL_LOCK(*retval);
12837 			FREE_OP_VAR_PTR(free_res);
12838 		}
12839 		/* break missing intentionally */
12840 		default:
12841 			EX_T(opline->result.var).var.ptr_ptr = retval;
12842 			break;
12843 	}
12844 	CHECK_EXCEPTION();
12845 	ZEND_VM_NEXT_OPCODE();
12846 }
12847 
ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12848 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12849 {
12850 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12851 }
12852 
ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12853 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12854 {
12855 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12856 }
12857 
ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12858 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12859 {
12860 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12861 }
12862 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12863 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12864 {
12865 	USE_OPLINE
12866 
12867 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12868 }
12869 
ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12870 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12871 {
12872 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12873 }
12874 
ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12875 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12876 {
12877 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12878 }
12879 
ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12880 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12881 {
12882 	USE_OPLINE
12883 	zend_free_op free_op1;
12884 	zval *container;
12885 
12886 	SAVE_OPLINE();
12887 
12888 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
12889 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
12890 	}
12891 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12892 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
12893 
12894 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12895 	CHECK_EXCEPTION();
12896 	ZEND_VM_NEXT_OPCODE();
12897 }
12898 
ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12899 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12900 {
12901 	USE_OPLINE
12902 	zend_free_op free_op1;
12903 	zval **container;
12904 
12905 	SAVE_OPLINE();
12906 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12907 
12908 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
12909 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
12910 	}
12911 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
12912 
12913 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
12914 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
12915 	}
12916 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12917 
12918 	/* We are going to assign the result by reference */
12919 	if (UNEXPECTED(opline->extended_value != 0)) {
12920 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
12921 
12922 		if (retval_ptr) {
12923 			Z_DELREF_PP(retval_ptr);
12924 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
12925 			Z_ADDREF_PP(retval_ptr);
12926 		}
12927 	}
12928 
12929 	CHECK_EXCEPTION();
12930 	ZEND_VM_NEXT_OPCODE();
12931 }
12932 
ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12933 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12934 {
12935 	USE_OPLINE
12936 	zend_free_op free_op1;
12937 	zval **container;
12938 
12939 	SAVE_OPLINE();
12940 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12941 
12942 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
12943 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
12944 	}
12945 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_RW TSRMLS_CC);
12946 
12947 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
12948 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
12949 	}
12950 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12951 	CHECK_EXCEPTION();
12952 	ZEND_VM_NEXT_OPCODE();
12953 }
12954 
ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12955 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12956 {
12957 	USE_OPLINE
12958 	zend_free_op free_op1;
12959 	zval *container;
12960 
12961 	SAVE_OPLINE();
12962 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12963 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_IS TSRMLS_CC);
12964 
12965 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12966 	CHECK_EXCEPTION();
12967 	ZEND_VM_NEXT_OPCODE();
12968 }
12969 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12970 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12971 {
12972 	USE_OPLINE
12973 	zend_free_op free_op1;
12974 
12975 	SAVE_OPLINE();
12976 
12977 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
12978 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12979 
12980 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
12981 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
12982 		}
12983 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
12984 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
12985 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
12986 		}
12987 
12988 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12989 	} else {
12990 		zval *container;
12991 
12992 		if (IS_CONST == IS_UNUSED) {
12993 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
12994 		}
12995 		container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
12996 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
12997 
12998 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12999 	}
13000 	CHECK_EXCEPTION();
13001 	ZEND_VM_NEXT_OPCODE();
13002 }
13003 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13004 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13005 {
13006 	USE_OPLINE
13007 	zend_free_op free_op1;
13008 	zval **container;
13009 
13010 	SAVE_OPLINE();
13011 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13012 
13013 	if (IS_VAR == IS_CV) {
13014 		if (container != &EG(uninitialized_zval_ptr)) {
13015 			SEPARATE_ZVAL_IF_NOT_REF(container);
13016 		}
13017 	}
13018 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
13019 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
13020 	}
13021 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_UNSET TSRMLS_CC);
13022 
13023 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
13024 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
13025 	}
13026 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13027 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
13028 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
13029 	} else {
13030 		zend_free_op free_res;
13031 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
13032 
13033 		PZVAL_UNLOCK(*retval_ptr, &free_res);
13034 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
13035 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
13036 		}
13037 		PZVAL_LOCK(*retval_ptr);
13038 		FREE_OP_VAR_PTR(free_res);
13039 		CHECK_EXCEPTION();
13040 		ZEND_VM_NEXT_OPCODE();
13041 	}
13042 }
13043 
zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS)13044 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS)
13045 {
13046 	USE_OPLINE
13047 	zend_free_op free_op1;
13048 	zval *container;
13049 
13050 	zval *offset;
13051 
13052 	SAVE_OPLINE();
13053 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13054 	offset  = opline->op2.zv;
13055 
13056 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
13057 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
13058 		zend_error(E_NOTICE, "Trying to get property of non-object");
13059 		PZVAL_LOCK(&EG(uninitialized_zval));
13060 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13061 
13062 	} else {
13063 		zval *retval;
13064 
13065 		if (0) {
13066 			MAKE_REAL_ZVAL_PTR(offset);
13067 		}
13068 
13069 		/* here we are sure we are dealing with an object */
13070 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
13071 
13072 		PZVAL_LOCK(retval);
13073 		AI_SET_PTR(&EX_T(opline->result.var), retval);
13074 
13075 		if (0) {
13076 			zval_ptr_dtor(&offset);
13077 		} else {
13078 
13079 		}
13080 	}
13081 
13082 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13083 	CHECK_EXCEPTION();
13084 	ZEND_VM_NEXT_OPCODE();
13085 }
13086 
ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13087 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13088 {
13089 	return zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13090 }
13091 
ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13092 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13093 {
13094 	USE_OPLINE
13095 	zend_free_op free_op1;
13096 	zval *property;
13097 	zval **container;
13098 
13099 	SAVE_OPLINE();
13100 	property = opline->op2.zv;
13101 
13102 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
13103 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
13104 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
13105 	}
13106 
13107 	if (0) {
13108 		MAKE_REAL_ZVAL_PTR(property);
13109 	}
13110 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13111 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
13112 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
13113 	}
13114 
13115 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
13116 	if (0) {
13117 		zval_ptr_dtor(&property);
13118 	} else {
13119 
13120 	}
13121 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
13122 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
13123 	}
13124 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13125 
13126 	/* We are going to assign the result by reference */
13127 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
13128 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
13129 
13130 		Z_DELREF_PP(retval_ptr);
13131 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
13132 		Z_ADDREF_PP(retval_ptr);
13133 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
13134 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13135 	}
13136 
13137 	CHECK_EXCEPTION();
13138 	ZEND_VM_NEXT_OPCODE();
13139 }
13140 
ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13141 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13142 {
13143 	USE_OPLINE
13144 	zend_free_op free_op1;
13145 	zval *property;
13146 	zval **container;
13147 
13148 	SAVE_OPLINE();
13149 	property = opline->op2.zv;
13150 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13151 
13152 	if (0) {
13153 		MAKE_REAL_ZVAL_PTR(property);
13154 	}
13155 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
13156 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
13157 	}
13158 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
13159 	if (0) {
13160 		zval_ptr_dtor(&property);
13161 	} else {
13162 
13163 	}
13164 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
13165 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
13166 	}
13167 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13168 	CHECK_EXCEPTION();
13169 	ZEND_VM_NEXT_OPCODE();
13170 }
13171 
ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13172 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13173 {
13174 	USE_OPLINE
13175 	zend_free_op free_op1;
13176 	zval *container;
13177 
13178 	zval *offset;
13179 
13180 	SAVE_OPLINE();
13181 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13182 	offset  = opline->op2.zv;
13183 
13184 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
13185 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
13186 		PZVAL_LOCK(&EG(uninitialized_zval));
13187 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13188 
13189 	} else {
13190 		zval *retval;
13191 
13192 		if (0) {
13193 			MAKE_REAL_ZVAL_PTR(offset);
13194 		}
13195 
13196 		/* here we are sure we are dealing with an object */
13197 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
13198 
13199 		PZVAL_LOCK(retval);
13200 		AI_SET_PTR(&EX_T(opline->result.var), retval);
13201 
13202 		if (0) {
13203 			zval_ptr_dtor(&offset);
13204 		} else {
13205 
13206 		}
13207 	}
13208 
13209 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13210 	CHECK_EXCEPTION();
13211 	ZEND_VM_NEXT_OPCODE();
13212 }
13213 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13214 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13215 {
13216 	USE_OPLINE
13217 
13218 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
13219 		/* Behave like FETCH_OBJ_W */
13220 		zend_free_op free_op1;
13221 		zval *property;
13222 		zval **container;
13223 
13224 		SAVE_OPLINE();
13225 		property = opline->op2.zv;
13226 		container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13227 
13228 		if (0) {
13229 			MAKE_REAL_ZVAL_PTR(property);
13230 		}
13231 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
13232 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
13233 		}
13234 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
13235 		if (0) {
13236 			zval_ptr_dtor(&property);
13237 		} else {
13238 
13239 		}
13240 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
13241 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
13242 		}
13243 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13244 		CHECK_EXCEPTION();
13245 		ZEND_VM_NEXT_OPCODE();
13246 	} else {
13247 		return zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13248 	}
13249 }
13250 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13251 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13252 {
13253 	USE_OPLINE
13254 	zend_free_op free_op1, free_res;
13255 	zval **container;
13256 	zval *property;
13257 
13258 	SAVE_OPLINE();
13259 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13260 	property = opline->op2.zv;
13261 
13262 	if (IS_VAR == IS_CV) {
13263 		if (container != &EG(uninitialized_zval_ptr)) {
13264 			SEPARATE_ZVAL_IF_NOT_REF(container);
13265 		}
13266 	}
13267 	if (0) {
13268 		MAKE_REAL_ZVAL_PTR(property);
13269 	}
13270 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
13271 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
13272 	}
13273 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
13274 	if (0) {
13275 		zval_ptr_dtor(&property);
13276 	} else {
13277 
13278 	}
13279 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
13280 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
13281 	}
13282 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13283 
13284 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
13285 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
13286 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
13287 	}
13288 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
13289 	FREE_OP_VAR_PTR(free_res);
13290 	CHECK_EXCEPTION();
13291 	ZEND_VM_NEXT_OPCODE();
13292 }
13293 
ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13294 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13295 {
13296 	USE_OPLINE
13297 	zend_free_op free_op1;
13298 	zval **object_ptr;
13299 	zval *property_name;
13300 
13301 	SAVE_OPLINE();
13302 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13303 	property_name = opline->op2.zv;
13304 
13305 	if (0) {
13306 		MAKE_REAL_ZVAL_PTR(property_name);
13307 	}
13308 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
13309 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
13310 	}
13311 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
13312 	if (0) {
13313 		zval_ptr_dtor(&property_name);
13314 	} else {
13315 
13316 	}
13317 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13318 	/* assign_obj has two opcodes! */
13319 	CHECK_EXCEPTION();
13320 	ZEND_VM_INC_OPCODE();
13321 	ZEND_VM_NEXT_OPCODE();
13322 }
13323 
ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13324 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13325 {
13326 	USE_OPLINE
13327 	zend_free_op free_op1;
13328 	zval **object_ptr;
13329 
13330 	SAVE_OPLINE();
13331 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13332 
13333 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
13334 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
13335 	}
13336 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
13337 
13338 		zval *property_name = opline->op2.zv;
13339 
13340 		if (0) {
13341 			MAKE_REAL_ZVAL_PTR(property_name);
13342 		}
13343 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
13344 		if (0) {
13345 			zval_ptr_dtor(&property_name);
13346 		} else {
13347 
13348 		}
13349 	} else {
13350 		zend_free_op free_op_data1, free_op_data2;
13351 		zval *value;
13352 		zval *dim = opline->op2.zv;
13353 		zval **variable_ptr_ptr;
13354 
13355 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CONST, BP_VAR_W TSRMLS_CC);
13356 
13357 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
13358 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
13359 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
13360 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
13361 				if (RETURN_VALUE_USED(opline)) {
13362 					zval *retval;
13363 
13364 					ALLOC_ZVAL(retval);
13365 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
13366 					INIT_PZVAL(retval);
13367 					AI_SET_PTR(&EX_T(opline->result.var), retval);
13368 				}
13369 			} else if (RETURN_VALUE_USED(opline)) {
13370 				PZVAL_LOCK(&EG(uninitialized_zval));
13371 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13372 			}
13373 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
13374 			if (IS_TMP_FREE(free_op_data1)) {
13375 				zval_dtor(value);
13376 			}
13377 			if (RETURN_VALUE_USED(opline)) {
13378 				PZVAL_LOCK(&EG(uninitialized_zval));
13379 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13380 			}
13381 		} else {
13382 			if ((opline+1)->op1_type == IS_TMP_VAR) {
13383 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13384 			} else if ((opline+1)->op1_type == IS_CONST) {
13385 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13386 			} else {
13387 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13388 			}
13389 			if (RETURN_VALUE_USED(opline)) {
13390 				PZVAL_LOCK(value);
13391 				AI_SET_PTR(&EX_T(opline->result.var), value);
13392 			}
13393 		}
13394 		FREE_OP_VAR_PTR(free_op_data2);
13395 	 	FREE_OP_IF_VAR(free_op_data1);
13396 	}
13397  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13398 	/* assign_dim has two opcodes! */
13399 	CHECK_EXCEPTION();
13400 	ZEND_VM_INC_OPCODE();
13401 	ZEND_VM_NEXT_OPCODE();
13402 }
13403 
ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13404 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13405 {
13406 	USE_OPLINE
13407 	zend_free_op free_op1;
13408 	zval *value;
13409 	zval **variable_ptr_ptr;
13410 
13411 	SAVE_OPLINE();
13412 	value = opline->op2.zv;
13413 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13414 
13415 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
13416 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CONST TSRMLS_CC)) {
13417 			if (RETURN_VALUE_USED(opline)) {
13418 				zval *retval;
13419 
13420 				ALLOC_ZVAL(retval);
13421 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
13422 				INIT_PZVAL(retval);
13423 				AI_SET_PTR(&EX_T(opline->result.var), retval);
13424 			}
13425 		} else if (RETURN_VALUE_USED(opline)) {
13426 			PZVAL_LOCK(&EG(uninitialized_zval));
13427 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13428 		}
13429 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
13430 		if (0) {
13431 			zval_dtor(value);
13432 		}
13433 		if (RETURN_VALUE_USED(opline)) {
13434 			PZVAL_LOCK(&EG(uninitialized_zval));
13435 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
13436 		}
13437 	} else {
13438 		if (IS_CONST == IS_TMP_VAR) {
13439 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13440 		} else if (IS_CONST == IS_CONST) {
13441 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13442 		} else {
13443 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
13444 		}
13445 		if (RETURN_VALUE_USED(opline)) {
13446 			PZVAL_LOCK(value);
13447 			AI_SET_PTR(&EX_T(opline->result.var), value);
13448 		}
13449 	}
13450 
13451 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13452 
13453 	/* zend_assign_to_variable() always takes care of op2, never free it! */
13454 
13455 	CHECK_EXCEPTION();
13456 	ZEND_VM_NEXT_OPCODE();
13457 }
13458 
ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13459 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13460 {
13461 	USE_OPLINE
13462 	zval *function_name;
13463 	char *function_name_strval;
13464 	int function_name_strlen;
13465 	zend_free_op free_op1;
13466 
13467 	SAVE_OPLINE();
13468 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
13469 
13470 	function_name = opline->op2.zv;
13471 
13472 	if (IS_CONST != IS_CONST &&
13473 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
13474 		zend_error_noreturn(E_ERROR, "Method name must be a string");
13475 	}
13476 
13477 	function_name_strval = Z_STRVAL_P(function_name);
13478 	function_name_strlen = Z_STRLEN_P(function_name);
13479 
13480 	EX(object) = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13481 
13482 	if (EXPECTED(EX(object) != NULL) &&
13483 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
13484 		EX(called_scope) = Z_OBJCE_P(EX(object));
13485 
13486 		if (IS_CONST != IS_CONST ||
13487 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
13488 		    zval *object = EX(object);
13489 
13490 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
13491 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
13492 			}
13493 
13494 			/* First, locate the function. */
13495 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
13496 			if (UNEXPECTED(EX(fbc) == NULL)) {
13497 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
13498 			}
13499 			if (IS_CONST == IS_CONST &&
13500 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
13501 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
13502 			    EXPECTED(EX(object) == object)) {
13503 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
13504 			}
13505 		}
13506 	} else {
13507 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
13508 	}
13509 
13510 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
13511 		EX(object) = NULL;
13512 	} else {
13513 		if (!PZVAL_IS_REF(EX(object))) {
13514 			Z_ADDREF_P(EX(object)); /* For $this pointer */
13515 		} else {
13516 			zval *this_ptr;
13517 			ALLOC_ZVAL(this_ptr);
13518 			INIT_PZVAL_COPY(this_ptr, EX(object));
13519 			zval_copy_ctor(this_ptr);
13520 			EX(object) = this_ptr;
13521 		}
13522 	}
13523 
13524 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13525 
13526 	CHECK_EXCEPTION();
13527 	ZEND_VM_NEXT_OPCODE();
13528 }
13529 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13530 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13531 {
13532 	USE_OPLINE
13533 	zval *function_name;
13534 	zend_class_entry *ce;
13535 
13536 	SAVE_OPLINE();
13537 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
13538 
13539 	if (IS_VAR == IS_CONST) {
13540 		/* no function found. try a static method in class */
13541 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
13542 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
13543 		} else {
13544 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
13545 			if (UNEXPECTED(EG(exception) != NULL)) {
13546 				HANDLE_EXCEPTION();
13547 			}
13548 			if (UNEXPECTED(ce == NULL)) {
13549 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
13550 			}
13551 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
13552 		}
13553 		EX(called_scope) = ce;
13554 	} else {
13555 		ce = EX_T(opline->op1.var).class_entry;
13556 
13557 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
13558 			EX(called_scope) = EG(called_scope);
13559 		} else {
13560 			EX(called_scope) = ce;
13561 		}
13562 	}
13563 
13564 	if (IS_VAR == IS_CONST &&
13565 	    IS_CONST == IS_CONST &&
13566 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
13567 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
13568 	} else if (IS_VAR != IS_CONST &&
13569 	           IS_CONST == IS_CONST &&
13570 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
13571 		/* do nothing */
13572 	} else if (IS_CONST != IS_UNUSED) {
13573 		char *function_name_strval = NULL;
13574 		int function_name_strlen = 0;
13575 
13576 
13577 		if (IS_CONST == IS_CONST) {
13578 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
13579 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
13580 		} else {
13581 			function_name = opline->op2.zv;
13582 
13583 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
13584 				zend_error_noreturn(E_ERROR, "Function name must be a string");
13585 			} else {
13586 				function_name_strval = Z_STRVAL_P(function_name);
13587 				function_name_strlen = Z_STRLEN_P(function_name);
13588  			}
13589 		}
13590 
13591 		if (function_name_strval) {
13592 			if (ce->get_static_method) {
13593 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
13594 			} else {
13595 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
13596 			}
13597 			if (UNEXPECTED(EX(fbc) == NULL)) {
13598 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
13599 			}
13600 			if (IS_CONST == IS_CONST &&
13601 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
13602 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
13603 				if (IS_VAR == IS_CONST) {
13604 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
13605 				} else {
13606 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
13607 				}
13608 			}
13609 		}
13610 		if (IS_CONST != IS_CONST) {
13611 
13612 		}
13613 	} else {
13614 		if (UNEXPECTED(ce->constructor == NULL)) {
13615 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
13616 		}
13617 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
13618 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
13619 		}
13620 		EX(fbc) = ce->constructor;
13621 	}
13622 
13623 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
13624 		EX(object) = NULL;
13625 	} else {
13626 		if (EG(This) &&
13627 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
13628 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
13629 		    /* We are calling method of the other (incompatible) class,
13630 		       but passing $this. This is done for compatibility with php-4. */
13631 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
13632 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
13633 			} else {
13634 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
13635 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
13636 			}
13637 		}
13638 		if ((EX(object) = EG(This))) {
13639 			Z_ADDREF_P(EX(object));
13640 			EX(called_scope) = Z_OBJCE_P(EX(object));
13641 		}
13642 	}
13643 
13644 	CHECK_EXCEPTION();
13645 	ZEND_VM_NEXT_OPCODE();
13646 }
13647 
ZEND_CASE_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13648 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13649 {
13650 	USE_OPLINE
13651 	zend_free_op free_op1;
13652 
13653 	SAVE_OPLINE();
13654 	if (IS_VAR==IS_VAR) {
13655 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
13656 	}
13657 	is_equal_function(&EX_T(opline->result.var).tmp_var,
13658 				 _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
13659 				 opline->op2.zv TSRMLS_CC);
13660 
13661 	CHECK_EXCEPTION();
13662 	ZEND_VM_NEXT_OPCODE();
13663 }
13664 
ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13665 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13666 {
13667 	USE_OPLINE
13668 
13669 	SAVE_OPLINE();
13670 	if (IS_VAR == IS_UNUSED) {
13671 		zend_constant *c;
13672 		zval *retval;
13673 
13674 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
13675 			c = CACHED_PTR(opline->op2.literal->cache_slot);
13676 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
13677 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
13678 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
13679 				if(!actual) {
13680 					actual = Z_STRVAL_P(opline->op2.zv);
13681 				} else {
13682 					actual++;
13683 				}
13684 				/* non-qualified constant - allow text substitution */
13685 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
13686 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
13687 				CHECK_EXCEPTION();
13688 				ZEND_VM_NEXT_OPCODE();
13689 			} else {
13690 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
13691 			}
13692 		} else {
13693 			CACHE_PTR(opline->op2.literal->cache_slot, c);
13694 		}
13695 		retval = &EX_T(opline->result.var).tmp_var;
13696 		ZVAL_COPY_VALUE(retval, &c->value);
13697 		zval_copy_ctor(retval);
13698 		CHECK_EXCEPTION();
13699 		ZEND_VM_NEXT_OPCODE();
13700 	} else {
13701 		/* class constant */
13702 		zend_class_entry *ce;
13703 		zval **value;
13704 
13705 		if (IS_VAR == IS_CONST) {
13706 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
13707 				value = CACHED_PTR(opline->op2.literal->cache_slot);
13708 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
13709 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
13710 				CHECK_EXCEPTION();
13711 				ZEND_VM_NEXT_OPCODE();
13712 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
13713 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
13714 			} else {
13715 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
13716 				if (UNEXPECTED(EG(exception) != NULL)) {
13717 					HANDLE_EXCEPTION();
13718 				}
13719 				if (UNEXPECTED(ce == NULL)) {
13720 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
13721 				}
13722 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
13723 			}
13724 		} else {
13725 			ce = EX_T(opline->op1.var).class_entry;
13726 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
13727 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
13728 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
13729 				CHECK_EXCEPTION();
13730 				ZEND_VM_NEXT_OPCODE();
13731 			}
13732 		}
13733 
13734 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
13735 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
13736 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
13737 				zend_class_entry *old_scope = EG(scope);
13738 
13739 				EG(scope) = ce;
13740 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
13741 				EG(scope) = old_scope;
13742 			}
13743 			if (IS_VAR == IS_CONST) {
13744 				CACHE_PTR(opline->op2.literal->cache_slot, value);
13745 			} else {
13746 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
13747 			}
13748 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
13749 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
13750 		} else {
13751 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
13752 		}
13753 
13754 		CHECK_EXCEPTION();
13755 		ZEND_VM_NEXT_OPCODE();
13756 	}
13757 }
13758 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13759 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13760 {
13761 	USE_OPLINE
13762 	zend_free_op free_op1;
13763 	zval *expr_ptr;
13764 
13765 	SAVE_OPLINE();
13766 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
13767 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13768 
13769 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
13770 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
13771 		}
13772 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
13773 		expr_ptr = *expr_ptr_ptr;
13774 		Z_ADDREF_P(expr_ptr);
13775 	} else {
13776 		expr_ptr=_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13777 		if (0) { /* temporary variable */
13778 			zval *new_expr;
13779 
13780 			ALLOC_ZVAL(new_expr);
13781 			INIT_PZVAL_COPY(new_expr, expr_ptr);
13782 			expr_ptr = new_expr;
13783 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
13784 			zval *new_expr;
13785 
13786 			ALLOC_ZVAL(new_expr);
13787 			INIT_PZVAL_COPY(new_expr, expr_ptr);
13788 			expr_ptr = new_expr;
13789 			zendi_zval_copy_ctor(*expr_ptr);
13790 		} else {
13791 			Z_ADDREF_P(expr_ptr);
13792 		}
13793 	}
13794 
13795 	if (IS_CONST != IS_UNUSED) {
13796 
13797 		zval *offset = opline->op2.zv;
13798 		ulong hval;
13799 
13800 		switch (Z_TYPE_P(offset)) {
13801 			case IS_DOUBLE:
13802 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
13803 				goto num_index;
13804 			case IS_LONG:
13805 			case IS_BOOL:
13806 				hval = Z_LVAL_P(offset);
13807 num_index:
13808 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
13809 				break;
13810 			case IS_STRING:
13811 				if (IS_CONST == IS_CONST) {
13812 					hval = Z_HASH_P(offset);
13813 				} else {
13814 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
13815 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
13816 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
13817 					} else {
13818 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
13819 					}
13820 				}
13821 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
13822 				break;
13823 			case IS_NULL:
13824 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
13825 				break;
13826 			default:
13827 				zend_error(E_WARNING, "Illegal offset type");
13828 				zval_ptr_dtor(&expr_ptr);
13829 				/* do nothing */
13830 				break;
13831 		}
13832 
13833 	} else {
13834 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
13835 	}
13836 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
13837 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13838 	} else {
13839 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13840 	}
13841 	CHECK_EXCEPTION();
13842 	ZEND_VM_NEXT_OPCODE();
13843 }
13844 
ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13845 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13846 {
13847 	USE_OPLINE
13848 
13849 	array_init(&EX_T(opline->result.var).tmp_var);
13850 	if (IS_VAR == IS_UNUSED) {
13851 		ZEND_VM_NEXT_OPCODE();
13852 #if 0 || IS_VAR != IS_UNUSED
13853 	} else {
13854 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13855 #endif
13856 	}
13857 }
13858 
ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13859 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13860 {
13861 	USE_OPLINE
13862 	zval tmp, *varname;
13863 	HashTable *target_symbol_table;
13864 	zend_free_op free_op1;
13865 
13866 	SAVE_OPLINE();
13867 	if (IS_VAR == IS_CV &&
13868 	    IS_CONST == IS_UNUSED &&
13869 	    (opline->extended_value & ZEND_QUICK_SET)) {
13870 		if (EG(active_symbol_table)) {
13871 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
13872 
13873 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
13874 			EX_CV(opline->op1.var) = NULL;
13875 		} else if (EX_CV(opline->op1.var)) {
13876 			zval_ptr_dtor(EX_CV(opline->op1.var));
13877 			EX_CV(opline->op1.var) = NULL;
13878 		}
13879 		CHECK_EXCEPTION();
13880 		ZEND_VM_NEXT_OPCODE();
13881 	}
13882 
13883 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13884 
13885 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
13886 		ZVAL_COPY_VALUE(&tmp, varname);
13887 		zval_copy_ctor(&tmp);
13888 		convert_to_string(&tmp);
13889 		varname = &tmp;
13890 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
13891 		Z_ADDREF_P(varname);
13892 	}
13893 
13894 	if (IS_CONST != IS_UNUSED) {
13895 		zend_class_entry *ce;
13896 
13897 		if (IS_CONST == IS_CONST) {
13898 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
13899 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
13900 			} else {
13901 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
13902 				if (UNEXPECTED(EG(exception) != NULL)) {
13903 					if (IS_VAR != IS_CONST && varname == &tmp) {
13904 						zval_dtor(&tmp);
13905 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
13906 						zval_ptr_dtor(&varname);
13907 					}
13908 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13909 					HANDLE_EXCEPTION();
13910 				}
13911 				if (UNEXPECTED(ce == NULL)) {
13912 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
13913 				}
13914 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
13915 			}
13916 		} else {
13917 			ce = EX_T(opline->op2.var).class_entry;
13918 		}
13919 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
13920 	} else {
13921 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
13922 
13923 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
13924 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
13925 	}
13926 
13927 	if (IS_VAR != IS_CONST && varname == &tmp) {
13928 		zval_dtor(&tmp);
13929 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
13930 		zval_ptr_dtor(&varname);
13931 	}
13932 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13933 	CHECK_EXCEPTION();
13934 	ZEND_VM_NEXT_OPCODE();
13935 }
13936 
ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13937 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13938 {
13939 	USE_OPLINE
13940 	zend_free_op free_op1;
13941 	zval **container;
13942 	zval *offset;
13943 	ulong hval;
13944 
13945 	SAVE_OPLINE();
13946 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
13947 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
13948 		SEPARATE_ZVAL_IF_NOT_REF(container);
13949 	}
13950 	offset = opline->op2.zv;
13951 
13952 	if (IS_VAR != IS_VAR || container) {
13953 		switch (Z_TYPE_PP(container)) {
13954 			case IS_ARRAY: {
13955 				HashTable *ht = Z_ARRVAL_PP(container);
13956 
13957 				switch (Z_TYPE_P(offset)) {
13958 					case IS_DOUBLE:
13959 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
13960 						zend_hash_index_del(ht, hval);
13961 						break;
13962 					case IS_RESOURCE:
13963 					case IS_BOOL:
13964 					case IS_LONG:
13965 						hval = Z_LVAL_P(offset);
13966 						zend_hash_index_del(ht, hval);
13967 						break;
13968 					case IS_STRING:
13969 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
13970 							Z_ADDREF_P(offset);
13971 						}
13972 						if (IS_CONST == IS_CONST) {
13973 							hval = Z_HASH_P(offset);
13974 						} else {
13975 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
13976 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
13977 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
13978 							} else {
13979 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
13980 							}
13981 						}
13982 						if (ht == &EG(symbol_table)) {
13983 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
13984 						} else {
13985 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
13986 						}
13987 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
13988 							zval_ptr_dtor(&offset);
13989 						}
13990 						break;
13991 num_index_dim:
13992 						zend_hash_index_del(ht, hval);
13993 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
13994 							zval_ptr_dtor(&offset);
13995 						}
13996 						break;
13997 					case IS_NULL:
13998 						zend_hash_del(ht, "", sizeof(""));
13999 						break;
14000 					default:
14001 						zend_error(E_WARNING, "Illegal offset type in unset");
14002 						break;
14003 				}
14004 
14005 				break;
14006 			}
14007 			case IS_OBJECT:
14008 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
14009 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
14010 				}
14011 				if (0) {
14012 					MAKE_REAL_ZVAL_PTR(offset);
14013 				}
14014 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
14015 				if (0) {
14016 					zval_ptr_dtor(&offset);
14017 				} else {
14018 
14019 				}
14020 				break;
14021 			case IS_STRING:
14022 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
14023 				ZEND_VM_CONTINUE(); /* bailed out before */
14024 			default:
14025 
14026 				break;
14027 		}
14028 	} else {
14029 
14030 	}
14031 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14032 
14033 	CHECK_EXCEPTION();
14034 	ZEND_VM_NEXT_OPCODE();
14035 }
14036 
ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14037 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14038 {
14039 	USE_OPLINE
14040 	zend_free_op free_op1;
14041 	zval **container;
14042 	zval *offset;
14043 
14044 	SAVE_OPLINE();
14045 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14046 	offset = opline->op2.zv;
14047 
14048 	if (IS_VAR != IS_VAR || container) {
14049 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
14050 			SEPARATE_ZVAL_IF_NOT_REF(container);
14051 		}
14052 		if (Z_TYPE_PP(container) == IS_OBJECT) {
14053 			if (0) {
14054 				MAKE_REAL_ZVAL_PTR(offset);
14055 			}
14056 			if (Z_OBJ_HT_P(*container)->unset_property) {
14057 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14058 			} else {
14059 				zend_error(E_NOTICE, "Trying to unset property of non-object");
14060 			}
14061 			if (0) {
14062 				zval_ptr_dtor(&offset);
14063 			} else {
14064 
14065 			}
14066 		} else {
14067 
14068 		}
14069 	} else {
14070 
14071 	}
14072 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14073 
14074 	CHECK_EXCEPTION();
14075 	ZEND_VM_NEXT_OPCODE();
14076 }
14077 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14078 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14079 {
14080 	USE_OPLINE
14081 	zval **value;
14082 	zend_bool isset = 1;
14083 
14084 	SAVE_OPLINE();
14085 	if (IS_VAR == IS_CV &&
14086 	    IS_CONST == IS_UNUSED &&
14087 	    (opline->extended_value & ZEND_QUICK_SET)) {
14088 		if (EX_CV(opline->op1.var)) {
14089 			value = EX_CV(opline->op1.var);
14090 		} else if (EG(active_symbol_table)) {
14091 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
14092 
14093 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
14094 				isset = 0;
14095 			}
14096 		} else {
14097 			isset = 0;
14098 		}
14099 	} else {
14100 		HashTable *target_symbol_table;
14101 		zend_free_op free_op1;
14102 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14103 
14104 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
14105 			ZVAL_COPY_VALUE(&tmp, varname);
14106 			zval_copy_ctor(&tmp);
14107 			convert_to_string(&tmp);
14108 			varname = &tmp;
14109 		}
14110 
14111 		if (IS_CONST != IS_UNUSED) {
14112 			zend_class_entry *ce;
14113 
14114 			if (IS_CONST == IS_CONST) {
14115 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
14116 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
14117 				} else {
14118 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
14119 					if (UNEXPECTED(ce == NULL)) {
14120 						CHECK_EXCEPTION();
14121 						ZEND_VM_NEXT_OPCODE();
14122 					}
14123 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
14124 				}
14125 			} else {
14126 				ce = EX_T(opline->op2.var).class_entry;
14127 			}
14128 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
14129 			if (!value) {
14130 				isset = 0;
14131 			}
14132 		} else {
14133 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
14134 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
14135 				isset = 0;
14136 			}
14137 		}
14138 
14139 		if (IS_VAR != IS_CONST && varname == &tmp) {
14140 			zval_dtor(&tmp);
14141 		}
14142 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14143 	}
14144 
14145 	if (opline->extended_value & ZEND_ISSET) {
14146 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
14147 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
14148 		} else {
14149 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
14150 		}
14151 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
14152 		if (!isset || !i_zend_is_true(*value)) {
14153 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
14154 		} else {
14155 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
14156 		}
14157 	}
14158 
14159 	CHECK_EXCEPTION();
14160 	ZEND_VM_NEXT_OPCODE();
14161 }
14162 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)14163 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
14164 {
14165 	USE_OPLINE
14166 	zend_free_op free_op1;
14167 	zval **container;
14168 	zval **value = NULL;
14169 	int result = 0;
14170 	ulong hval;
14171 	zval *offset;
14172 
14173 	SAVE_OPLINE();
14174 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14175 
14176 	offset = opline->op2.zv;
14177 
14178 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
14179 		HashTable *ht;
14180 		int isset = 0;
14181 
14182 		ht = Z_ARRVAL_PP(container);
14183 
14184 		switch (Z_TYPE_P(offset)) {
14185 			case IS_DOUBLE:
14186 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
14187 				goto num_index_prop;
14188 			case IS_RESOURCE:
14189 			case IS_BOOL:
14190 			case IS_LONG:
14191 				hval = Z_LVAL_P(offset);
14192 num_index_prop:
14193 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
14194 					isset = 1;
14195 				}
14196 				break;
14197 			case IS_STRING:
14198 				if (IS_CONST == IS_CONST) {
14199 					hval = Z_HASH_P(offset);
14200 				} else {
14201 					if (!prop_dim) {
14202 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
14203 					}
14204 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
14205 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
14206 					} else {
14207 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
14208 					}
14209 				}
14210 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
14211 					isset = 1;
14212 				}
14213 				break;
14214 			case IS_NULL:
14215 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
14216 					isset = 1;
14217 				}
14218 				break;
14219 			default:
14220 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
14221 				break;
14222 		}
14223 
14224 		if (opline->extended_value & ZEND_ISSET) {
14225 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
14226 				result = 0;
14227 			} else {
14228 				result = isset;
14229 			}
14230 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
14231 			if (!isset || !i_zend_is_true(*value)) {
14232 				result = 0;
14233 			} else {
14234 				result = 1;
14235 			}
14236 		}
14237 
14238 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
14239 		if (0) {
14240 			MAKE_REAL_ZVAL_PTR(offset);
14241 		}
14242 		if (prop_dim) {
14243 			if (Z_OBJ_HT_P(*container)->has_property) {
14244 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14245 			} else {
14246 				zend_error(E_NOTICE, "Trying to check property of non-object");
14247 				result = 0;
14248 			}
14249 		} else {
14250 			if (Z_OBJ_HT_P(*container)->has_dimension) {
14251 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
14252 			} else {
14253 				zend_error(E_NOTICE, "Trying to check element of non-array");
14254 				result = 0;
14255 			}
14256 		}
14257 		if (0) {
14258 			zval_ptr_dtor(&offset);
14259 		} else {
14260 
14261 		}
14262 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
14263 		zval tmp;
14264 
14265 		if (Z_TYPE_P(offset) != IS_LONG) {
14266 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
14267 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
14268 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
14269 				ZVAL_COPY_VALUE(&tmp, offset);
14270 				zval_copy_ctor(&tmp);
14271 				convert_to_long(&tmp);
14272 				offset = &tmp;
14273 			} else {
14274 				/* can not be converted to proper offset, return "not set" */
14275 				result = 0;
14276 			}
14277 		}
14278 		if (Z_TYPE_P(offset) == IS_LONG) {
14279 			if (opline->extended_value & ZEND_ISSET) {
14280 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
14281 					result = 1;
14282 				}
14283 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
14284 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
14285 					result = 1;
14286 				}
14287 			}
14288 		}
14289 
14290 	} else {
14291 
14292 	}
14293 
14294 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
14295 	if (opline->extended_value & ZEND_ISSET) {
14296 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
14297 	} else {
14298 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
14299 	}
14300 
14301 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14302 
14303 	CHECK_EXCEPTION();
14304 	ZEND_VM_NEXT_OPCODE();
14305 }
14306 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14307 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14308 {
14309 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14310 }
14311 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14312 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14313 {
14314 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14315 }
14316 
ZEND_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14317 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14318 {
14319 	USE_OPLINE
14320 	zend_free_op free_op1, free_op2;
14321 
14322 	SAVE_OPLINE();
14323 	fast_add_function(&EX_T(opline->result.var).tmp_var,
14324 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14325 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14326 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14327 	zval_dtor(free_op2.var);
14328 	CHECK_EXCEPTION();
14329 	ZEND_VM_NEXT_OPCODE();
14330 }
14331 
ZEND_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14332 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14333 {
14334 	USE_OPLINE
14335 	zend_free_op free_op1, free_op2;
14336 
14337 	SAVE_OPLINE();
14338 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
14339 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14340 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14341 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14342 	zval_dtor(free_op2.var);
14343 	CHECK_EXCEPTION();
14344 	ZEND_VM_NEXT_OPCODE();
14345 }
14346 
ZEND_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14347 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14348 {
14349 	USE_OPLINE
14350 	zend_free_op free_op1, free_op2;
14351 
14352 	SAVE_OPLINE();
14353 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
14354 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14355 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14356 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14357 	zval_dtor(free_op2.var);
14358 	CHECK_EXCEPTION();
14359 	ZEND_VM_NEXT_OPCODE();
14360 }
14361 
ZEND_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14362 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14363 {
14364 	USE_OPLINE
14365 	zend_free_op free_op1, free_op2;
14366 
14367 	SAVE_OPLINE();
14368 	fast_div_function(&EX_T(opline->result.var).tmp_var,
14369 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14370 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14371 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14372 	zval_dtor(free_op2.var);
14373 	CHECK_EXCEPTION();
14374 	ZEND_VM_NEXT_OPCODE();
14375 }
14376 
ZEND_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14377 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14378 {
14379 	USE_OPLINE
14380 	zend_free_op free_op1, free_op2;
14381 
14382 	SAVE_OPLINE();
14383 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
14384 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14385 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14386 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14387 	zval_dtor(free_op2.var);
14388 	CHECK_EXCEPTION();
14389 	ZEND_VM_NEXT_OPCODE();
14390 }
14391 
ZEND_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14392 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14393 {
14394 	USE_OPLINE
14395 	zend_free_op free_op1, free_op2;
14396 
14397 	SAVE_OPLINE();
14398 	shift_left_function(&EX_T(opline->result.var).tmp_var,
14399 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14400 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14401 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14402 	zval_dtor(free_op2.var);
14403 	CHECK_EXCEPTION();
14404 	ZEND_VM_NEXT_OPCODE();
14405 }
14406 
ZEND_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14407 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14408 {
14409 	USE_OPLINE
14410 	zend_free_op free_op1, free_op2;
14411 
14412 	SAVE_OPLINE();
14413 	shift_right_function(&EX_T(opline->result.var).tmp_var,
14414 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14415 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14416 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14417 	zval_dtor(free_op2.var);
14418 	CHECK_EXCEPTION();
14419 	ZEND_VM_NEXT_OPCODE();
14420 }
14421 
ZEND_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14422 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14423 {
14424 	USE_OPLINE
14425 	zend_free_op free_op1, free_op2;
14426 
14427 	SAVE_OPLINE();
14428 	concat_function(&EX_T(opline->result.var).tmp_var,
14429 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14430 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14431 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14432 	zval_dtor(free_op2.var);
14433 	CHECK_EXCEPTION();
14434 	ZEND_VM_NEXT_OPCODE();
14435 }
14436 
ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14437 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14438 {
14439 	USE_OPLINE
14440 	zend_free_op free_op1, free_op2;
14441 
14442 	SAVE_OPLINE();
14443 	is_identical_function(&EX_T(opline->result.var).tmp_var,
14444 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14445 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14446 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14447 	zval_dtor(free_op2.var);
14448 	CHECK_EXCEPTION();
14449 	ZEND_VM_NEXT_OPCODE();
14450 }
14451 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14452 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14453 {
14454 	USE_OPLINE
14455 	zend_free_op free_op1, free_op2;
14456 	zval *result = &EX_T(opline->result.var).tmp_var;
14457 
14458 	SAVE_OPLINE();
14459 	is_identical_function(result,
14460 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14461 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14462 	Z_LVAL_P(result) = !Z_LVAL_P(result);
14463 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14464 	zval_dtor(free_op2.var);
14465 	CHECK_EXCEPTION();
14466 	ZEND_VM_NEXT_OPCODE();
14467 }
14468 
ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14469 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14470 {
14471 	USE_OPLINE
14472 	zend_free_op free_op1, free_op2;
14473 	zval *result = &EX_T(opline->result.var).tmp_var;
14474 
14475 	SAVE_OPLINE();
14476 	ZVAL_BOOL(result, fast_equal_function(result,
14477 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14478 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
14479 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14480 	zval_dtor(free_op2.var);
14481 	CHECK_EXCEPTION();
14482 	ZEND_VM_NEXT_OPCODE();
14483 }
14484 
ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14485 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14486 {
14487 	USE_OPLINE
14488 	zend_free_op free_op1, free_op2;
14489 	zval *result = &EX_T(opline->result.var).tmp_var;
14490 
14491 	SAVE_OPLINE();
14492 	ZVAL_BOOL(result, fast_not_equal_function(result,
14493 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14494 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
14495 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14496 	zval_dtor(free_op2.var);
14497 	CHECK_EXCEPTION();
14498 	ZEND_VM_NEXT_OPCODE();
14499 }
14500 
ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14501 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14502 {
14503 	USE_OPLINE
14504 	zend_free_op free_op1, free_op2;
14505 	zval *result = &EX_T(opline->result.var).tmp_var;
14506 
14507 	SAVE_OPLINE();
14508 	ZVAL_BOOL(result, fast_is_smaller_function(result,
14509 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14510 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
14511 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14512 	zval_dtor(free_op2.var);
14513 	CHECK_EXCEPTION();
14514 	ZEND_VM_NEXT_OPCODE();
14515 }
14516 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14517 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14518 {
14519 	USE_OPLINE
14520 	zend_free_op free_op1, free_op2;
14521 	zval *result = &EX_T(opline->result.var).tmp_var;
14522 
14523 	SAVE_OPLINE();
14524 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
14525 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14526 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
14527 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14528 	zval_dtor(free_op2.var);
14529 	CHECK_EXCEPTION();
14530 	ZEND_VM_NEXT_OPCODE();
14531 }
14532 
ZEND_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14533 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14534 {
14535 	USE_OPLINE
14536 	zend_free_op free_op1, free_op2;
14537 
14538 	SAVE_OPLINE();
14539 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
14540 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14541 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14542 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14543 	zval_dtor(free_op2.var);
14544 	CHECK_EXCEPTION();
14545 	ZEND_VM_NEXT_OPCODE();
14546 }
14547 
ZEND_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14548 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14549 {
14550 	USE_OPLINE
14551 	zend_free_op free_op1, free_op2;
14552 
14553 	SAVE_OPLINE();
14554 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
14555 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14556 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14557 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14558 	zval_dtor(free_op2.var);
14559 	CHECK_EXCEPTION();
14560 	ZEND_VM_NEXT_OPCODE();
14561 }
14562 
ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14563 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14564 {
14565 	USE_OPLINE
14566 	zend_free_op free_op1, free_op2;
14567 
14568 	SAVE_OPLINE();
14569 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
14570 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14571 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14572 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14573 	zval_dtor(free_op2.var);
14574 	CHECK_EXCEPTION();
14575 	ZEND_VM_NEXT_OPCODE();
14576 }
14577 
ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14578 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14579 {
14580 	USE_OPLINE
14581 	zend_free_op free_op1, free_op2;
14582 
14583 	SAVE_OPLINE();
14584 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
14585 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
14586 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
14587 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14588 	zval_dtor(free_op2.var);
14589 	CHECK_EXCEPTION();
14590 	ZEND_VM_NEXT_OPCODE();
14591 }
14592 
zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)14593 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
14594 {
14595 	USE_OPLINE
14596 	zend_free_op free_op1, free_op2, free_op_data1;
14597 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14598 	zval *object;
14599 	zval *property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
14600 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
14601 	int have_get_ptr = 0;
14602 
14603 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14604 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
14605 	}
14606 
14607 	make_real_object(object_ptr TSRMLS_CC);
14608 	object = *object_ptr;
14609 
14610 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14611 		zend_error(E_WARNING, "Attempt to assign property of non-object");
14612 		zval_dtor(free_op2.var);
14613 		FREE_OP(free_op_data1);
14614 
14615 		if (RETURN_VALUE_USED(opline)) {
14616 			PZVAL_LOCK(&EG(uninitialized_zval));
14617 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
14618 			EX_T(opline->result.var).var.ptr_ptr = NULL;
14619 		}
14620 	} else {
14621 		/* here we are sure we are dealing with an object */
14622 		if (1) {
14623 			MAKE_REAL_ZVAL_PTR(property);
14624 		}
14625 
14626 		/* here property is a string */
14627 		if (opline->extended_value == ZEND_ASSIGN_OBJ
14628 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14629 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14630 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14631 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
14632 
14633 				have_get_ptr = 1;
14634 				binary_op(*zptr, *zptr, value TSRMLS_CC);
14635 				if (RETURN_VALUE_USED(opline)) {
14636 					PZVAL_LOCK(*zptr);
14637 					EX_T(opline->result.var).var.ptr = *zptr;
14638 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14639 				}
14640 			}
14641 		}
14642 
14643 		if (!have_get_ptr) {
14644 			zval *z = NULL;
14645 
14646 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
14647 				if (Z_OBJ_HT_P(object)->read_property) {
14648 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14649 				}
14650 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
14651 				if (Z_OBJ_HT_P(object)->read_dimension) {
14652 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
14653 				}
14654 			}
14655 			if (z) {
14656 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
14657 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
14658 
14659 					if (Z_REFCOUNT_P(z) == 0) {
14660 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
14661 						zval_dtor(z);
14662 						FREE_ZVAL(z);
14663 					}
14664 					z = value;
14665 				}
14666 				Z_ADDREF_P(z);
14667 				SEPARATE_ZVAL_IF_NOT_REF(&z);
14668 				binary_op(z, z, value TSRMLS_CC);
14669 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
14670 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14671 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
14672 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
14673 				}
14674 				if (RETURN_VALUE_USED(opline)) {
14675 					PZVAL_LOCK(z);
14676 					EX_T(opline->result.var).var.ptr = z;
14677 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14678 				}
14679 				zval_ptr_dtor(&z);
14680 			} else {
14681 				zend_error(E_WARNING, "Attempt to assign property of non-object");
14682 				if (RETURN_VALUE_USED(opline)) {
14683 					PZVAL_LOCK(&EG(uninitialized_zval));
14684 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
14685 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14686 				}
14687 			}
14688 		}
14689 
14690 		if (1) {
14691 			zval_ptr_dtor(&property);
14692 		} else {
14693 			zval_dtor(free_op2.var);
14694 		}
14695 		FREE_OP(free_op_data1);
14696 	}
14697 
14698 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14699 	/* assign_obj has two opcodes! */
14700 	CHECK_EXCEPTION();
14701 	ZEND_VM_INC_OPCODE();
14702 	ZEND_VM_NEXT_OPCODE();
14703 }
14704 
zend_binary_assign_op_helper_SPEC_VAR_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)14705 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
14706 {
14707 	USE_OPLINE
14708 	zend_free_op free_op1, free_op2, free_op_data2, free_op_data1;
14709 	zval **var_ptr;
14710 	zval *value;
14711 
14712 	SAVE_OPLINE();
14713 	switch (opline->extended_value) {
14714 		case ZEND_ASSIGN_OBJ:
14715 			return zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14716 			break;
14717 		case ZEND_ASSIGN_DIM: {
14718 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14719 
14720 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14721 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14722 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
14723 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
14724 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
14725 					}
14726 					return zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14727 				} else {
14728 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
14729 
14730 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
14731 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
14732 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
14733 				}
14734 			}
14735 			break;
14736 		default:
14737 			value = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
14738 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14739 			/* do nothing */
14740 			break;
14741 	}
14742 
14743 	if (UNEXPECTED(var_ptr == NULL)) {
14744 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
14745 	}
14746 
14747 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
14748 		if (RETURN_VALUE_USED(opline)) {
14749 			PZVAL_LOCK(&EG(uninitialized_zval));
14750 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
14751 		}
14752 		zval_dtor(free_op2.var);
14753 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14754 		CHECK_EXCEPTION();
14755 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
14756 			ZEND_VM_INC_OPCODE();
14757 		}
14758 		ZEND_VM_NEXT_OPCODE();
14759 	}
14760 
14761 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
14762 
14763 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
14764 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
14765 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
14766 		/* proxy object */
14767 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
14768 		Z_ADDREF_P(objval);
14769 		binary_op(objval, objval, value TSRMLS_CC);
14770 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
14771 		zval_ptr_dtor(&objval);
14772 	} else {
14773 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
14774 	}
14775 
14776 	if (RETURN_VALUE_USED(opline)) {
14777 		PZVAL_LOCK(*var_ptr);
14778 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
14779 	}
14780 	zval_dtor(free_op2.var);
14781 
14782 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
14783 		FREE_OP(free_op_data1);
14784 		FREE_OP_VAR_PTR(free_op_data2);
14785 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14786 		CHECK_EXCEPTION();
14787 		ZEND_VM_INC_OPCODE();
14788 	} else {
14789 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14790 		CHECK_EXCEPTION();
14791 	}
14792 	ZEND_VM_NEXT_OPCODE();
14793 }
14794 
ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14795 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14796 {
14797 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14798 }
14799 
ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14800 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14801 {
14802 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14803 }
14804 
ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14805 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14806 {
14807 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14808 }
14809 
ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14810 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14811 {
14812 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14813 }
14814 
ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14815 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14816 {
14817 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14818 }
14819 
ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14820 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14821 {
14822 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14823 }
14824 
ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14825 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14826 {
14827 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14828 }
14829 
ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14830 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14831 {
14832 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14833 }
14834 
ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14835 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14836 {
14837 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14838 }
14839 
ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14840 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14841 {
14842 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14843 }
14844 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14845 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14846 {
14847 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14848 }
14849 
zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)14850 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
14851 {
14852 	USE_OPLINE
14853 	zend_free_op free_op1, free_op2;
14854 	zval **object_ptr;
14855 	zval *object;
14856 	zval *property;
14857 	zval **retval;
14858 	int have_get_ptr = 0;
14859 
14860 	SAVE_OPLINE();
14861 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14862 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
14863 	retval = &EX_T(opline->result.var).var.ptr;
14864 
14865 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14866 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
14867 	}
14868 
14869 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
14870 	object = *object_ptr;
14871 
14872 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14873 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14874 		zval_dtor(free_op2.var);
14875 		if (RETURN_VALUE_USED(opline)) {
14876 			PZVAL_LOCK(&EG(uninitialized_zval));
14877 			*retval = &EG(uninitialized_zval);
14878 		}
14879 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14880 		CHECK_EXCEPTION();
14881 		ZEND_VM_NEXT_OPCODE();
14882 	}
14883 
14884 	/* here we are sure we are dealing with an object */
14885 
14886 	if (1) {
14887 		MAKE_REAL_ZVAL_PTR(property);
14888 	}
14889 
14890 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14891 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14892 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14893 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
14894 
14895 			have_get_ptr = 1;
14896 			incdec_op(*zptr);
14897 			if (RETURN_VALUE_USED(opline)) {
14898 				*retval = *zptr;
14899 				PZVAL_LOCK(*retval);
14900 			}
14901 		}
14902 	}
14903 
14904 	if (!have_get_ptr) {
14905 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
14906 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14907 
14908 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
14909 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
14910 
14911 				if (Z_REFCOUNT_P(z) == 0) {
14912 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
14913 					zval_dtor(z);
14914 					FREE_ZVAL(z);
14915 				}
14916 				z = value;
14917 			}
14918 			Z_ADDREF_P(z);
14919 			SEPARATE_ZVAL_IF_NOT_REF(&z);
14920 			incdec_op(z);
14921 			*retval = z;
14922 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14923 			SELECTIVE_PZVAL_LOCK(*retval, opline);
14924 			zval_ptr_dtor(&z);
14925 		} else {
14926 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14927 			if (RETURN_VALUE_USED(opline)) {
14928 				PZVAL_LOCK(&EG(uninitialized_zval));
14929 				*retval = &EG(uninitialized_zval);
14930 			}
14931 		}
14932 	}
14933 
14934 	if (1) {
14935 		zval_ptr_dtor(&property);
14936 	} else {
14937 		zval_dtor(free_op2.var);
14938 	}
14939 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14940 	CHECK_EXCEPTION();
14941 	ZEND_VM_NEXT_OPCODE();
14942 }
14943 
ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14944 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14945 {
14946 	return zend_pre_incdec_property_helper_SPEC_VAR_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14947 }
14948 
ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14949 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14950 {
14951 	return zend_pre_incdec_property_helper_SPEC_VAR_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14952 }
14953 
zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)14954 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
14955 {
14956 	USE_OPLINE
14957 	zend_free_op free_op1, free_op2;
14958 	zval **object_ptr;
14959 	zval *object;
14960 	zval *property;
14961 	zval *retval;
14962 	int have_get_ptr = 0;
14963 
14964 	SAVE_OPLINE();
14965 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
14966 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
14967 	retval = &EX_T(opline->result.var).tmp_var;
14968 
14969 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14970 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
14971 	}
14972 
14973 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
14974 	object = *object_ptr;
14975 
14976 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14977 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14978 		zval_dtor(free_op2.var);
14979 		ZVAL_NULL(retval);
14980 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14981 		CHECK_EXCEPTION();
14982 		ZEND_VM_NEXT_OPCODE();
14983 	}
14984 
14985 	/* here we are sure we are dealing with an object */
14986 
14987 	if (1) {
14988 		MAKE_REAL_ZVAL_PTR(property);
14989 	}
14990 
14991 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14992 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14993 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14994 			have_get_ptr = 1;
14995 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
14996 
14997 			ZVAL_COPY_VALUE(retval, *zptr);
14998 			zendi_zval_copy_ctor(*retval);
14999 
15000 			incdec_op(*zptr);
15001 
15002 		}
15003 	}
15004 
15005 	if (!have_get_ptr) {
15006 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
15007 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15008 			zval *z_copy;
15009 
15010 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
15011 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
15012 
15013 				if (Z_REFCOUNT_P(z) == 0) {
15014 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
15015 					zval_dtor(z);
15016 					FREE_ZVAL(z);
15017 				}
15018 				z = value;
15019 			}
15020 			ZVAL_COPY_VALUE(retval, z);
15021 			zendi_zval_copy_ctor(*retval);
15022 			ALLOC_ZVAL(z_copy);
15023 			INIT_PZVAL_COPY(z_copy, z);
15024 			zendi_zval_copy_ctor(*z_copy);
15025 			incdec_op(z_copy);
15026 			Z_ADDREF_P(z);
15027 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15028 			zval_ptr_dtor(&z_copy);
15029 			zval_ptr_dtor(&z);
15030 		} else {
15031 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
15032 			ZVAL_NULL(retval);
15033 		}
15034 	}
15035 
15036 	if (1) {
15037 		zval_ptr_dtor(&property);
15038 	} else {
15039 		zval_dtor(free_op2.var);
15040 	}
15041 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15042 	CHECK_EXCEPTION();
15043 	ZEND_VM_NEXT_OPCODE();
15044 }
15045 
ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15046 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15047 {
15048 	return zend_post_incdec_property_helper_SPEC_VAR_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15049 }
15050 
ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15051 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15052 {
15053 	return zend_post_incdec_property_helper_SPEC_VAR_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15054 }
15055 
ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15056 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15057 {
15058 	USE_OPLINE
15059 	zend_free_op free_op1, free_op2;
15060 	zval *container;
15061 
15062 	SAVE_OPLINE();
15063 
15064 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
15065 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
15066 	}
15067 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15068 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
15069 	zval_dtor(free_op2.var);
15070 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15071 	CHECK_EXCEPTION();
15072 	ZEND_VM_NEXT_OPCODE();
15073 }
15074 
ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15075 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15076 {
15077 	USE_OPLINE
15078 	zend_free_op free_op1, free_op2;
15079 	zval **container;
15080 
15081 	SAVE_OPLINE();
15082 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15083 
15084 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15085 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15086 	}
15087 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
15088 	zval_dtor(free_op2.var);
15089 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15090 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15091 	}
15092 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15093 
15094 	/* We are going to assign the result by reference */
15095 	if (UNEXPECTED(opline->extended_value != 0)) {
15096 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
15097 
15098 		if (retval_ptr) {
15099 			Z_DELREF_PP(retval_ptr);
15100 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
15101 			Z_ADDREF_PP(retval_ptr);
15102 		}
15103 	}
15104 
15105 	CHECK_EXCEPTION();
15106 	ZEND_VM_NEXT_OPCODE();
15107 }
15108 
ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15109 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15110 {
15111 	USE_OPLINE
15112 	zend_free_op free_op1, free_op2;
15113 	zval **container;
15114 
15115 	SAVE_OPLINE();
15116 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15117 
15118 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15119 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15120 	}
15121 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
15122 	zval_dtor(free_op2.var);
15123 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15124 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15125 	}
15126 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15127 	CHECK_EXCEPTION();
15128 	ZEND_VM_NEXT_OPCODE();
15129 }
15130 
ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15131 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15132 {
15133 	USE_OPLINE
15134 	zend_free_op free_op1, free_op2;
15135 	zval *container;
15136 
15137 	SAVE_OPLINE();
15138 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15139 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_IS TSRMLS_CC);
15140 	zval_dtor(free_op2.var);
15141 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15142 	CHECK_EXCEPTION();
15143 	ZEND_VM_NEXT_OPCODE();
15144 }
15145 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15146 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15147 {
15148 	USE_OPLINE
15149 	zend_free_op free_op1, free_op2;
15150 
15151 	SAVE_OPLINE();
15152 
15153 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
15154 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15155 
15156 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15157 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15158 		}
15159 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
15160 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15161 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15162 		}
15163 		zval_dtor(free_op2.var);
15164 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15165 	} else {
15166 		zval *container;
15167 
15168 		if (IS_TMP_VAR == IS_UNUSED) {
15169 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
15170 		}
15171 		container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15172 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
15173 		zval_dtor(free_op2.var);
15174 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15175 	}
15176 	CHECK_EXCEPTION();
15177 	ZEND_VM_NEXT_OPCODE();
15178 }
15179 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15180 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15181 {
15182 	USE_OPLINE
15183 	zend_free_op free_op1, free_op2;
15184 	zval **container;
15185 
15186 	SAVE_OPLINE();
15187 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15188 
15189 	if (IS_VAR == IS_CV) {
15190 		if (container != &EG(uninitialized_zval_ptr)) {
15191 			SEPARATE_ZVAL_IF_NOT_REF(container);
15192 		}
15193 	}
15194 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15195 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15196 	}
15197 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_UNSET TSRMLS_CC);
15198 	zval_dtor(free_op2.var);
15199 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15200 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15201 	}
15202 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15203 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
15204 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
15205 	} else {
15206 		zend_free_op free_res;
15207 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
15208 
15209 		PZVAL_UNLOCK(*retval_ptr, &free_res);
15210 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
15211 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
15212 		}
15213 		PZVAL_LOCK(*retval_ptr);
15214 		FREE_OP_VAR_PTR(free_res);
15215 		CHECK_EXCEPTION();
15216 		ZEND_VM_NEXT_OPCODE();
15217 	}
15218 }
15219 
zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS)15220 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS)
15221 {
15222 	USE_OPLINE
15223 	zend_free_op free_op1;
15224 	zval *container;
15225 	zend_free_op free_op2;
15226 	zval *offset;
15227 
15228 	SAVE_OPLINE();
15229 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15230 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15231 
15232 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
15233 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
15234 		zend_error(E_NOTICE, "Trying to get property of non-object");
15235 		PZVAL_LOCK(&EG(uninitialized_zval));
15236 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15237 		zval_dtor(free_op2.var);
15238 	} else {
15239 		zval *retval;
15240 
15241 		if (1) {
15242 			MAKE_REAL_ZVAL_PTR(offset);
15243 		}
15244 
15245 		/* here we are sure we are dealing with an object */
15246 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15247 
15248 		PZVAL_LOCK(retval);
15249 		AI_SET_PTR(&EX_T(opline->result.var), retval);
15250 
15251 		if (1) {
15252 			zval_ptr_dtor(&offset);
15253 		} else {
15254 			zval_dtor(free_op2.var);
15255 		}
15256 	}
15257 
15258 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15259 	CHECK_EXCEPTION();
15260 	ZEND_VM_NEXT_OPCODE();
15261 }
15262 
ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15263 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15264 {
15265 	return zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15266 }
15267 
ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15268 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15269 {
15270 	USE_OPLINE
15271 	zend_free_op free_op1, free_op2;
15272 	zval *property;
15273 	zval **container;
15274 
15275 	SAVE_OPLINE();
15276 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15277 
15278 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
15279 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
15280 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
15281 	}
15282 
15283 	if (1) {
15284 		MAKE_REAL_ZVAL_PTR(property);
15285 	}
15286 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15287 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15288 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15289 	}
15290 
15291 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
15292 	if (1) {
15293 		zval_ptr_dtor(&property);
15294 	} else {
15295 		zval_dtor(free_op2.var);
15296 	}
15297 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15298 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15299 	}
15300 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15301 
15302 	/* We are going to assign the result by reference */
15303 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
15304 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
15305 
15306 		Z_DELREF_PP(retval_ptr);
15307 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
15308 		Z_ADDREF_PP(retval_ptr);
15309 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
15310 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
15311 	}
15312 
15313 	CHECK_EXCEPTION();
15314 	ZEND_VM_NEXT_OPCODE();
15315 }
15316 
ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15317 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15318 {
15319 	USE_OPLINE
15320 	zend_free_op free_op1, free_op2;
15321 	zval *property;
15322 	zval **container;
15323 
15324 	SAVE_OPLINE();
15325 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15326 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15327 
15328 	if (1) {
15329 		MAKE_REAL_ZVAL_PTR(property);
15330 	}
15331 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15332 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15333 	}
15334 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
15335 	if (1) {
15336 		zval_ptr_dtor(&property);
15337 	} else {
15338 		zval_dtor(free_op2.var);
15339 	}
15340 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15341 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15342 	}
15343 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15344 	CHECK_EXCEPTION();
15345 	ZEND_VM_NEXT_OPCODE();
15346 }
15347 
ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15348 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15349 {
15350 	USE_OPLINE
15351 	zend_free_op free_op1;
15352 	zval *container;
15353 	zend_free_op free_op2;
15354 	zval *offset;
15355 
15356 	SAVE_OPLINE();
15357 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15358 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15359 
15360 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
15361 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
15362 		PZVAL_LOCK(&EG(uninitialized_zval));
15363 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15364 		zval_dtor(free_op2.var);
15365 	} else {
15366 		zval *retval;
15367 
15368 		if (1) {
15369 			MAKE_REAL_ZVAL_PTR(offset);
15370 		}
15371 
15372 		/* here we are sure we are dealing with an object */
15373 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15374 
15375 		PZVAL_LOCK(retval);
15376 		AI_SET_PTR(&EX_T(opline->result.var), retval);
15377 
15378 		if (1) {
15379 			zval_ptr_dtor(&offset);
15380 		} else {
15381 			zval_dtor(free_op2.var);
15382 		}
15383 	}
15384 
15385 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15386 	CHECK_EXCEPTION();
15387 	ZEND_VM_NEXT_OPCODE();
15388 }
15389 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15390 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15391 {
15392 	USE_OPLINE
15393 
15394 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
15395 		/* Behave like FETCH_OBJ_W */
15396 		zend_free_op free_op1, free_op2;
15397 		zval *property;
15398 		zval **container;
15399 
15400 		SAVE_OPLINE();
15401 		property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15402 		container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15403 
15404 		if (1) {
15405 			MAKE_REAL_ZVAL_PTR(property);
15406 		}
15407 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15408 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15409 		}
15410 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
15411 		if (1) {
15412 			zval_ptr_dtor(&property);
15413 		} else {
15414 			zval_dtor(free_op2.var);
15415 		}
15416 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15417 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15418 		}
15419 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15420 		CHECK_EXCEPTION();
15421 		ZEND_VM_NEXT_OPCODE();
15422 	} else {
15423 		return zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15424 	}
15425 }
15426 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15427 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15428 {
15429 	USE_OPLINE
15430 	zend_free_op free_op1, free_op2, free_res;
15431 	zval **container;
15432 	zval *property;
15433 
15434 	SAVE_OPLINE();
15435 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15436 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15437 
15438 	if (IS_VAR == IS_CV) {
15439 		if (container != &EG(uninitialized_zval_ptr)) {
15440 			SEPARATE_ZVAL_IF_NOT_REF(container);
15441 		}
15442 	}
15443 	if (1) {
15444 		MAKE_REAL_ZVAL_PTR(property);
15445 	}
15446 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15447 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15448 	}
15449 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
15450 	if (1) {
15451 		zval_ptr_dtor(&property);
15452 	} else {
15453 		zval_dtor(free_op2.var);
15454 	}
15455 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15456 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15457 	}
15458 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15459 
15460 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
15461 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
15462 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
15463 	}
15464 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
15465 	FREE_OP_VAR_PTR(free_res);
15466 	CHECK_EXCEPTION();
15467 	ZEND_VM_NEXT_OPCODE();
15468 }
15469 
ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15470 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15471 {
15472 	USE_OPLINE
15473 	zend_free_op free_op1, free_op2;
15474 	zval **object_ptr;
15475 	zval *property_name;
15476 
15477 	SAVE_OPLINE();
15478 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15479 	property_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15480 
15481 	if (1) {
15482 		MAKE_REAL_ZVAL_PTR(property_name);
15483 	}
15484 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
15485 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15486 	}
15487 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15488 	if (1) {
15489 		zval_ptr_dtor(&property_name);
15490 	} else {
15491 		zval_dtor(free_op2.var);
15492 	}
15493 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15494 	/* assign_obj has two opcodes! */
15495 	CHECK_EXCEPTION();
15496 	ZEND_VM_INC_OPCODE();
15497 	ZEND_VM_NEXT_OPCODE();
15498 }
15499 
ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15500 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15501 {
15502 	USE_OPLINE
15503 	zend_free_op free_op1;
15504 	zval **object_ptr;
15505 
15506 	SAVE_OPLINE();
15507 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15508 
15509 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
15510 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15511 	}
15512 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
15513 		zend_free_op free_op2;
15514 		zval *property_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15515 
15516 		if (1) {
15517 			MAKE_REAL_ZVAL_PTR(property_name);
15518 		}
15519 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15520 		if (1) {
15521 			zval_ptr_dtor(&property_name);
15522 		} else {
15523 			zval_dtor(free_op2.var);
15524 		}
15525 	} else {
15526 		zend_free_op free_op2, free_op_data1, free_op_data2;
15527 		zval *value;
15528 		zval *dim = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15529 		zval **variable_ptr_ptr;
15530 
15531 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
15532 		zval_dtor(free_op2.var);
15533 
15534 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
15535 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
15536 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
15537 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
15538 				if (RETURN_VALUE_USED(opline)) {
15539 					zval *retval;
15540 
15541 					ALLOC_ZVAL(retval);
15542 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
15543 					INIT_PZVAL(retval);
15544 					AI_SET_PTR(&EX_T(opline->result.var), retval);
15545 				}
15546 			} else if (RETURN_VALUE_USED(opline)) {
15547 				PZVAL_LOCK(&EG(uninitialized_zval));
15548 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15549 			}
15550 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
15551 			if (IS_TMP_FREE(free_op_data1)) {
15552 				zval_dtor(value);
15553 			}
15554 			if (RETURN_VALUE_USED(opline)) {
15555 				PZVAL_LOCK(&EG(uninitialized_zval));
15556 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15557 			}
15558 		} else {
15559 			if ((opline+1)->op1_type == IS_TMP_VAR) {
15560 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15561 			} else if ((opline+1)->op1_type == IS_CONST) {
15562 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15563 			} else {
15564 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15565 			}
15566 			if (RETURN_VALUE_USED(opline)) {
15567 				PZVAL_LOCK(value);
15568 				AI_SET_PTR(&EX_T(opline->result.var), value);
15569 			}
15570 		}
15571 		FREE_OP_VAR_PTR(free_op_data2);
15572 	 	FREE_OP_IF_VAR(free_op_data1);
15573 	}
15574  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15575 	/* assign_dim has two opcodes! */
15576 	CHECK_EXCEPTION();
15577 	ZEND_VM_INC_OPCODE();
15578 	ZEND_VM_NEXT_OPCODE();
15579 }
15580 
ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15581 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15582 {
15583 	USE_OPLINE
15584 	zend_free_op free_op1, free_op2;
15585 	zval *value;
15586 	zval **variable_ptr_ptr;
15587 
15588 	SAVE_OPLINE();
15589 	value = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15590 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15591 
15592 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
15593 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_TMP_VAR TSRMLS_CC)) {
15594 			if (RETURN_VALUE_USED(opline)) {
15595 				zval *retval;
15596 
15597 				ALLOC_ZVAL(retval);
15598 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
15599 				INIT_PZVAL(retval);
15600 				AI_SET_PTR(&EX_T(opline->result.var), retval);
15601 			}
15602 		} else if (RETURN_VALUE_USED(opline)) {
15603 			PZVAL_LOCK(&EG(uninitialized_zval));
15604 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15605 		}
15606 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
15607 		if (1) {
15608 			zval_dtor(value);
15609 		}
15610 		if (RETURN_VALUE_USED(opline)) {
15611 			PZVAL_LOCK(&EG(uninitialized_zval));
15612 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15613 		}
15614 	} else {
15615 		if (IS_TMP_VAR == IS_TMP_VAR) {
15616 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15617 		} else if (IS_TMP_VAR == IS_CONST) {
15618 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15619 		} else {
15620 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15621 		}
15622 		if (RETURN_VALUE_USED(opline)) {
15623 			PZVAL_LOCK(value);
15624 			AI_SET_PTR(&EX_T(opline->result.var), value);
15625 		}
15626 	}
15627 
15628 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15629 
15630 	/* zend_assign_to_variable() always takes care of op2, never free it! */
15631 
15632 	CHECK_EXCEPTION();
15633 	ZEND_VM_NEXT_OPCODE();
15634 }
15635 
ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15636 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15637 {
15638 	USE_OPLINE
15639 	zval *function_name;
15640 	char *function_name_strval;
15641 	int function_name_strlen;
15642 	zend_free_op free_op1, free_op2;
15643 
15644 	SAVE_OPLINE();
15645 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
15646 
15647 	function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15648 
15649 	if (IS_TMP_VAR != IS_CONST &&
15650 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
15651 		zend_error_noreturn(E_ERROR, "Method name must be a string");
15652 	}
15653 
15654 	function_name_strval = Z_STRVAL_P(function_name);
15655 	function_name_strlen = Z_STRLEN_P(function_name);
15656 
15657 	EX(object) = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15658 
15659 	if (EXPECTED(EX(object) != NULL) &&
15660 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
15661 		EX(called_scope) = Z_OBJCE_P(EX(object));
15662 
15663 		if (IS_TMP_VAR != IS_CONST ||
15664 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
15665 		    zval *object = EX(object);
15666 
15667 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
15668 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
15669 			}
15670 
15671 			/* First, locate the function. */
15672 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
15673 			if (UNEXPECTED(EX(fbc) == NULL)) {
15674 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
15675 			}
15676 			if (IS_TMP_VAR == IS_CONST &&
15677 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
15678 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
15679 			    EXPECTED(EX(object) == object)) {
15680 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
15681 			}
15682 		}
15683 	} else {
15684 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
15685 	}
15686 
15687 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
15688 		EX(object) = NULL;
15689 	} else {
15690 		if (!PZVAL_IS_REF(EX(object))) {
15691 			Z_ADDREF_P(EX(object)); /* For $this pointer */
15692 		} else {
15693 			zval *this_ptr;
15694 			ALLOC_ZVAL(this_ptr);
15695 			INIT_PZVAL_COPY(this_ptr, EX(object));
15696 			zval_copy_ctor(this_ptr);
15697 			EX(object) = this_ptr;
15698 		}
15699 	}
15700 
15701 	zval_dtor(free_op2.var);
15702 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15703 
15704 	CHECK_EXCEPTION();
15705 	ZEND_VM_NEXT_OPCODE();
15706 }
15707 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15708 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15709 {
15710 	USE_OPLINE
15711 	zval *function_name;
15712 	zend_class_entry *ce;
15713 
15714 	SAVE_OPLINE();
15715 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
15716 
15717 	if (IS_VAR == IS_CONST) {
15718 		/* no function found. try a static method in class */
15719 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
15720 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
15721 		} else {
15722 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
15723 			if (UNEXPECTED(EG(exception) != NULL)) {
15724 				HANDLE_EXCEPTION();
15725 			}
15726 			if (UNEXPECTED(ce == NULL)) {
15727 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
15728 			}
15729 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
15730 		}
15731 		EX(called_scope) = ce;
15732 	} else {
15733 		ce = EX_T(opline->op1.var).class_entry;
15734 
15735 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
15736 			EX(called_scope) = EG(called_scope);
15737 		} else {
15738 			EX(called_scope) = ce;
15739 		}
15740 	}
15741 
15742 	if (IS_VAR == IS_CONST &&
15743 	    IS_TMP_VAR == IS_CONST &&
15744 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
15745 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
15746 	} else if (IS_VAR != IS_CONST &&
15747 	           IS_TMP_VAR == IS_CONST &&
15748 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
15749 		/* do nothing */
15750 	} else if (IS_TMP_VAR != IS_UNUSED) {
15751 		char *function_name_strval = NULL;
15752 		int function_name_strlen = 0;
15753 		zend_free_op free_op2;
15754 
15755 		if (IS_TMP_VAR == IS_CONST) {
15756 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
15757 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
15758 		} else {
15759 			function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15760 
15761 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
15762 				zend_error_noreturn(E_ERROR, "Function name must be a string");
15763 			} else {
15764 				function_name_strval = Z_STRVAL_P(function_name);
15765 				function_name_strlen = Z_STRLEN_P(function_name);
15766  			}
15767 		}
15768 
15769 		if (function_name_strval) {
15770 			if (ce->get_static_method) {
15771 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
15772 			} else {
15773 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
15774 			}
15775 			if (UNEXPECTED(EX(fbc) == NULL)) {
15776 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
15777 			}
15778 			if (IS_TMP_VAR == IS_CONST &&
15779 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
15780 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
15781 				if (IS_VAR == IS_CONST) {
15782 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
15783 				} else {
15784 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
15785 				}
15786 			}
15787 		}
15788 		if (IS_TMP_VAR != IS_CONST) {
15789 			zval_dtor(free_op2.var);
15790 		}
15791 	} else {
15792 		if (UNEXPECTED(ce->constructor == NULL)) {
15793 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
15794 		}
15795 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
15796 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
15797 		}
15798 		EX(fbc) = ce->constructor;
15799 	}
15800 
15801 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
15802 		EX(object) = NULL;
15803 	} else {
15804 		if (EG(This) &&
15805 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
15806 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
15807 		    /* We are calling method of the other (incompatible) class,
15808 		       but passing $this. This is done for compatibility with php-4. */
15809 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
15810 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
15811 			} else {
15812 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
15813 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
15814 			}
15815 		}
15816 		if ((EX(object) = EG(This))) {
15817 			Z_ADDREF_P(EX(object));
15818 			EX(called_scope) = Z_OBJCE_P(EX(object));
15819 		}
15820 	}
15821 
15822 	CHECK_EXCEPTION();
15823 	ZEND_VM_NEXT_OPCODE();
15824 }
15825 
ZEND_CASE_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15826 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15827 {
15828 	USE_OPLINE
15829 	zend_free_op free_op1, free_op2;
15830 
15831 	SAVE_OPLINE();
15832 	if (IS_VAR==IS_VAR) {
15833 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
15834 	}
15835 	is_equal_function(&EX_T(opline->result.var).tmp_var,
15836 				 _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
15837 				 _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
15838 
15839 	zval_dtor(free_op2.var);
15840 	CHECK_EXCEPTION();
15841 	ZEND_VM_NEXT_OPCODE();
15842 }
15843 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15844 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15845 {
15846 	USE_OPLINE
15847 	zend_free_op free_op1;
15848 	zval *expr_ptr;
15849 
15850 	SAVE_OPLINE();
15851 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
15852 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15853 
15854 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
15855 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
15856 		}
15857 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
15858 		expr_ptr = *expr_ptr_ptr;
15859 		Z_ADDREF_P(expr_ptr);
15860 	} else {
15861 		expr_ptr=_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15862 		if (0) { /* temporary variable */
15863 			zval *new_expr;
15864 
15865 			ALLOC_ZVAL(new_expr);
15866 			INIT_PZVAL_COPY(new_expr, expr_ptr);
15867 			expr_ptr = new_expr;
15868 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
15869 			zval *new_expr;
15870 
15871 			ALLOC_ZVAL(new_expr);
15872 			INIT_PZVAL_COPY(new_expr, expr_ptr);
15873 			expr_ptr = new_expr;
15874 			zendi_zval_copy_ctor(*expr_ptr);
15875 		} else {
15876 			Z_ADDREF_P(expr_ptr);
15877 		}
15878 	}
15879 
15880 	if (IS_TMP_VAR != IS_UNUSED) {
15881 		zend_free_op free_op2;
15882 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15883 		ulong hval;
15884 
15885 		switch (Z_TYPE_P(offset)) {
15886 			case IS_DOUBLE:
15887 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
15888 				goto num_index;
15889 			case IS_LONG:
15890 			case IS_BOOL:
15891 				hval = Z_LVAL_P(offset);
15892 num_index:
15893 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
15894 				break;
15895 			case IS_STRING:
15896 				if (IS_TMP_VAR == IS_CONST) {
15897 					hval = Z_HASH_P(offset);
15898 				} else {
15899 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
15900 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
15901 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
15902 					} else {
15903 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
15904 					}
15905 				}
15906 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
15907 				break;
15908 			case IS_NULL:
15909 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
15910 				break;
15911 			default:
15912 				zend_error(E_WARNING, "Illegal offset type");
15913 				zval_ptr_dtor(&expr_ptr);
15914 				/* do nothing */
15915 				break;
15916 		}
15917 		zval_dtor(free_op2.var);
15918 	} else {
15919 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
15920 	}
15921 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
15922 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15923 	} else {
15924 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15925 	}
15926 	CHECK_EXCEPTION();
15927 	ZEND_VM_NEXT_OPCODE();
15928 }
15929 
ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15930 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15931 {
15932 	USE_OPLINE
15933 
15934 	array_init(&EX_T(opline->result.var).tmp_var);
15935 	if (IS_VAR == IS_UNUSED) {
15936 		ZEND_VM_NEXT_OPCODE();
15937 #if 0 || IS_VAR != IS_UNUSED
15938 	} else {
15939 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15940 #endif
15941 	}
15942 }
15943 
ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15944 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15945 {
15946 	USE_OPLINE
15947 	zend_free_op free_op1, free_op2;
15948 	zval **container;
15949 	zval *offset;
15950 	ulong hval;
15951 
15952 	SAVE_OPLINE();
15953 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
15954 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
15955 		SEPARATE_ZVAL_IF_NOT_REF(container);
15956 	}
15957 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
15958 
15959 	if (IS_VAR != IS_VAR || container) {
15960 		switch (Z_TYPE_PP(container)) {
15961 			case IS_ARRAY: {
15962 				HashTable *ht = Z_ARRVAL_PP(container);
15963 
15964 				switch (Z_TYPE_P(offset)) {
15965 					case IS_DOUBLE:
15966 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
15967 						zend_hash_index_del(ht, hval);
15968 						break;
15969 					case IS_RESOURCE:
15970 					case IS_BOOL:
15971 					case IS_LONG:
15972 						hval = Z_LVAL_P(offset);
15973 						zend_hash_index_del(ht, hval);
15974 						break;
15975 					case IS_STRING:
15976 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
15977 							Z_ADDREF_P(offset);
15978 						}
15979 						if (IS_TMP_VAR == IS_CONST) {
15980 							hval = Z_HASH_P(offset);
15981 						} else {
15982 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
15983 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
15984 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
15985 							} else {
15986 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
15987 							}
15988 						}
15989 						if (ht == &EG(symbol_table)) {
15990 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
15991 						} else {
15992 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
15993 						}
15994 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
15995 							zval_ptr_dtor(&offset);
15996 						}
15997 						break;
15998 num_index_dim:
15999 						zend_hash_index_del(ht, hval);
16000 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
16001 							zval_ptr_dtor(&offset);
16002 						}
16003 						break;
16004 					case IS_NULL:
16005 						zend_hash_del(ht, "", sizeof(""));
16006 						break;
16007 					default:
16008 						zend_error(E_WARNING, "Illegal offset type in unset");
16009 						break;
16010 				}
16011 				zval_dtor(free_op2.var);
16012 				break;
16013 			}
16014 			case IS_OBJECT:
16015 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
16016 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
16017 				}
16018 				if (1) {
16019 					MAKE_REAL_ZVAL_PTR(offset);
16020 				}
16021 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
16022 				if (1) {
16023 					zval_ptr_dtor(&offset);
16024 				} else {
16025 					zval_dtor(free_op2.var);
16026 				}
16027 				break;
16028 			case IS_STRING:
16029 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
16030 				ZEND_VM_CONTINUE(); /* bailed out before */
16031 			default:
16032 				zval_dtor(free_op2.var);
16033 				break;
16034 		}
16035 	} else {
16036 		zval_dtor(free_op2.var);
16037 	}
16038 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16039 
16040 	CHECK_EXCEPTION();
16041 	ZEND_VM_NEXT_OPCODE();
16042 }
16043 
ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16044 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16045 {
16046 	USE_OPLINE
16047 	zend_free_op free_op1, free_op2;
16048 	zval **container;
16049 	zval *offset;
16050 
16051 	SAVE_OPLINE();
16052 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16053 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16054 
16055 	if (IS_VAR != IS_VAR || container) {
16056 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
16057 			SEPARATE_ZVAL_IF_NOT_REF(container);
16058 		}
16059 		if (Z_TYPE_PP(container) == IS_OBJECT) {
16060 			if (1) {
16061 				MAKE_REAL_ZVAL_PTR(offset);
16062 			}
16063 			if (Z_OBJ_HT_P(*container)->unset_property) {
16064 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16065 			} else {
16066 				zend_error(E_NOTICE, "Trying to unset property of non-object");
16067 			}
16068 			if (1) {
16069 				zval_ptr_dtor(&offset);
16070 			} else {
16071 				zval_dtor(free_op2.var);
16072 			}
16073 		} else {
16074 			zval_dtor(free_op2.var);
16075 		}
16076 	} else {
16077 		zval_dtor(free_op2.var);
16078 	}
16079 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16080 
16081 	CHECK_EXCEPTION();
16082 	ZEND_VM_NEXT_OPCODE();
16083 }
16084 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)16085 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
16086 {
16087 	USE_OPLINE
16088 	zend_free_op free_op1, free_op2;
16089 	zval **container;
16090 	zval **value = NULL;
16091 	int result = 0;
16092 	ulong hval;
16093 	zval *offset;
16094 
16095 	SAVE_OPLINE();
16096 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16097 
16098 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16099 
16100 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
16101 		HashTable *ht;
16102 		int isset = 0;
16103 
16104 		ht = Z_ARRVAL_PP(container);
16105 
16106 		switch (Z_TYPE_P(offset)) {
16107 			case IS_DOUBLE:
16108 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
16109 				goto num_index_prop;
16110 			case IS_RESOURCE:
16111 			case IS_BOOL:
16112 			case IS_LONG:
16113 				hval = Z_LVAL_P(offset);
16114 num_index_prop:
16115 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
16116 					isset = 1;
16117 				}
16118 				break;
16119 			case IS_STRING:
16120 				if (IS_TMP_VAR == IS_CONST) {
16121 					hval = Z_HASH_P(offset);
16122 				} else {
16123 					if (!prop_dim) {
16124 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
16125 					}
16126 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
16127 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
16128 					} else {
16129 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
16130 					}
16131 				}
16132 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
16133 					isset = 1;
16134 				}
16135 				break;
16136 			case IS_NULL:
16137 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
16138 					isset = 1;
16139 				}
16140 				break;
16141 			default:
16142 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
16143 				break;
16144 		}
16145 
16146 		if (opline->extended_value & ZEND_ISSET) {
16147 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
16148 				result = 0;
16149 			} else {
16150 				result = isset;
16151 			}
16152 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
16153 			if (!isset || !i_zend_is_true(*value)) {
16154 				result = 0;
16155 			} else {
16156 				result = 1;
16157 			}
16158 		}
16159 		zval_dtor(free_op2.var);
16160 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
16161 		if (1) {
16162 			MAKE_REAL_ZVAL_PTR(offset);
16163 		}
16164 		if (prop_dim) {
16165 			if (Z_OBJ_HT_P(*container)->has_property) {
16166 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16167 			} else {
16168 				zend_error(E_NOTICE, "Trying to check property of non-object");
16169 				result = 0;
16170 			}
16171 		} else {
16172 			if (Z_OBJ_HT_P(*container)->has_dimension) {
16173 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
16174 			} else {
16175 				zend_error(E_NOTICE, "Trying to check element of non-array");
16176 				result = 0;
16177 			}
16178 		}
16179 		if (1) {
16180 			zval_ptr_dtor(&offset);
16181 		} else {
16182 			zval_dtor(free_op2.var);
16183 		}
16184 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
16185 		zval tmp;
16186 
16187 		if (Z_TYPE_P(offset) != IS_LONG) {
16188 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
16189 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
16190 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
16191 				ZVAL_COPY_VALUE(&tmp, offset);
16192 				zval_copy_ctor(&tmp);
16193 				convert_to_long(&tmp);
16194 				offset = &tmp;
16195 			} else {
16196 				/* can not be converted to proper offset, return "not set" */
16197 				result = 0;
16198 			}
16199 		}
16200 		if (Z_TYPE_P(offset) == IS_LONG) {
16201 			if (opline->extended_value & ZEND_ISSET) {
16202 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
16203 					result = 1;
16204 				}
16205 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
16206 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
16207 					result = 1;
16208 				}
16209 			}
16210 		}
16211 		zval_dtor(free_op2.var);
16212 	} else {
16213 		zval_dtor(free_op2.var);
16214 	}
16215 
16216 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
16217 	if (opline->extended_value & ZEND_ISSET) {
16218 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
16219 	} else {
16220 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
16221 	}
16222 
16223 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16224 
16225 	CHECK_EXCEPTION();
16226 	ZEND_VM_NEXT_OPCODE();
16227 }
16228 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16229 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16230 {
16231 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16232 }
16233 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16234 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16235 {
16236 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16237 }
16238 
ZEND_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16239 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16240 {
16241 	USE_OPLINE
16242 	zend_free_op free_op1, free_op2;
16243 
16244 	SAVE_OPLINE();
16245 	fast_add_function(&EX_T(opline->result.var).tmp_var,
16246 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16247 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16248 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16249 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16250 	CHECK_EXCEPTION();
16251 	ZEND_VM_NEXT_OPCODE();
16252 }
16253 
ZEND_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16254 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16255 {
16256 	USE_OPLINE
16257 	zend_free_op free_op1, free_op2;
16258 
16259 	SAVE_OPLINE();
16260 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
16261 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16262 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16263 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16264 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16265 	CHECK_EXCEPTION();
16266 	ZEND_VM_NEXT_OPCODE();
16267 }
16268 
ZEND_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16269 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16270 {
16271 	USE_OPLINE
16272 	zend_free_op free_op1, free_op2;
16273 
16274 	SAVE_OPLINE();
16275 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
16276 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16277 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16278 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16279 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16280 	CHECK_EXCEPTION();
16281 	ZEND_VM_NEXT_OPCODE();
16282 }
16283 
ZEND_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16284 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16285 {
16286 	USE_OPLINE
16287 	zend_free_op free_op1, free_op2;
16288 
16289 	SAVE_OPLINE();
16290 	fast_div_function(&EX_T(opline->result.var).tmp_var,
16291 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16292 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16293 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16294 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16295 	CHECK_EXCEPTION();
16296 	ZEND_VM_NEXT_OPCODE();
16297 }
16298 
ZEND_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16299 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16300 {
16301 	USE_OPLINE
16302 	zend_free_op free_op1, free_op2;
16303 
16304 	SAVE_OPLINE();
16305 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
16306 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16307 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16308 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16309 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16310 	CHECK_EXCEPTION();
16311 	ZEND_VM_NEXT_OPCODE();
16312 }
16313 
ZEND_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16314 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16315 {
16316 	USE_OPLINE
16317 	zend_free_op free_op1, free_op2;
16318 
16319 	SAVE_OPLINE();
16320 	shift_left_function(&EX_T(opline->result.var).tmp_var,
16321 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16322 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16323 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16324 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16325 	CHECK_EXCEPTION();
16326 	ZEND_VM_NEXT_OPCODE();
16327 }
16328 
ZEND_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16329 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16330 {
16331 	USE_OPLINE
16332 	zend_free_op free_op1, free_op2;
16333 
16334 	SAVE_OPLINE();
16335 	shift_right_function(&EX_T(opline->result.var).tmp_var,
16336 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16337 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16338 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16339 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16340 	CHECK_EXCEPTION();
16341 	ZEND_VM_NEXT_OPCODE();
16342 }
16343 
ZEND_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16344 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16345 {
16346 	USE_OPLINE
16347 	zend_free_op free_op1, free_op2;
16348 
16349 	SAVE_OPLINE();
16350 	concat_function(&EX_T(opline->result.var).tmp_var,
16351 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16352 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16353 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16354 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16355 	CHECK_EXCEPTION();
16356 	ZEND_VM_NEXT_OPCODE();
16357 }
16358 
ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16359 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16360 {
16361 	USE_OPLINE
16362 	zend_free_op free_op1, free_op2;
16363 
16364 	SAVE_OPLINE();
16365 	is_identical_function(&EX_T(opline->result.var).tmp_var,
16366 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16367 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16368 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16369 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16370 	CHECK_EXCEPTION();
16371 	ZEND_VM_NEXT_OPCODE();
16372 }
16373 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16374 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16375 {
16376 	USE_OPLINE
16377 	zend_free_op free_op1, free_op2;
16378 	zval *result = &EX_T(opline->result.var).tmp_var;
16379 
16380 	SAVE_OPLINE();
16381 	is_identical_function(result,
16382 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16383 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16384 	Z_LVAL_P(result) = !Z_LVAL_P(result);
16385 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16386 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16387 	CHECK_EXCEPTION();
16388 	ZEND_VM_NEXT_OPCODE();
16389 }
16390 
ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16391 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16392 {
16393 	USE_OPLINE
16394 	zend_free_op free_op1, free_op2;
16395 	zval *result = &EX_T(opline->result.var).tmp_var;
16396 
16397 	SAVE_OPLINE();
16398 	ZVAL_BOOL(result, fast_equal_function(result,
16399 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16400 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
16401 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16402 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16403 	CHECK_EXCEPTION();
16404 	ZEND_VM_NEXT_OPCODE();
16405 }
16406 
ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16407 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16408 {
16409 	USE_OPLINE
16410 	zend_free_op free_op1, free_op2;
16411 	zval *result = &EX_T(opline->result.var).tmp_var;
16412 
16413 	SAVE_OPLINE();
16414 	ZVAL_BOOL(result, fast_not_equal_function(result,
16415 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16416 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
16417 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16418 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16419 	CHECK_EXCEPTION();
16420 	ZEND_VM_NEXT_OPCODE();
16421 }
16422 
ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16423 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16424 {
16425 	USE_OPLINE
16426 	zend_free_op free_op1, free_op2;
16427 	zval *result = &EX_T(opline->result.var).tmp_var;
16428 
16429 	SAVE_OPLINE();
16430 	ZVAL_BOOL(result, fast_is_smaller_function(result,
16431 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16432 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
16433 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16434 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16435 	CHECK_EXCEPTION();
16436 	ZEND_VM_NEXT_OPCODE();
16437 }
16438 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16439 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16440 {
16441 	USE_OPLINE
16442 	zend_free_op free_op1, free_op2;
16443 	zval *result = &EX_T(opline->result.var).tmp_var;
16444 
16445 	SAVE_OPLINE();
16446 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
16447 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16448 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
16449 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16450 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16451 	CHECK_EXCEPTION();
16452 	ZEND_VM_NEXT_OPCODE();
16453 }
16454 
ZEND_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16455 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16456 {
16457 	USE_OPLINE
16458 	zend_free_op free_op1, free_op2;
16459 
16460 	SAVE_OPLINE();
16461 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
16462 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16463 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16464 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16465 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16466 	CHECK_EXCEPTION();
16467 	ZEND_VM_NEXT_OPCODE();
16468 }
16469 
ZEND_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16470 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16471 {
16472 	USE_OPLINE
16473 	zend_free_op free_op1, free_op2;
16474 
16475 	SAVE_OPLINE();
16476 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
16477 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16478 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16479 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16480 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16481 	CHECK_EXCEPTION();
16482 	ZEND_VM_NEXT_OPCODE();
16483 }
16484 
ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16485 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16486 {
16487 	USE_OPLINE
16488 	zend_free_op free_op1, free_op2;
16489 
16490 	SAVE_OPLINE();
16491 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
16492 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16493 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16494 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16495 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16496 	CHECK_EXCEPTION();
16497 	ZEND_VM_NEXT_OPCODE();
16498 }
16499 
ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16500 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16501 {
16502 	USE_OPLINE
16503 	zend_free_op free_op1, free_op2;
16504 
16505 	SAVE_OPLINE();
16506 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
16507 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
16508 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
16509 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16510 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16511 	CHECK_EXCEPTION();
16512 	ZEND_VM_NEXT_OPCODE();
16513 }
16514 
zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)16515 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
16516 {
16517 	USE_OPLINE
16518 	zend_free_op free_op1, free_op2, free_op_data1;
16519 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16520 	zval *object;
16521 	zval *property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16522 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
16523 	int have_get_ptr = 0;
16524 
16525 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
16526 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
16527 	}
16528 
16529 	make_real_object(object_ptr TSRMLS_CC);
16530 	object = *object_ptr;
16531 
16532 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
16533 		zend_error(E_WARNING, "Attempt to assign property of non-object");
16534 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16535 		FREE_OP(free_op_data1);
16536 
16537 		if (RETURN_VALUE_USED(opline)) {
16538 			PZVAL_LOCK(&EG(uninitialized_zval));
16539 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
16540 			EX_T(opline->result.var).var.ptr_ptr = NULL;
16541 		}
16542 	} else {
16543 		/* here we are sure we are dealing with an object */
16544 		if (0) {
16545 			MAKE_REAL_ZVAL_PTR(property);
16546 		}
16547 
16548 		/* here property is a string */
16549 		if (opline->extended_value == ZEND_ASSIGN_OBJ
16550 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
16551 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16552 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
16553 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
16554 
16555 				have_get_ptr = 1;
16556 				binary_op(*zptr, *zptr, value TSRMLS_CC);
16557 				if (RETURN_VALUE_USED(opline)) {
16558 					PZVAL_LOCK(*zptr);
16559 					EX_T(opline->result.var).var.ptr = *zptr;
16560 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16561 				}
16562 			}
16563 		}
16564 
16565 		if (!have_get_ptr) {
16566 			zval *z = NULL;
16567 
16568 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
16569 				if (Z_OBJ_HT_P(object)->read_property) {
16570 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16571 				}
16572 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
16573 				if (Z_OBJ_HT_P(object)->read_dimension) {
16574 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
16575 				}
16576 			}
16577 			if (z) {
16578 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
16579 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
16580 
16581 					if (Z_REFCOUNT_P(z) == 0) {
16582 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
16583 						zval_dtor(z);
16584 						FREE_ZVAL(z);
16585 					}
16586 					z = value;
16587 				}
16588 				Z_ADDREF_P(z);
16589 				SEPARATE_ZVAL_IF_NOT_REF(&z);
16590 				binary_op(z, z, value TSRMLS_CC);
16591 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
16592 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16593 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
16594 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
16595 				}
16596 				if (RETURN_VALUE_USED(opline)) {
16597 					PZVAL_LOCK(z);
16598 					EX_T(opline->result.var).var.ptr = z;
16599 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16600 				}
16601 				zval_ptr_dtor(&z);
16602 			} else {
16603 				zend_error(E_WARNING, "Attempt to assign property of non-object");
16604 				if (RETURN_VALUE_USED(opline)) {
16605 					PZVAL_LOCK(&EG(uninitialized_zval));
16606 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
16607 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16608 				}
16609 			}
16610 		}
16611 
16612 		if (0) {
16613 			zval_ptr_dtor(&property);
16614 		} else {
16615 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16616 		}
16617 		FREE_OP(free_op_data1);
16618 	}
16619 
16620 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16621 	/* assign_obj has two opcodes! */
16622 	CHECK_EXCEPTION();
16623 	ZEND_VM_INC_OPCODE();
16624 	ZEND_VM_NEXT_OPCODE();
16625 }
16626 
zend_binary_assign_op_helper_SPEC_VAR_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)16627 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
16628 {
16629 	USE_OPLINE
16630 	zend_free_op free_op1, free_op2, free_op_data2, free_op_data1;
16631 	zval **var_ptr;
16632 	zval *value;
16633 
16634 	SAVE_OPLINE();
16635 	switch (opline->extended_value) {
16636 		case ZEND_ASSIGN_OBJ:
16637 			return zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16638 			break;
16639 		case ZEND_ASSIGN_DIM: {
16640 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16641 
16642 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
16643 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
16644 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
16645 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
16646 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
16647 					}
16648 					return zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16649 				} else {
16650 					zval *dim = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16651 
16652 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
16653 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
16654 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
16655 				}
16656 			}
16657 			break;
16658 		default:
16659 			value = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16660 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16661 			/* do nothing */
16662 			break;
16663 	}
16664 
16665 	if (UNEXPECTED(var_ptr == NULL)) {
16666 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
16667 	}
16668 
16669 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
16670 		if (RETURN_VALUE_USED(opline)) {
16671 			PZVAL_LOCK(&EG(uninitialized_zval));
16672 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
16673 		}
16674 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16675 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16676 		CHECK_EXCEPTION();
16677 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
16678 			ZEND_VM_INC_OPCODE();
16679 		}
16680 		ZEND_VM_NEXT_OPCODE();
16681 	}
16682 
16683 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
16684 
16685 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
16686 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
16687 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
16688 		/* proxy object */
16689 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
16690 		Z_ADDREF_P(objval);
16691 		binary_op(objval, objval, value TSRMLS_CC);
16692 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
16693 		zval_ptr_dtor(&objval);
16694 	} else {
16695 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
16696 	}
16697 
16698 	if (RETURN_VALUE_USED(opline)) {
16699 		PZVAL_LOCK(*var_ptr);
16700 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
16701 	}
16702 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16703 
16704 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
16705 		FREE_OP(free_op_data1);
16706 		FREE_OP_VAR_PTR(free_op_data2);
16707 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16708 		CHECK_EXCEPTION();
16709 		ZEND_VM_INC_OPCODE();
16710 	} else {
16711 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16712 		CHECK_EXCEPTION();
16713 	}
16714 	ZEND_VM_NEXT_OPCODE();
16715 }
16716 
ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16717 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16718 {
16719 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16720 }
16721 
ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16722 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16723 {
16724 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16725 }
16726 
ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16727 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16728 {
16729 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16730 }
16731 
ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16732 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16733 {
16734 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16735 }
16736 
ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16737 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16738 {
16739 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16740 }
16741 
ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16742 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16743 {
16744 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16745 }
16746 
ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16747 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16748 {
16749 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16750 }
16751 
ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16752 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16753 {
16754 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16755 }
16756 
ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16757 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16758 {
16759 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16760 }
16761 
ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16762 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16763 {
16764 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16765 }
16766 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16767 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16768 {
16769 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16770 }
16771 
zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)16772 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
16773 {
16774 	USE_OPLINE
16775 	zend_free_op free_op1, free_op2;
16776 	zval **object_ptr;
16777 	zval *object;
16778 	zval *property;
16779 	zval **retval;
16780 	int have_get_ptr = 0;
16781 
16782 	SAVE_OPLINE();
16783 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16784 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16785 	retval = &EX_T(opline->result.var).var.ptr;
16786 
16787 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
16788 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
16789 	}
16790 
16791 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
16792 	object = *object_ptr;
16793 
16794 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
16795 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16796 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16797 		if (RETURN_VALUE_USED(opline)) {
16798 			PZVAL_LOCK(&EG(uninitialized_zval));
16799 			*retval = &EG(uninitialized_zval);
16800 		}
16801 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16802 		CHECK_EXCEPTION();
16803 		ZEND_VM_NEXT_OPCODE();
16804 	}
16805 
16806 	/* here we are sure we are dealing with an object */
16807 
16808 	if (0) {
16809 		MAKE_REAL_ZVAL_PTR(property);
16810 	}
16811 
16812 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
16813 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16814 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
16815 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
16816 
16817 			have_get_ptr = 1;
16818 			incdec_op(*zptr);
16819 			if (RETURN_VALUE_USED(opline)) {
16820 				*retval = *zptr;
16821 				PZVAL_LOCK(*retval);
16822 			}
16823 		}
16824 	}
16825 
16826 	if (!have_get_ptr) {
16827 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
16828 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16829 
16830 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
16831 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
16832 
16833 				if (Z_REFCOUNT_P(z) == 0) {
16834 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
16835 					zval_dtor(z);
16836 					FREE_ZVAL(z);
16837 				}
16838 				z = value;
16839 			}
16840 			Z_ADDREF_P(z);
16841 			SEPARATE_ZVAL_IF_NOT_REF(&z);
16842 			incdec_op(z);
16843 			*retval = z;
16844 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16845 			SELECTIVE_PZVAL_LOCK(*retval, opline);
16846 			zval_ptr_dtor(&z);
16847 		} else {
16848 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16849 			if (RETURN_VALUE_USED(opline)) {
16850 				PZVAL_LOCK(&EG(uninitialized_zval));
16851 				*retval = &EG(uninitialized_zval);
16852 			}
16853 		}
16854 	}
16855 
16856 	if (0) {
16857 		zval_ptr_dtor(&property);
16858 	} else {
16859 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16860 	}
16861 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16862 	CHECK_EXCEPTION();
16863 	ZEND_VM_NEXT_OPCODE();
16864 }
16865 
ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16866 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16867 {
16868 	return zend_pre_incdec_property_helper_SPEC_VAR_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16869 }
16870 
ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16871 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16872 {
16873 	return zend_pre_incdec_property_helper_SPEC_VAR_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16874 }
16875 
zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)16876 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
16877 {
16878 	USE_OPLINE
16879 	zend_free_op free_op1, free_op2;
16880 	zval **object_ptr;
16881 	zval *object;
16882 	zval *property;
16883 	zval *retval;
16884 	int have_get_ptr = 0;
16885 
16886 	SAVE_OPLINE();
16887 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16888 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
16889 	retval = &EX_T(opline->result.var).tmp_var;
16890 
16891 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
16892 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
16893 	}
16894 
16895 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
16896 	object = *object_ptr;
16897 
16898 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
16899 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16900 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16901 		ZVAL_NULL(retval);
16902 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16903 		CHECK_EXCEPTION();
16904 		ZEND_VM_NEXT_OPCODE();
16905 	}
16906 
16907 	/* here we are sure we are dealing with an object */
16908 
16909 	if (0) {
16910 		MAKE_REAL_ZVAL_PTR(property);
16911 	}
16912 
16913 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
16914 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16915 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
16916 			have_get_ptr = 1;
16917 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
16918 
16919 			ZVAL_COPY_VALUE(retval, *zptr);
16920 			zendi_zval_copy_ctor(*retval);
16921 
16922 			incdec_op(*zptr);
16923 
16924 		}
16925 	}
16926 
16927 	if (!have_get_ptr) {
16928 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
16929 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16930 			zval *z_copy;
16931 
16932 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
16933 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
16934 
16935 				if (Z_REFCOUNT_P(z) == 0) {
16936 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
16937 					zval_dtor(z);
16938 					FREE_ZVAL(z);
16939 				}
16940 				z = value;
16941 			}
16942 			ZVAL_COPY_VALUE(retval, z);
16943 			zendi_zval_copy_ctor(*retval);
16944 			ALLOC_ZVAL(z_copy);
16945 			INIT_PZVAL_COPY(z_copy, z);
16946 			zendi_zval_copy_ctor(*z_copy);
16947 			incdec_op(z_copy);
16948 			Z_ADDREF_P(z);
16949 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16950 			zval_ptr_dtor(&z_copy);
16951 			zval_ptr_dtor(&z);
16952 		} else {
16953 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16954 			ZVAL_NULL(retval);
16955 		}
16956 	}
16957 
16958 	if (0) {
16959 		zval_ptr_dtor(&property);
16960 	} else {
16961 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
16962 	}
16963 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16964 	CHECK_EXCEPTION();
16965 	ZEND_VM_NEXT_OPCODE();
16966 }
16967 
ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16968 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16969 {
16970 	return zend_post_incdec_property_helper_SPEC_VAR_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16971 }
16972 
ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16973 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16974 {
16975 	return zend_post_incdec_property_helper_SPEC_VAR_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16976 }
16977 
zend_fetch_var_address_helper_SPEC_VAR_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)16978 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
16979 {
16980 	USE_OPLINE
16981 	zend_free_op free_op1;
16982 	zval *varname;
16983 	zval **retval;
16984 	zval tmp_varname;
16985 	HashTable *target_symbol_table;
16986 	ulong hash_value;
16987 
16988 	SAVE_OPLINE();
16989 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
16990 
16991  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
16992 		ZVAL_COPY_VALUE(&tmp_varname, varname);
16993 		zval_copy_ctor(&tmp_varname);
16994 		Z_SET_REFCOUNT(tmp_varname, 1);
16995 		Z_UNSET_ISREF(tmp_varname);
16996 		convert_to_string(&tmp_varname);
16997 		varname = &tmp_varname;
16998 	}
16999 
17000 	if (IS_VAR != IS_UNUSED) {
17001 		zend_class_entry *ce;
17002 
17003 		if (IS_VAR == IS_CONST) {
17004 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
17005 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
17006 			} else {
17007 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
17008 				if (UNEXPECTED(ce == NULL)) {
17009 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
17010 						zval_dtor(&tmp_varname);
17011 					}
17012 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17013 					CHECK_EXCEPTION();
17014 					ZEND_VM_NEXT_OPCODE();
17015 				}
17016 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
17017 			}
17018 		} else {
17019 			ce = EX_T(opline->op2.var).class_entry;
17020 		}
17021 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
17022 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17023 	} else {
17024 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
17025 /*
17026 		if (!target_symbol_table) {
17027 			CHECK_EXCEPTION();
17028 			ZEND_VM_NEXT_OPCODE();
17029 		}
17030 */
17031 		if (IS_VAR == IS_CONST) {
17032 			hash_value = Z_HASH_P(varname);
17033 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
17034 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
17035 		} else {
17036 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
17037 		}
17038 
17039 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
17040 			switch (type) {
17041 				case BP_VAR_R:
17042 				case BP_VAR_UNSET:
17043 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
17044 					/* break missing intentionally */
17045 				case BP_VAR_IS:
17046 					retval = &EG(uninitialized_zval_ptr);
17047 					break;
17048 				case BP_VAR_RW:
17049 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
17050 					/* break missing intentionally */
17051 				case BP_VAR_W:
17052 					Z_ADDREF_P(&EG(uninitialized_zval));
17053 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
17054 					break;
17055 				EMPTY_SWITCH_DEFAULT_CASE()
17056 			}
17057 		}
17058 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
17059 			case ZEND_FETCH_GLOBAL:
17060 				if (IS_VAR != IS_TMP_VAR) {
17061 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17062 				}
17063 				break;
17064 			case ZEND_FETCH_LOCAL:
17065 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17066 				break;
17067 			case ZEND_FETCH_STATIC:
17068 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
17069 				break;
17070 			case ZEND_FETCH_GLOBAL_LOCK:
17071 				if (IS_VAR == IS_VAR && !free_op1.var) {
17072 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
17073 				}
17074 				break;
17075 		}
17076 	}
17077 
17078 
17079 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
17080 		zval_dtor(&tmp_varname);
17081 	}
17082 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
17083 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
17084 	}
17085 	PZVAL_LOCK(*retval);
17086 	switch (type) {
17087 		case BP_VAR_R:
17088 		case BP_VAR_IS:
17089 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
17090 			break;
17091 		case BP_VAR_UNSET: {
17092 			zend_free_op free_res;
17093 
17094 			PZVAL_UNLOCK(*retval, &free_res);
17095 			if (retval != &EG(uninitialized_zval_ptr)) {
17096 				SEPARATE_ZVAL_IF_NOT_REF(retval);
17097 			}
17098 			PZVAL_LOCK(*retval);
17099 			FREE_OP_VAR_PTR(free_res);
17100 		}
17101 		/* break missing intentionally */
17102 		default:
17103 			EX_T(opline->result.var).var.ptr_ptr = retval;
17104 			break;
17105 	}
17106 	CHECK_EXCEPTION();
17107 	ZEND_VM_NEXT_OPCODE();
17108 }
17109 
ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17110 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17111 {
17112 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17113 }
17114 
ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17115 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17116 {
17117 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17118 }
17119 
ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17120 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17121 {
17122 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17123 }
17124 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17125 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17126 {
17127 	USE_OPLINE
17128 
17129 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17130 }
17131 
ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17132 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17133 {
17134 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17135 }
17136 
ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17137 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17138 {
17139 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17140 }
17141 
ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17142 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17143 {
17144 	USE_OPLINE
17145 	zend_free_op free_op1, free_op2;
17146 	zval *container;
17147 
17148 	SAVE_OPLINE();
17149 
17150 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
17151 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
17152 	}
17153 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17154 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
17155 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17156 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17157 	CHECK_EXCEPTION();
17158 	ZEND_VM_NEXT_OPCODE();
17159 }
17160 
ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17161 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17162 {
17163 	USE_OPLINE
17164 	zend_free_op free_op1, free_op2;
17165 	zval **container;
17166 
17167 	SAVE_OPLINE();
17168 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17169 
17170 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17171 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17172 	}
17173 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
17174 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17175 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17176 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17177 	}
17178 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17179 
17180 	/* We are going to assign the result by reference */
17181 	if (UNEXPECTED(opline->extended_value != 0)) {
17182 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17183 
17184 		if (retval_ptr) {
17185 			Z_DELREF_PP(retval_ptr);
17186 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
17187 			Z_ADDREF_PP(retval_ptr);
17188 		}
17189 	}
17190 
17191 	CHECK_EXCEPTION();
17192 	ZEND_VM_NEXT_OPCODE();
17193 }
17194 
ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17195 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17196 {
17197 	USE_OPLINE
17198 	zend_free_op free_op1, free_op2;
17199 	zval **container;
17200 
17201 	SAVE_OPLINE();
17202 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17203 
17204 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17205 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17206 	}
17207 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_RW TSRMLS_CC);
17208 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17209 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17210 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17211 	}
17212 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17213 	CHECK_EXCEPTION();
17214 	ZEND_VM_NEXT_OPCODE();
17215 }
17216 
ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17217 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17218 {
17219 	USE_OPLINE
17220 	zend_free_op free_op1, free_op2;
17221 	zval *container;
17222 
17223 	SAVE_OPLINE();
17224 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17225 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_IS TSRMLS_CC);
17226 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17227 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17228 	CHECK_EXCEPTION();
17229 	ZEND_VM_NEXT_OPCODE();
17230 }
17231 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17232 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17233 {
17234 	USE_OPLINE
17235 	zend_free_op free_op1, free_op2;
17236 
17237 	SAVE_OPLINE();
17238 
17239 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
17240 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17241 
17242 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17243 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17244 		}
17245 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
17246 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17247 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17248 		}
17249 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17250 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17251 	} else {
17252 		zval *container;
17253 
17254 		if (IS_VAR == IS_UNUSED) {
17255 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
17256 		}
17257 		container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17258 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
17259 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17260 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17261 	}
17262 	CHECK_EXCEPTION();
17263 	ZEND_VM_NEXT_OPCODE();
17264 }
17265 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17266 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17267 {
17268 	USE_OPLINE
17269 	zend_free_op free_op1, free_op2;
17270 	zval **container;
17271 
17272 	SAVE_OPLINE();
17273 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17274 
17275 	if (IS_VAR == IS_CV) {
17276 		if (container != &EG(uninitialized_zval_ptr)) {
17277 			SEPARATE_ZVAL_IF_NOT_REF(container);
17278 		}
17279 	}
17280 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17281 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17282 	}
17283 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_UNSET TSRMLS_CC);
17284 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17285 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17286 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17287 	}
17288 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17289 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
17290 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
17291 	} else {
17292 		zend_free_op free_res;
17293 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17294 
17295 		PZVAL_UNLOCK(*retval_ptr, &free_res);
17296 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
17297 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
17298 		}
17299 		PZVAL_LOCK(*retval_ptr);
17300 		FREE_OP_VAR_PTR(free_res);
17301 		CHECK_EXCEPTION();
17302 		ZEND_VM_NEXT_OPCODE();
17303 	}
17304 }
17305 
zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS)17306 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS)
17307 {
17308 	USE_OPLINE
17309 	zend_free_op free_op1;
17310 	zval *container;
17311 	zend_free_op free_op2;
17312 	zval *offset;
17313 
17314 	SAVE_OPLINE();
17315 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17316 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17317 
17318 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
17319 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
17320 		zend_error(E_NOTICE, "Trying to get property of non-object");
17321 		PZVAL_LOCK(&EG(uninitialized_zval));
17322 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17323 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17324 	} else {
17325 		zval *retval;
17326 
17327 		if (0) {
17328 			MAKE_REAL_ZVAL_PTR(offset);
17329 		}
17330 
17331 		/* here we are sure we are dealing with an object */
17332 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17333 
17334 		PZVAL_LOCK(retval);
17335 		AI_SET_PTR(&EX_T(opline->result.var), retval);
17336 
17337 		if (0) {
17338 			zval_ptr_dtor(&offset);
17339 		} else {
17340 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17341 		}
17342 	}
17343 
17344 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17345 	CHECK_EXCEPTION();
17346 	ZEND_VM_NEXT_OPCODE();
17347 }
17348 
ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17349 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17350 {
17351 	return zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17352 }
17353 
ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17354 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17355 {
17356 	USE_OPLINE
17357 	zend_free_op free_op1, free_op2;
17358 	zval *property;
17359 	zval **container;
17360 
17361 	SAVE_OPLINE();
17362 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17363 
17364 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
17365 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
17366 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
17367 	}
17368 
17369 	if (0) {
17370 		MAKE_REAL_ZVAL_PTR(property);
17371 	}
17372 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17373 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17374 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17375 	}
17376 
17377 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
17378 	if (0) {
17379 		zval_ptr_dtor(&property);
17380 	} else {
17381 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17382 	}
17383 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17384 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17385 	}
17386 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17387 
17388 	/* We are going to assign the result by reference */
17389 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
17390 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17391 
17392 		Z_DELREF_PP(retval_ptr);
17393 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
17394 		Z_ADDREF_PP(retval_ptr);
17395 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
17396 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
17397 	}
17398 
17399 	CHECK_EXCEPTION();
17400 	ZEND_VM_NEXT_OPCODE();
17401 }
17402 
ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17403 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17404 {
17405 	USE_OPLINE
17406 	zend_free_op free_op1, free_op2;
17407 	zval *property;
17408 	zval **container;
17409 
17410 	SAVE_OPLINE();
17411 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17412 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17413 
17414 	if (0) {
17415 		MAKE_REAL_ZVAL_PTR(property);
17416 	}
17417 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17418 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17419 	}
17420 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
17421 	if (0) {
17422 		zval_ptr_dtor(&property);
17423 	} else {
17424 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17425 	}
17426 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17427 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17428 	}
17429 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17430 	CHECK_EXCEPTION();
17431 	ZEND_VM_NEXT_OPCODE();
17432 }
17433 
ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17434 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17435 {
17436 	USE_OPLINE
17437 	zend_free_op free_op1;
17438 	zval *container;
17439 	zend_free_op free_op2;
17440 	zval *offset;
17441 
17442 	SAVE_OPLINE();
17443 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17444 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17445 
17446 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
17447 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
17448 		PZVAL_LOCK(&EG(uninitialized_zval));
17449 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17450 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17451 	} else {
17452 		zval *retval;
17453 
17454 		if (0) {
17455 			MAKE_REAL_ZVAL_PTR(offset);
17456 		}
17457 
17458 		/* here we are sure we are dealing with an object */
17459 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17460 
17461 		PZVAL_LOCK(retval);
17462 		AI_SET_PTR(&EX_T(opline->result.var), retval);
17463 
17464 		if (0) {
17465 			zval_ptr_dtor(&offset);
17466 		} else {
17467 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17468 		}
17469 	}
17470 
17471 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17472 	CHECK_EXCEPTION();
17473 	ZEND_VM_NEXT_OPCODE();
17474 }
17475 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17476 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17477 {
17478 	USE_OPLINE
17479 
17480 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
17481 		/* Behave like FETCH_OBJ_W */
17482 		zend_free_op free_op1, free_op2;
17483 		zval *property;
17484 		zval **container;
17485 
17486 		SAVE_OPLINE();
17487 		property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17488 		container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17489 
17490 		if (0) {
17491 			MAKE_REAL_ZVAL_PTR(property);
17492 		}
17493 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17494 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17495 		}
17496 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
17497 		if (0) {
17498 			zval_ptr_dtor(&property);
17499 		} else {
17500 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17501 		}
17502 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17503 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17504 		}
17505 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17506 		CHECK_EXCEPTION();
17507 		ZEND_VM_NEXT_OPCODE();
17508 	} else {
17509 		return zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17510 	}
17511 }
17512 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17513 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17514 {
17515 	USE_OPLINE
17516 	zend_free_op free_op1, free_op2, free_res;
17517 	zval **container;
17518 	zval *property;
17519 
17520 	SAVE_OPLINE();
17521 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17522 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17523 
17524 	if (IS_VAR == IS_CV) {
17525 		if (container != &EG(uninitialized_zval_ptr)) {
17526 			SEPARATE_ZVAL_IF_NOT_REF(container);
17527 		}
17528 	}
17529 	if (0) {
17530 		MAKE_REAL_ZVAL_PTR(property);
17531 	}
17532 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17533 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17534 	}
17535 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
17536 	if (0) {
17537 		zval_ptr_dtor(&property);
17538 	} else {
17539 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17540 	}
17541 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17542 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17543 	}
17544 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17545 
17546 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
17547 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
17548 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
17549 	}
17550 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
17551 	FREE_OP_VAR_PTR(free_res);
17552 	CHECK_EXCEPTION();
17553 	ZEND_VM_NEXT_OPCODE();
17554 }
17555 
ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17556 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17557 {
17558 	USE_OPLINE
17559 	zend_free_op free_op1, free_op2;
17560 	zval **object_ptr;
17561 	zval *property_name;
17562 
17563 	SAVE_OPLINE();
17564 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17565 	property_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17566 
17567 	if (0) {
17568 		MAKE_REAL_ZVAL_PTR(property_name);
17569 	}
17570 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
17571 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17572 	}
17573 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17574 	if (0) {
17575 		zval_ptr_dtor(&property_name);
17576 	} else {
17577 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17578 	}
17579 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17580 	/* assign_obj has two opcodes! */
17581 	CHECK_EXCEPTION();
17582 	ZEND_VM_INC_OPCODE();
17583 	ZEND_VM_NEXT_OPCODE();
17584 }
17585 
ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17586 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17587 {
17588 	USE_OPLINE
17589 	zend_free_op free_op1;
17590 	zval **object_ptr;
17591 
17592 	SAVE_OPLINE();
17593 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17594 
17595 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
17596 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17597 	}
17598 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
17599 		zend_free_op free_op2;
17600 		zval *property_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17601 
17602 		if (0) {
17603 			MAKE_REAL_ZVAL_PTR(property_name);
17604 		}
17605 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17606 		if (0) {
17607 			zval_ptr_dtor(&property_name);
17608 		} else {
17609 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17610 		}
17611 	} else {
17612 		zend_free_op free_op2, free_op_data1, free_op_data2;
17613 		zval *value;
17614 		zval *dim = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17615 		zval **variable_ptr_ptr;
17616 
17617 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_VAR, BP_VAR_W TSRMLS_CC);
17618 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17619 
17620 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
17621 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
17622 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
17623 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
17624 				if (RETURN_VALUE_USED(opline)) {
17625 					zval *retval;
17626 
17627 					ALLOC_ZVAL(retval);
17628 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
17629 					INIT_PZVAL(retval);
17630 					AI_SET_PTR(&EX_T(opline->result.var), retval);
17631 				}
17632 			} else if (RETURN_VALUE_USED(opline)) {
17633 				PZVAL_LOCK(&EG(uninitialized_zval));
17634 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17635 			}
17636 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
17637 			if (IS_TMP_FREE(free_op_data1)) {
17638 				zval_dtor(value);
17639 			}
17640 			if (RETURN_VALUE_USED(opline)) {
17641 				PZVAL_LOCK(&EG(uninitialized_zval));
17642 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17643 			}
17644 		} else {
17645 			if ((opline+1)->op1_type == IS_TMP_VAR) {
17646 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17647 			} else if ((opline+1)->op1_type == IS_CONST) {
17648 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17649 			} else {
17650 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17651 			}
17652 			if (RETURN_VALUE_USED(opline)) {
17653 				PZVAL_LOCK(value);
17654 				AI_SET_PTR(&EX_T(opline->result.var), value);
17655 			}
17656 		}
17657 		FREE_OP_VAR_PTR(free_op_data2);
17658 	 	FREE_OP_IF_VAR(free_op_data1);
17659 	}
17660  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17661 	/* assign_dim has two opcodes! */
17662 	CHECK_EXCEPTION();
17663 	ZEND_VM_INC_OPCODE();
17664 	ZEND_VM_NEXT_OPCODE();
17665 }
17666 
ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17667 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17668 {
17669 	USE_OPLINE
17670 	zend_free_op free_op1, free_op2;
17671 	zval *value;
17672 	zval **variable_ptr_ptr;
17673 
17674 	SAVE_OPLINE();
17675 	value = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17676 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17677 
17678 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
17679 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_VAR TSRMLS_CC)) {
17680 			if (RETURN_VALUE_USED(opline)) {
17681 				zval *retval;
17682 
17683 				ALLOC_ZVAL(retval);
17684 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
17685 				INIT_PZVAL(retval);
17686 				AI_SET_PTR(&EX_T(opline->result.var), retval);
17687 			}
17688 		} else if (RETURN_VALUE_USED(opline)) {
17689 			PZVAL_LOCK(&EG(uninitialized_zval));
17690 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17691 		}
17692 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
17693 		if (0) {
17694 			zval_dtor(value);
17695 		}
17696 		if (RETURN_VALUE_USED(opline)) {
17697 			PZVAL_LOCK(&EG(uninitialized_zval));
17698 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17699 		}
17700 	} else {
17701 		if (IS_VAR == IS_TMP_VAR) {
17702 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17703 		} else if (IS_VAR == IS_CONST) {
17704 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17705 		} else {
17706 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17707 		}
17708 		if (RETURN_VALUE_USED(opline)) {
17709 			PZVAL_LOCK(value);
17710 			AI_SET_PTR(&EX_T(opline->result.var), value);
17711 		}
17712 	}
17713 
17714 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17715 
17716 	/* zend_assign_to_variable() always takes care of op2, never free it! */
17717  	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17718 
17719 	CHECK_EXCEPTION();
17720 	ZEND_VM_NEXT_OPCODE();
17721 }
17722 
ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17723 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17724 {
17725 	USE_OPLINE
17726 	zend_free_op free_op1, free_op2;
17727 	zval **variable_ptr_ptr;
17728 	zval **value_ptr_ptr;
17729 
17730 	SAVE_OPLINE();
17731 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17732 
17733 	if (IS_VAR == IS_VAR &&
17734 	    value_ptr_ptr &&
17735 	    !Z_ISREF_PP(value_ptr_ptr) &&
17736 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
17737 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
17738 		if (free_op2.var == NULL) {
17739 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
17740 		}
17741 		zend_error(E_STRICT, "Only variables should be assigned by reference");
17742 		if (UNEXPECTED(EG(exception) != NULL)) {
17743 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17744 			HANDLE_EXCEPTION();
17745 		}
17746 		return ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17747 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
17748 		PZVAL_LOCK(*value_ptr_ptr);
17749 	}
17750 	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
17751 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
17752 	}
17753 
17754 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17755 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
17756 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
17757 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
17758 	}
17759 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
17760 
17761 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
17762 		Z_DELREF_PP(variable_ptr_ptr);
17763 	}
17764 
17765 	if (RETURN_VALUE_USED(opline)) {
17766 		PZVAL_LOCK(*variable_ptr_ptr);
17767 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
17768 	}
17769 
17770 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17771 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17772 
17773 	CHECK_EXCEPTION();
17774 	ZEND_VM_NEXT_OPCODE();
17775 }
17776 
ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17777 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17778 {
17779 	USE_OPLINE
17780 	zval *function_name;
17781 	char *function_name_strval;
17782 	int function_name_strlen;
17783 	zend_free_op free_op1, free_op2;
17784 
17785 	SAVE_OPLINE();
17786 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
17787 
17788 	function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17789 
17790 	if (IS_VAR != IS_CONST &&
17791 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
17792 		zend_error_noreturn(E_ERROR, "Method name must be a string");
17793 	}
17794 
17795 	function_name_strval = Z_STRVAL_P(function_name);
17796 	function_name_strlen = Z_STRLEN_P(function_name);
17797 
17798 	EX(object) = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17799 
17800 	if (EXPECTED(EX(object) != NULL) &&
17801 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
17802 		EX(called_scope) = Z_OBJCE_P(EX(object));
17803 
17804 		if (IS_VAR != IS_CONST ||
17805 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
17806 		    zval *object = EX(object);
17807 
17808 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
17809 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
17810 			}
17811 
17812 			/* First, locate the function. */
17813 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
17814 			if (UNEXPECTED(EX(fbc) == NULL)) {
17815 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
17816 			}
17817 			if (IS_VAR == IS_CONST &&
17818 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
17819 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
17820 			    EXPECTED(EX(object) == object)) {
17821 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
17822 			}
17823 		}
17824 	} else {
17825 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
17826 	}
17827 
17828 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
17829 		EX(object) = NULL;
17830 	} else {
17831 		if (!PZVAL_IS_REF(EX(object))) {
17832 			Z_ADDREF_P(EX(object)); /* For $this pointer */
17833 		} else {
17834 			zval *this_ptr;
17835 			ALLOC_ZVAL(this_ptr);
17836 			INIT_PZVAL_COPY(this_ptr, EX(object));
17837 			zval_copy_ctor(this_ptr);
17838 			EX(object) = this_ptr;
17839 		}
17840 	}
17841 
17842 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17843 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17844 
17845 	CHECK_EXCEPTION();
17846 	ZEND_VM_NEXT_OPCODE();
17847 }
17848 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17849 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17850 {
17851 	USE_OPLINE
17852 	zval *function_name;
17853 	zend_class_entry *ce;
17854 
17855 	SAVE_OPLINE();
17856 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
17857 
17858 	if (IS_VAR == IS_CONST) {
17859 		/* no function found. try a static method in class */
17860 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
17861 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
17862 		} else {
17863 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
17864 			if (UNEXPECTED(EG(exception) != NULL)) {
17865 				HANDLE_EXCEPTION();
17866 			}
17867 			if (UNEXPECTED(ce == NULL)) {
17868 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
17869 			}
17870 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
17871 		}
17872 		EX(called_scope) = ce;
17873 	} else {
17874 		ce = EX_T(opline->op1.var).class_entry;
17875 
17876 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
17877 			EX(called_scope) = EG(called_scope);
17878 		} else {
17879 			EX(called_scope) = ce;
17880 		}
17881 	}
17882 
17883 	if (IS_VAR == IS_CONST &&
17884 	    IS_VAR == IS_CONST &&
17885 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
17886 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
17887 	} else if (IS_VAR != IS_CONST &&
17888 	           IS_VAR == IS_CONST &&
17889 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
17890 		/* do nothing */
17891 	} else if (IS_VAR != IS_UNUSED) {
17892 		char *function_name_strval = NULL;
17893 		int function_name_strlen = 0;
17894 		zend_free_op free_op2;
17895 
17896 		if (IS_VAR == IS_CONST) {
17897 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
17898 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
17899 		} else {
17900 			function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
17901 
17902 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
17903 				zend_error_noreturn(E_ERROR, "Function name must be a string");
17904 			} else {
17905 				function_name_strval = Z_STRVAL_P(function_name);
17906 				function_name_strlen = Z_STRLEN_P(function_name);
17907  			}
17908 		}
17909 
17910 		if (function_name_strval) {
17911 			if (ce->get_static_method) {
17912 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
17913 			} else {
17914 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
17915 			}
17916 			if (UNEXPECTED(EX(fbc) == NULL)) {
17917 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
17918 			}
17919 			if (IS_VAR == IS_CONST &&
17920 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
17921 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
17922 				if (IS_VAR == IS_CONST) {
17923 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
17924 				} else {
17925 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
17926 				}
17927 			}
17928 		}
17929 		if (IS_VAR != IS_CONST) {
17930 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17931 		}
17932 	} else {
17933 		if (UNEXPECTED(ce->constructor == NULL)) {
17934 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
17935 		}
17936 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
17937 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
17938 		}
17939 		EX(fbc) = ce->constructor;
17940 	}
17941 
17942 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
17943 		EX(object) = NULL;
17944 	} else {
17945 		if (EG(This) &&
17946 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
17947 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
17948 		    /* We are calling method of the other (incompatible) class,
17949 		       but passing $this. This is done for compatibility with php-4. */
17950 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
17951 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
17952 			} else {
17953 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
17954 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
17955 			}
17956 		}
17957 		if ((EX(object) = EG(This))) {
17958 			Z_ADDREF_P(EX(object));
17959 			EX(called_scope) = Z_OBJCE_P(EX(object));
17960 		}
17961 	}
17962 
17963 	CHECK_EXCEPTION();
17964 	ZEND_VM_NEXT_OPCODE();
17965 }
17966 
ZEND_CASE_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17967 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17968 {
17969 	USE_OPLINE
17970 	zend_free_op free_op1, free_op2;
17971 
17972 	SAVE_OPLINE();
17973 	if (IS_VAR==IS_VAR) {
17974 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
17975 	}
17976 	is_equal_function(&EX_T(opline->result.var).tmp_var,
17977 				 _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
17978 				 _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
17979 
17980 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
17981 	CHECK_EXCEPTION();
17982 	ZEND_VM_NEXT_OPCODE();
17983 }
17984 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17985 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17986 {
17987 	USE_OPLINE
17988 	zend_free_op free_op1;
17989 	zval *expr_ptr;
17990 
17991 	SAVE_OPLINE();
17992 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
17993 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
17994 
17995 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
17996 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
17997 		}
17998 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
17999 		expr_ptr = *expr_ptr_ptr;
18000 		Z_ADDREF_P(expr_ptr);
18001 	} else {
18002 		expr_ptr=_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18003 		if (0) { /* temporary variable */
18004 			zval *new_expr;
18005 
18006 			ALLOC_ZVAL(new_expr);
18007 			INIT_PZVAL_COPY(new_expr, expr_ptr);
18008 			expr_ptr = new_expr;
18009 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
18010 			zval *new_expr;
18011 
18012 			ALLOC_ZVAL(new_expr);
18013 			INIT_PZVAL_COPY(new_expr, expr_ptr);
18014 			expr_ptr = new_expr;
18015 			zendi_zval_copy_ctor(*expr_ptr);
18016 		} else {
18017 			Z_ADDREF_P(expr_ptr);
18018 		}
18019 	}
18020 
18021 	if (IS_VAR != IS_UNUSED) {
18022 		zend_free_op free_op2;
18023 		zval *offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
18024 		ulong hval;
18025 
18026 		switch (Z_TYPE_P(offset)) {
18027 			case IS_DOUBLE:
18028 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
18029 				goto num_index;
18030 			case IS_LONG:
18031 			case IS_BOOL:
18032 				hval = Z_LVAL_P(offset);
18033 num_index:
18034 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
18035 				break;
18036 			case IS_STRING:
18037 				if (IS_VAR == IS_CONST) {
18038 					hval = Z_HASH_P(offset);
18039 				} else {
18040 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
18041 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
18042 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
18043 					} else {
18044 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
18045 					}
18046 				}
18047 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
18048 				break;
18049 			case IS_NULL:
18050 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
18051 				break;
18052 			default:
18053 				zend_error(E_WARNING, "Illegal offset type");
18054 				zval_ptr_dtor(&expr_ptr);
18055 				/* do nothing */
18056 				break;
18057 		}
18058 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18059 	} else {
18060 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
18061 	}
18062 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
18063 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18064 	} else {
18065 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18066 	}
18067 	CHECK_EXCEPTION();
18068 	ZEND_VM_NEXT_OPCODE();
18069 }
18070 
ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18071 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18072 {
18073 	USE_OPLINE
18074 
18075 	array_init(&EX_T(opline->result.var).tmp_var);
18076 	if (IS_VAR == IS_UNUSED) {
18077 		ZEND_VM_NEXT_OPCODE();
18078 #if 0 || IS_VAR != IS_UNUSED
18079 	} else {
18080 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18081 #endif
18082 	}
18083 }
18084 
ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18085 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18086 {
18087 	USE_OPLINE
18088 	zval tmp, *varname;
18089 	HashTable *target_symbol_table;
18090 	zend_free_op free_op1;
18091 
18092 	SAVE_OPLINE();
18093 	if (IS_VAR == IS_CV &&
18094 	    IS_VAR == IS_UNUSED &&
18095 	    (opline->extended_value & ZEND_QUICK_SET)) {
18096 		if (EG(active_symbol_table)) {
18097 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
18098 
18099 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
18100 			EX_CV(opline->op1.var) = NULL;
18101 		} else if (EX_CV(opline->op1.var)) {
18102 			zval_ptr_dtor(EX_CV(opline->op1.var));
18103 			EX_CV(opline->op1.var) = NULL;
18104 		}
18105 		CHECK_EXCEPTION();
18106 		ZEND_VM_NEXT_OPCODE();
18107 	}
18108 
18109 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18110 
18111 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
18112 		ZVAL_COPY_VALUE(&tmp, varname);
18113 		zval_copy_ctor(&tmp);
18114 		convert_to_string(&tmp);
18115 		varname = &tmp;
18116 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
18117 		Z_ADDREF_P(varname);
18118 	}
18119 
18120 	if (IS_VAR != IS_UNUSED) {
18121 		zend_class_entry *ce;
18122 
18123 		if (IS_VAR == IS_CONST) {
18124 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
18125 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
18126 			} else {
18127 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
18128 				if (UNEXPECTED(EG(exception) != NULL)) {
18129 					if (IS_VAR != IS_CONST && varname == &tmp) {
18130 						zval_dtor(&tmp);
18131 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
18132 						zval_ptr_dtor(&varname);
18133 					}
18134 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18135 					HANDLE_EXCEPTION();
18136 				}
18137 				if (UNEXPECTED(ce == NULL)) {
18138 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
18139 				}
18140 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
18141 			}
18142 		} else {
18143 			ce = EX_T(opline->op2.var).class_entry;
18144 		}
18145 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
18146 	} else {
18147 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
18148 
18149 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
18150 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
18151 	}
18152 
18153 	if (IS_VAR != IS_CONST && varname == &tmp) {
18154 		zval_dtor(&tmp);
18155 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
18156 		zval_ptr_dtor(&varname);
18157 	}
18158 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18159 	CHECK_EXCEPTION();
18160 	ZEND_VM_NEXT_OPCODE();
18161 }
18162 
ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18163 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18164 {
18165 	USE_OPLINE
18166 	zend_free_op free_op1, free_op2;
18167 	zval **container;
18168 	zval *offset;
18169 	ulong hval;
18170 
18171 	SAVE_OPLINE();
18172 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18173 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
18174 		SEPARATE_ZVAL_IF_NOT_REF(container);
18175 	}
18176 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
18177 
18178 	if (IS_VAR != IS_VAR || container) {
18179 		switch (Z_TYPE_PP(container)) {
18180 			case IS_ARRAY: {
18181 				HashTable *ht = Z_ARRVAL_PP(container);
18182 
18183 				switch (Z_TYPE_P(offset)) {
18184 					case IS_DOUBLE:
18185 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
18186 						zend_hash_index_del(ht, hval);
18187 						break;
18188 					case IS_RESOURCE:
18189 					case IS_BOOL:
18190 					case IS_LONG:
18191 						hval = Z_LVAL_P(offset);
18192 						zend_hash_index_del(ht, hval);
18193 						break;
18194 					case IS_STRING:
18195 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
18196 							Z_ADDREF_P(offset);
18197 						}
18198 						if (IS_VAR == IS_CONST) {
18199 							hval = Z_HASH_P(offset);
18200 						} else {
18201 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
18202 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
18203 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
18204 							} else {
18205 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
18206 							}
18207 						}
18208 						if (ht == &EG(symbol_table)) {
18209 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
18210 						} else {
18211 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
18212 						}
18213 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
18214 							zval_ptr_dtor(&offset);
18215 						}
18216 						break;
18217 num_index_dim:
18218 						zend_hash_index_del(ht, hval);
18219 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
18220 							zval_ptr_dtor(&offset);
18221 						}
18222 						break;
18223 					case IS_NULL:
18224 						zend_hash_del(ht, "", sizeof(""));
18225 						break;
18226 					default:
18227 						zend_error(E_WARNING, "Illegal offset type in unset");
18228 						break;
18229 				}
18230 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18231 				break;
18232 			}
18233 			case IS_OBJECT:
18234 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
18235 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
18236 				}
18237 				if (0) {
18238 					MAKE_REAL_ZVAL_PTR(offset);
18239 				}
18240 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
18241 				if (0) {
18242 					zval_ptr_dtor(&offset);
18243 				} else {
18244 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18245 				}
18246 				break;
18247 			case IS_STRING:
18248 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
18249 				ZEND_VM_CONTINUE(); /* bailed out before */
18250 			default:
18251 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18252 				break;
18253 		}
18254 	} else {
18255 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18256 	}
18257 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18258 
18259 	CHECK_EXCEPTION();
18260 	ZEND_VM_NEXT_OPCODE();
18261 }
18262 
ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18263 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18264 {
18265 	USE_OPLINE
18266 	zend_free_op free_op1, free_op2;
18267 	zval **container;
18268 	zval *offset;
18269 
18270 	SAVE_OPLINE();
18271 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18272 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
18273 
18274 	if (IS_VAR != IS_VAR || container) {
18275 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
18276 			SEPARATE_ZVAL_IF_NOT_REF(container);
18277 		}
18278 		if (Z_TYPE_PP(container) == IS_OBJECT) {
18279 			if (0) {
18280 				MAKE_REAL_ZVAL_PTR(offset);
18281 			}
18282 			if (Z_OBJ_HT_P(*container)->unset_property) {
18283 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18284 			} else {
18285 				zend_error(E_NOTICE, "Trying to unset property of non-object");
18286 			}
18287 			if (0) {
18288 				zval_ptr_dtor(&offset);
18289 			} else {
18290 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18291 			}
18292 		} else {
18293 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18294 		}
18295 	} else {
18296 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18297 	}
18298 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18299 
18300 	CHECK_EXCEPTION();
18301 	ZEND_VM_NEXT_OPCODE();
18302 }
18303 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18304 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18305 {
18306 	USE_OPLINE
18307 	zval **value;
18308 	zend_bool isset = 1;
18309 
18310 	SAVE_OPLINE();
18311 	if (IS_VAR == IS_CV &&
18312 	    IS_VAR == IS_UNUSED &&
18313 	    (opline->extended_value & ZEND_QUICK_SET)) {
18314 		if (EX_CV(opline->op1.var)) {
18315 			value = EX_CV(opline->op1.var);
18316 		} else if (EG(active_symbol_table)) {
18317 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
18318 
18319 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
18320 				isset = 0;
18321 			}
18322 		} else {
18323 			isset = 0;
18324 		}
18325 	} else {
18326 		HashTable *target_symbol_table;
18327 		zend_free_op free_op1;
18328 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18329 
18330 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
18331 			ZVAL_COPY_VALUE(&tmp, varname);
18332 			zval_copy_ctor(&tmp);
18333 			convert_to_string(&tmp);
18334 			varname = &tmp;
18335 		}
18336 
18337 		if (IS_VAR != IS_UNUSED) {
18338 			zend_class_entry *ce;
18339 
18340 			if (IS_VAR == IS_CONST) {
18341 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
18342 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
18343 				} else {
18344 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
18345 					if (UNEXPECTED(ce == NULL)) {
18346 						CHECK_EXCEPTION();
18347 						ZEND_VM_NEXT_OPCODE();
18348 					}
18349 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
18350 				}
18351 			} else {
18352 				ce = EX_T(opline->op2.var).class_entry;
18353 			}
18354 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
18355 			if (!value) {
18356 				isset = 0;
18357 			}
18358 		} else {
18359 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
18360 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
18361 				isset = 0;
18362 			}
18363 		}
18364 
18365 		if (IS_VAR != IS_CONST && varname == &tmp) {
18366 			zval_dtor(&tmp);
18367 		}
18368 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18369 	}
18370 
18371 	if (opline->extended_value & ZEND_ISSET) {
18372 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
18373 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
18374 		} else {
18375 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
18376 		}
18377 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
18378 		if (!isset || !i_zend_is_true(*value)) {
18379 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
18380 		} else {
18381 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
18382 		}
18383 	}
18384 
18385 	CHECK_EXCEPTION();
18386 	ZEND_VM_NEXT_OPCODE();
18387 }
18388 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)18389 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
18390 {
18391 	USE_OPLINE
18392 	zend_free_op free_op1, free_op2;
18393 	zval **container;
18394 	zval **value = NULL;
18395 	int result = 0;
18396 	ulong hval;
18397 	zval *offset;
18398 
18399 	SAVE_OPLINE();
18400 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18401 
18402 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
18403 
18404 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
18405 		HashTable *ht;
18406 		int isset = 0;
18407 
18408 		ht = Z_ARRVAL_PP(container);
18409 
18410 		switch (Z_TYPE_P(offset)) {
18411 			case IS_DOUBLE:
18412 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
18413 				goto num_index_prop;
18414 			case IS_RESOURCE:
18415 			case IS_BOOL:
18416 			case IS_LONG:
18417 				hval = Z_LVAL_P(offset);
18418 num_index_prop:
18419 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
18420 					isset = 1;
18421 				}
18422 				break;
18423 			case IS_STRING:
18424 				if (IS_VAR == IS_CONST) {
18425 					hval = Z_HASH_P(offset);
18426 				} else {
18427 					if (!prop_dim) {
18428 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
18429 					}
18430 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
18431 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
18432 					} else {
18433 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
18434 					}
18435 				}
18436 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
18437 					isset = 1;
18438 				}
18439 				break;
18440 			case IS_NULL:
18441 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
18442 					isset = 1;
18443 				}
18444 				break;
18445 			default:
18446 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
18447 				break;
18448 		}
18449 
18450 		if (opline->extended_value & ZEND_ISSET) {
18451 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
18452 				result = 0;
18453 			} else {
18454 				result = isset;
18455 			}
18456 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
18457 			if (!isset || !i_zend_is_true(*value)) {
18458 				result = 0;
18459 			} else {
18460 				result = 1;
18461 			}
18462 		}
18463 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18464 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
18465 		if (0) {
18466 			MAKE_REAL_ZVAL_PTR(offset);
18467 		}
18468 		if (prop_dim) {
18469 			if (Z_OBJ_HT_P(*container)->has_property) {
18470 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18471 			} else {
18472 				zend_error(E_NOTICE, "Trying to check property of non-object");
18473 				result = 0;
18474 			}
18475 		} else {
18476 			if (Z_OBJ_HT_P(*container)->has_dimension) {
18477 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
18478 			} else {
18479 				zend_error(E_NOTICE, "Trying to check element of non-array");
18480 				result = 0;
18481 			}
18482 		}
18483 		if (0) {
18484 			zval_ptr_dtor(&offset);
18485 		} else {
18486 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18487 		}
18488 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
18489 		zval tmp;
18490 
18491 		if (Z_TYPE_P(offset) != IS_LONG) {
18492 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
18493 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
18494 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
18495 				ZVAL_COPY_VALUE(&tmp, offset);
18496 				zval_copy_ctor(&tmp);
18497 				convert_to_long(&tmp);
18498 				offset = &tmp;
18499 			} else {
18500 				/* can not be converted to proper offset, return "not set" */
18501 				result = 0;
18502 			}
18503 		}
18504 		if (Z_TYPE_P(offset) == IS_LONG) {
18505 			if (opline->extended_value & ZEND_ISSET) {
18506 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
18507 					result = 1;
18508 				}
18509 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
18510 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
18511 					result = 1;
18512 				}
18513 			}
18514 		}
18515 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18516 	} else {
18517 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18518 	}
18519 
18520 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
18521 	if (opline->extended_value & ZEND_ISSET) {
18522 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
18523 	} else {
18524 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
18525 	}
18526 
18527 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18528 
18529 	CHECK_EXCEPTION();
18530 	ZEND_VM_NEXT_OPCODE();
18531 }
18532 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18533 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18534 {
18535 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18536 }
18537 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18538 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18539 {
18540 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18541 }
18542 
zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)18543 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
18544 {
18545 	USE_OPLINE
18546 	zend_free_op free_op1, free_op_data1;
18547 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18548 	zval *object;
18549 	zval *property = NULL;
18550 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
18551 	int have_get_ptr = 0;
18552 
18553 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
18554 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
18555 	}
18556 
18557 	make_real_object(object_ptr TSRMLS_CC);
18558 	object = *object_ptr;
18559 
18560 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
18561 		zend_error(E_WARNING, "Attempt to assign property of non-object");
18562 
18563 		FREE_OP(free_op_data1);
18564 
18565 		if (RETURN_VALUE_USED(opline)) {
18566 			PZVAL_LOCK(&EG(uninitialized_zval));
18567 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
18568 			EX_T(opline->result.var).var.ptr_ptr = NULL;
18569 		}
18570 	} else {
18571 		/* here we are sure we are dealing with an object */
18572 		if (0) {
18573 			MAKE_REAL_ZVAL_PTR(property);
18574 		}
18575 
18576 		/* here property is a string */
18577 		if (opline->extended_value == ZEND_ASSIGN_OBJ
18578 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
18579 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18580 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
18581 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
18582 
18583 				have_get_ptr = 1;
18584 				binary_op(*zptr, *zptr, value TSRMLS_CC);
18585 				if (RETURN_VALUE_USED(opline)) {
18586 					PZVAL_LOCK(*zptr);
18587 					EX_T(opline->result.var).var.ptr = *zptr;
18588 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18589 				}
18590 			}
18591 		}
18592 
18593 		if (!have_get_ptr) {
18594 			zval *z = NULL;
18595 
18596 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
18597 				if (Z_OBJ_HT_P(object)->read_property) {
18598 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18599 				}
18600 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
18601 				if (Z_OBJ_HT_P(object)->read_dimension) {
18602 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
18603 				}
18604 			}
18605 			if (z) {
18606 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
18607 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
18608 
18609 					if (Z_REFCOUNT_P(z) == 0) {
18610 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
18611 						zval_dtor(z);
18612 						FREE_ZVAL(z);
18613 					}
18614 					z = value;
18615 				}
18616 				Z_ADDREF_P(z);
18617 				SEPARATE_ZVAL_IF_NOT_REF(&z);
18618 				binary_op(z, z, value TSRMLS_CC);
18619 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
18620 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18621 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
18622 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
18623 				}
18624 				if (RETURN_VALUE_USED(opline)) {
18625 					PZVAL_LOCK(z);
18626 					EX_T(opline->result.var).var.ptr = z;
18627 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18628 				}
18629 				zval_ptr_dtor(&z);
18630 			} else {
18631 				zend_error(E_WARNING, "Attempt to assign property of non-object");
18632 				if (RETURN_VALUE_USED(opline)) {
18633 					PZVAL_LOCK(&EG(uninitialized_zval));
18634 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
18635 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18636 				}
18637 			}
18638 		}
18639 
18640 		if (0) {
18641 			zval_ptr_dtor(&property);
18642 		} else {
18643 
18644 		}
18645 		FREE_OP(free_op_data1);
18646 	}
18647 
18648 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18649 	/* assign_obj has two opcodes! */
18650 	CHECK_EXCEPTION();
18651 	ZEND_VM_INC_OPCODE();
18652 	ZEND_VM_NEXT_OPCODE();
18653 }
18654 
zend_binary_assign_op_helper_SPEC_VAR_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)18655 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
18656 {
18657 	USE_OPLINE
18658 	zend_free_op free_op1, free_op_data2, free_op_data1;
18659 	zval **var_ptr;
18660 	zval *value;
18661 
18662 	SAVE_OPLINE();
18663 	switch (opline->extended_value) {
18664 		case ZEND_ASSIGN_OBJ:
18665 			return zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18666 			break;
18667 		case ZEND_ASSIGN_DIM: {
18668 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18669 
18670 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
18671 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
18672 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
18673 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
18674 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
18675 					}
18676 					return zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18677 				} else {
18678 					zval *dim = NULL;
18679 
18680 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
18681 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
18682 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
18683 				}
18684 			}
18685 			break;
18686 		default:
18687 			value = NULL;
18688 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18689 			/* do nothing */
18690 			break;
18691 	}
18692 
18693 	if (UNEXPECTED(var_ptr == NULL)) {
18694 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
18695 	}
18696 
18697 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
18698 		if (RETURN_VALUE_USED(opline)) {
18699 			PZVAL_LOCK(&EG(uninitialized_zval));
18700 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
18701 		}
18702 
18703 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18704 		CHECK_EXCEPTION();
18705 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
18706 			ZEND_VM_INC_OPCODE();
18707 		}
18708 		ZEND_VM_NEXT_OPCODE();
18709 	}
18710 
18711 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
18712 
18713 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
18714 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
18715 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
18716 		/* proxy object */
18717 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
18718 		Z_ADDREF_P(objval);
18719 		binary_op(objval, objval, value TSRMLS_CC);
18720 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
18721 		zval_ptr_dtor(&objval);
18722 	} else {
18723 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
18724 	}
18725 
18726 	if (RETURN_VALUE_USED(opline)) {
18727 		PZVAL_LOCK(*var_ptr);
18728 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
18729 	}
18730 
18731 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
18732 		FREE_OP(free_op_data1);
18733 		FREE_OP_VAR_PTR(free_op_data2);
18734 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18735 		CHECK_EXCEPTION();
18736 		ZEND_VM_INC_OPCODE();
18737 	} else {
18738 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18739 		CHECK_EXCEPTION();
18740 	}
18741 	ZEND_VM_NEXT_OPCODE();
18742 }
18743 
ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18744 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18745 {
18746 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18747 }
18748 
ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18749 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18750 {
18751 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18752 }
18753 
ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18754 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18755 {
18756 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18757 }
18758 
ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18759 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18760 {
18761 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18762 }
18763 
ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18764 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18765 {
18766 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18767 }
18768 
ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18769 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18770 {
18771 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18772 }
18773 
ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18774 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18775 {
18776 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18777 }
18778 
ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18779 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18780 {
18781 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18782 }
18783 
ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18784 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18785 {
18786 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18787 }
18788 
ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18789 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18790 {
18791 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18792 }
18793 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18794 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18795 {
18796 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18797 }
18798 
zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)18799 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
18800 {
18801 	USE_OPLINE
18802 	zend_free_op free_op1;
18803 	zval *varname;
18804 	zval **retval;
18805 	zval tmp_varname;
18806 	HashTable *target_symbol_table;
18807 	ulong hash_value;
18808 
18809 	SAVE_OPLINE();
18810 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18811 
18812  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
18813 		ZVAL_COPY_VALUE(&tmp_varname, varname);
18814 		zval_copy_ctor(&tmp_varname);
18815 		Z_SET_REFCOUNT(tmp_varname, 1);
18816 		Z_UNSET_ISREF(tmp_varname);
18817 		convert_to_string(&tmp_varname);
18818 		varname = &tmp_varname;
18819 	}
18820 
18821 	if (IS_UNUSED != IS_UNUSED) {
18822 		zend_class_entry *ce;
18823 
18824 		if (IS_UNUSED == IS_CONST) {
18825 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
18826 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
18827 			} else {
18828 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
18829 				if (UNEXPECTED(ce == NULL)) {
18830 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
18831 						zval_dtor(&tmp_varname);
18832 					}
18833 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18834 					CHECK_EXCEPTION();
18835 					ZEND_VM_NEXT_OPCODE();
18836 				}
18837 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
18838 			}
18839 		} else {
18840 			ce = EX_T(opline->op2.var).class_entry;
18841 		}
18842 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
18843 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18844 	} else {
18845 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
18846 /*
18847 		if (!target_symbol_table) {
18848 			CHECK_EXCEPTION();
18849 			ZEND_VM_NEXT_OPCODE();
18850 		}
18851 */
18852 		if (IS_VAR == IS_CONST) {
18853 			hash_value = Z_HASH_P(varname);
18854 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
18855 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
18856 		} else {
18857 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
18858 		}
18859 
18860 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
18861 			switch (type) {
18862 				case BP_VAR_R:
18863 				case BP_VAR_UNSET:
18864 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
18865 					/* break missing intentionally */
18866 				case BP_VAR_IS:
18867 					retval = &EG(uninitialized_zval_ptr);
18868 					break;
18869 				case BP_VAR_RW:
18870 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
18871 					/* break missing intentionally */
18872 				case BP_VAR_W:
18873 					Z_ADDREF_P(&EG(uninitialized_zval));
18874 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
18875 					break;
18876 				EMPTY_SWITCH_DEFAULT_CASE()
18877 			}
18878 		}
18879 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
18880 			case ZEND_FETCH_GLOBAL:
18881 				if (IS_VAR != IS_TMP_VAR) {
18882 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18883 				}
18884 				break;
18885 			case ZEND_FETCH_LOCAL:
18886 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18887 				break;
18888 			case ZEND_FETCH_STATIC:
18889 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
18890 				break;
18891 			case ZEND_FETCH_GLOBAL_LOCK:
18892 				if (IS_VAR == IS_VAR && !free_op1.var) {
18893 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
18894 				}
18895 				break;
18896 		}
18897 	}
18898 
18899 
18900 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
18901 		zval_dtor(&tmp_varname);
18902 	}
18903 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
18904 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
18905 	}
18906 	PZVAL_LOCK(*retval);
18907 	switch (type) {
18908 		case BP_VAR_R:
18909 		case BP_VAR_IS:
18910 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
18911 			break;
18912 		case BP_VAR_UNSET: {
18913 			zend_free_op free_res;
18914 
18915 			PZVAL_UNLOCK(*retval, &free_res);
18916 			if (retval != &EG(uninitialized_zval_ptr)) {
18917 				SEPARATE_ZVAL_IF_NOT_REF(retval);
18918 			}
18919 			PZVAL_LOCK(*retval);
18920 			FREE_OP_VAR_PTR(free_res);
18921 		}
18922 		/* break missing intentionally */
18923 		default:
18924 			EX_T(opline->result.var).var.ptr_ptr = retval;
18925 			break;
18926 	}
18927 	CHECK_EXCEPTION();
18928 	ZEND_VM_NEXT_OPCODE();
18929 }
18930 
ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18931 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18932 {
18933 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18934 }
18935 
ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18936 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18937 {
18938 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18939 }
18940 
ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18941 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18942 {
18943 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18944 }
18945 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18946 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18947 {
18948 	USE_OPLINE
18949 
18950 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18951 }
18952 
ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18953 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18954 {
18955 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18956 }
18957 
ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18958 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18959 {
18960 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18961 }
18962 
ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18963 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18964 {
18965 	USE_OPLINE
18966 	zend_free_op free_op1;
18967 	zval **container;
18968 
18969 	SAVE_OPLINE();
18970 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
18971 
18972 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
18973 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
18974 	}
18975 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
18976 
18977 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
18978 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
18979 	}
18980 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18981 
18982 	/* We are going to assign the result by reference */
18983 	if (UNEXPECTED(opline->extended_value != 0)) {
18984 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
18985 
18986 		if (retval_ptr) {
18987 			Z_DELREF_PP(retval_ptr);
18988 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
18989 			Z_ADDREF_PP(retval_ptr);
18990 		}
18991 	}
18992 
18993 	CHECK_EXCEPTION();
18994 	ZEND_VM_NEXT_OPCODE();
18995 }
18996 
ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18997 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18998 {
18999 	USE_OPLINE
19000 	zend_free_op free_op1;
19001 	zval **container;
19002 
19003 	SAVE_OPLINE();
19004 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19005 
19006 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19007 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19008 	}
19009 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
19010 
19011 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19012 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19013 	}
19014 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19015 	CHECK_EXCEPTION();
19016 	ZEND_VM_NEXT_OPCODE();
19017 }
19018 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19019 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19020 {
19021 	USE_OPLINE
19022 	zend_free_op free_op1;
19023 
19024 	SAVE_OPLINE();
19025 
19026 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
19027 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19028 
19029 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19030 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19031 		}
19032 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
19033 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19034 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19035 		}
19036 
19037 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19038 	} else {
19039 		zval *container;
19040 
19041 		if (IS_UNUSED == IS_UNUSED) {
19042 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
19043 		}
19044 		container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19045 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_R TSRMLS_CC);
19046 
19047 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19048 	}
19049 	CHECK_EXCEPTION();
19050 	ZEND_VM_NEXT_OPCODE();
19051 }
19052 
ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19053 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19054 {
19055 	USE_OPLINE
19056 	zend_free_op free_op1;
19057 	zval **object_ptr;
19058 
19059 	SAVE_OPLINE();
19060 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19061 
19062 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19063 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19064 	}
19065 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
19066 
19067 		zval *property_name = NULL;
19068 
19069 		if (0) {
19070 			MAKE_REAL_ZVAL_PTR(property_name);
19071 		}
19072 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19073 		if (0) {
19074 			zval_ptr_dtor(&property_name);
19075 		} else {
19076 
19077 		}
19078 	} else {
19079 		zend_free_op free_op_data1, free_op_data2;
19080 		zval *value;
19081 		zval *dim = NULL;
19082 		zval **variable_ptr_ptr;
19083 
19084 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_UNUSED, BP_VAR_W TSRMLS_CC);
19085 
19086 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
19087 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
19088 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
19089 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
19090 				if (RETURN_VALUE_USED(opline)) {
19091 					zval *retval;
19092 
19093 					ALLOC_ZVAL(retval);
19094 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
19095 					INIT_PZVAL(retval);
19096 					AI_SET_PTR(&EX_T(opline->result.var), retval);
19097 				}
19098 			} else if (RETURN_VALUE_USED(opline)) {
19099 				PZVAL_LOCK(&EG(uninitialized_zval));
19100 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19101 			}
19102 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
19103 			if (IS_TMP_FREE(free_op_data1)) {
19104 				zval_dtor(value);
19105 			}
19106 			if (RETURN_VALUE_USED(opline)) {
19107 				PZVAL_LOCK(&EG(uninitialized_zval));
19108 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19109 			}
19110 		} else {
19111 			if ((opline+1)->op1_type == IS_TMP_VAR) {
19112 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19113 			} else if ((opline+1)->op1_type == IS_CONST) {
19114 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19115 			} else {
19116 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19117 			}
19118 			if (RETURN_VALUE_USED(opline)) {
19119 				PZVAL_LOCK(value);
19120 				AI_SET_PTR(&EX_T(opline->result.var), value);
19121 			}
19122 		}
19123 		FREE_OP_VAR_PTR(free_op_data2);
19124 	 	FREE_OP_IF_VAR(free_op_data1);
19125 	}
19126  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19127 	/* assign_dim has two opcodes! */
19128 	CHECK_EXCEPTION();
19129 	ZEND_VM_INC_OPCODE();
19130 	ZEND_VM_NEXT_OPCODE();
19131 }
19132 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19133 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19134 {
19135 	USE_OPLINE
19136 	zval *function_name;
19137 	zend_class_entry *ce;
19138 
19139 	SAVE_OPLINE();
19140 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
19141 
19142 	if (IS_VAR == IS_CONST) {
19143 		/* no function found. try a static method in class */
19144 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
19145 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
19146 		} else {
19147 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
19148 			if (UNEXPECTED(EG(exception) != NULL)) {
19149 				HANDLE_EXCEPTION();
19150 			}
19151 			if (UNEXPECTED(ce == NULL)) {
19152 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
19153 			}
19154 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
19155 		}
19156 		EX(called_scope) = ce;
19157 	} else {
19158 		ce = EX_T(opline->op1.var).class_entry;
19159 
19160 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
19161 			EX(called_scope) = EG(called_scope);
19162 		} else {
19163 			EX(called_scope) = ce;
19164 		}
19165 	}
19166 
19167 	if (IS_VAR == IS_CONST &&
19168 	    IS_UNUSED == IS_CONST &&
19169 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
19170 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
19171 	} else if (IS_VAR != IS_CONST &&
19172 	           IS_UNUSED == IS_CONST &&
19173 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
19174 		/* do nothing */
19175 	} else if (IS_UNUSED != IS_UNUSED) {
19176 		char *function_name_strval = NULL;
19177 		int function_name_strlen = 0;
19178 
19179 
19180 		if (IS_UNUSED == IS_CONST) {
19181 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
19182 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
19183 		} else {
19184 			function_name = NULL;
19185 
19186 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
19187 				zend_error_noreturn(E_ERROR, "Function name must be a string");
19188 			} else {
19189 				function_name_strval = Z_STRVAL_P(function_name);
19190 				function_name_strlen = Z_STRLEN_P(function_name);
19191  			}
19192 		}
19193 
19194 		if (function_name_strval) {
19195 			if (ce->get_static_method) {
19196 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
19197 			} else {
19198 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_UNUSED == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
19199 			}
19200 			if (UNEXPECTED(EX(fbc) == NULL)) {
19201 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
19202 			}
19203 			if (IS_UNUSED == IS_CONST &&
19204 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
19205 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
19206 				if (IS_VAR == IS_CONST) {
19207 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
19208 				} else {
19209 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
19210 				}
19211 			}
19212 		}
19213 		if (IS_UNUSED != IS_CONST) {
19214 
19215 		}
19216 	} else {
19217 		if (UNEXPECTED(ce->constructor == NULL)) {
19218 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
19219 		}
19220 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
19221 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
19222 		}
19223 		EX(fbc) = ce->constructor;
19224 	}
19225 
19226 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
19227 		EX(object) = NULL;
19228 	} else {
19229 		if (EG(This) &&
19230 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
19231 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
19232 		    /* We are calling method of the other (incompatible) class,
19233 		       but passing $this. This is done for compatibility with php-4. */
19234 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
19235 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
19236 			} else {
19237 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
19238 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
19239 			}
19240 		}
19241 		if ((EX(object) = EG(This))) {
19242 			Z_ADDREF_P(EX(object));
19243 			EX(called_scope) = Z_OBJCE_P(EX(object));
19244 		}
19245 	}
19246 
19247 	CHECK_EXCEPTION();
19248 	ZEND_VM_NEXT_OPCODE();
19249 }
19250 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19251 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19252 {
19253 	USE_OPLINE
19254 	zend_free_op free_op1;
19255 	zval *expr_ptr;
19256 
19257 	SAVE_OPLINE();
19258 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
19259 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19260 
19261 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
19262 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
19263 		}
19264 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
19265 		expr_ptr = *expr_ptr_ptr;
19266 		Z_ADDREF_P(expr_ptr);
19267 	} else {
19268 		expr_ptr=_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19269 		if (0) { /* temporary variable */
19270 			zval *new_expr;
19271 
19272 			ALLOC_ZVAL(new_expr);
19273 			INIT_PZVAL_COPY(new_expr, expr_ptr);
19274 			expr_ptr = new_expr;
19275 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
19276 			zval *new_expr;
19277 
19278 			ALLOC_ZVAL(new_expr);
19279 			INIT_PZVAL_COPY(new_expr, expr_ptr);
19280 			expr_ptr = new_expr;
19281 			zendi_zval_copy_ctor(*expr_ptr);
19282 		} else {
19283 			Z_ADDREF_P(expr_ptr);
19284 		}
19285 	}
19286 
19287 	if (IS_UNUSED != IS_UNUSED) {
19288 
19289 		zval *offset = NULL;
19290 		ulong hval;
19291 
19292 		switch (Z_TYPE_P(offset)) {
19293 			case IS_DOUBLE:
19294 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
19295 				goto num_index;
19296 			case IS_LONG:
19297 			case IS_BOOL:
19298 				hval = Z_LVAL_P(offset);
19299 num_index:
19300 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
19301 				break;
19302 			case IS_STRING:
19303 				if (IS_UNUSED == IS_CONST) {
19304 					hval = Z_HASH_P(offset);
19305 				} else {
19306 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
19307 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
19308 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
19309 					} else {
19310 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
19311 					}
19312 				}
19313 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
19314 				break;
19315 			case IS_NULL:
19316 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
19317 				break;
19318 			default:
19319 				zend_error(E_WARNING, "Illegal offset type");
19320 				zval_ptr_dtor(&expr_ptr);
19321 				/* do nothing */
19322 				break;
19323 		}
19324 
19325 	} else {
19326 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
19327 	}
19328 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
19329 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19330 	} else {
19331 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19332 	}
19333 	CHECK_EXCEPTION();
19334 	ZEND_VM_NEXT_OPCODE();
19335 }
19336 
ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19337 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19338 {
19339 	USE_OPLINE
19340 
19341 	array_init(&EX_T(opline->result.var).tmp_var);
19342 	if (IS_VAR == IS_UNUSED) {
19343 		ZEND_VM_NEXT_OPCODE();
19344 #if 0 || IS_VAR != IS_UNUSED
19345 	} else {
19346 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19347 #endif
19348 	}
19349 }
19350 
ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19351 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19352 {
19353 	USE_OPLINE
19354 	zval tmp, *varname;
19355 	HashTable *target_symbol_table;
19356 	zend_free_op free_op1;
19357 
19358 	SAVE_OPLINE();
19359 	if (IS_VAR == IS_CV &&
19360 	    IS_UNUSED == IS_UNUSED &&
19361 	    (opline->extended_value & ZEND_QUICK_SET)) {
19362 		if (EG(active_symbol_table)) {
19363 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
19364 
19365 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
19366 			EX_CV(opline->op1.var) = NULL;
19367 		} else if (EX_CV(opline->op1.var)) {
19368 			zval_ptr_dtor(EX_CV(opline->op1.var));
19369 			EX_CV(opline->op1.var) = NULL;
19370 		}
19371 		CHECK_EXCEPTION();
19372 		ZEND_VM_NEXT_OPCODE();
19373 	}
19374 
19375 	varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19376 
19377 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
19378 		ZVAL_COPY_VALUE(&tmp, varname);
19379 		zval_copy_ctor(&tmp);
19380 		convert_to_string(&tmp);
19381 		varname = &tmp;
19382 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
19383 		Z_ADDREF_P(varname);
19384 	}
19385 
19386 	if (IS_UNUSED != IS_UNUSED) {
19387 		zend_class_entry *ce;
19388 
19389 		if (IS_UNUSED == IS_CONST) {
19390 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
19391 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
19392 			} else {
19393 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
19394 				if (UNEXPECTED(EG(exception) != NULL)) {
19395 					if (IS_VAR != IS_CONST && varname == &tmp) {
19396 						zval_dtor(&tmp);
19397 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
19398 						zval_ptr_dtor(&varname);
19399 					}
19400 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19401 					HANDLE_EXCEPTION();
19402 				}
19403 				if (UNEXPECTED(ce == NULL)) {
19404 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
19405 				}
19406 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
19407 			}
19408 		} else {
19409 			ce = EX_T(opline->op2.var).class_entry;
19410 		}
19411 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
19412 	} else {
19413 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
19414 
19415 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
19416 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
19417 	}
19418 
19419 	if (IS_VAR != IS_CONST && varname == &tmp) {
19420 		zval_dtor(&tmp);
19421 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
19422 		zval_ptr_dtor(&varname);
19423 	}
19424 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19425 	CHECK_EXCEPTION();
19426 	ZEND_VM_NEXT_OPCODE();
19427 }
19428 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19429 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19430 {
19431 	USE_OPLINE
19432 	zval **value;
19433 	zend_bool isset = 1;
19434 
19435 	SAVE_OPLINE();
19436 	if (IS_VAR == IS_CV &&
19437 	    IS_UNUSED == IS_UNUSED &&
19438 	    (opline->extended_value & ZEND_QUICK_SET)) {
19439 		if (EX_CV(opline->op1.var)) {
19440 			value = EX_CV(opline->op1.var);
19441 		} else if (EG(active_symbol_table)) {
19442 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
19443 
19444 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
19445 				isset = 0;
19446 			}
19447 		} else {
19448 			isset = 0;
19449 		}
19450 	} else {
19451 		HashTable *target_symbol_table;
19452 		zend_free_op free_op1;
19453 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19454 
19455 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
19456 			ZVAL_COPY_VALUE(&tmp, varname);
19457 			zval_copy_ctor(&tmp);
19458 			convert_to_string(&tmp);
19459 			varname = &tmp;
19460 		}
19461 
19462 		if (IS_UNUSED != IS_UNUSED) {
19463 			zend_class_entry *ce;
19464 
19465 			if (IS_UNUSED == IS_CONST) {
19466 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
19467 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
19468 				} else {
19469 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
19470 					if (UNEXPECTED(ce == NULL)) {
19471 						CHECK_EXCEPTION();
19472 						ZEND_VM_NEXT_OPCODE();
19473 					}
19474 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
19475 				}
19476 			} else {
19477 				ce = EX_T(opline->op2.var).class_entry;
19478 			}
19479 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
19480 			if (!value) {
19481 				isset = 0;
19482 			}
19483 		} else {
19484 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
19485 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
19486 				isset = 0;
19487 			}
19488 		}
19489 
19490 		if (IS_VAR != IS_CONST && varname == &tmp) {
19491 			zval_dtor(&tmp);
19492 		}
19493 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19494 	}
19495 
19496 	if (opline->extended_value & ZEND_ISSET) {
19497 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
19498 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
19499 		} else {
19500 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
19501 		}
19502 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
19503 		if (!isset || !i_zend_is_true(*value)) {
19504 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
19505 		} else {
19506 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
19507 		}
19508 	}
19509 
19510 	CHECK_EXCEPTION();
19511 	ZEND_VM_NEXT_OPCODE();
19512 }
19513 
ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19514 static int ZEND_FASTCALL  ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19515 {
19516 	USE_OPLINE
19517 	zval *var_ptr, *new_zv;
19518 
19519 	SAVE_OPLINE();
19520 	var_ptr = EX_T(opline->op1.var).var.ptr;
19521 	if (Z_TYPE_P(var_ptr) != IS_OBJECT &&
19522 	    !PZVAL_IS_REF(var_ptr) &&
19523 	    Z_REFCOUNT_P(var_ptr) > 1) {
19524 
19525 		Z_DELREF_P(var_ptr);
19526 		ALLOC_ZVAL(new_zv);
19527 		INIT_PZVAL_COPY(new_zv, var_ptr);
19528 		var_ptr = new_zv;
19529 		zval_copy_ctor(var_ptr);
19530 		EX_T(opline->op1.var).var.ptr = var_ptr;
19531 	}
19532 	ZEND_VM_NEXT_OPCODE();
19533 }
19534 
ZEND_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19535 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19536 {
19537 	USE_OPLINE
19538 	zend_free_op free_op1;
19539 
19540 	SAVE_OPLINE();
19541 	fast_add_function(&EX_T(opline->result.var).tmp_var,
19542 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19543 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19544 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19545 
19546 	CHECK_EXCEPTION();
19547 	ZEND_VM_NEXT_OPCODE();
19548 }
19549 
ZEND_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19550 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19551 {
19552 	USE_OPLINE
19553 	zend_free_op free_op1;
19554 
19555 	SAVE_OPLINE();
19556 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
19557 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19558 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19559 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19560 
19561 	CHECK_EXCEPTION();
19562 	ZEND_VM_NEXT_OPCODE();
19563 }
19564 
ZEND_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19565 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19566 {
19567 	USE_OPLINE
19568 	zend_free_op free_op1;
19569 
19570 	SAVE_OPLINE();
19571 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
19572 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19573 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19574 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19575 
19576 	CHECK_EXCEPTION();
19577 	ZEND_VM_NEXT_OPCODE();
19578 }
19579 
ZEND_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19580 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19581 {
19582 	USE_OPLINE
19583 	zend_free_op free_op1;
19584 
19585 	SAVE_OPLINE();
19586 	fast_div_function(&EX_T(opline->result.var).tmp_var,
19587 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19588 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19589 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19590 
19591 	CHECK_EXCEPTION();
19592 	ZEND_VM_NEXT_OPCODE();
19593 }
19594 
ZEND_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19595 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19596 {
19597 	USE_OPLINE
19598 	zend_free_op free_op1;
19599 
19600 	SAVE_OPLINE();
19601 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
19602 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19603 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19604 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19605 
19606 	CHECK_EXCEPTION();
19607 	ZEND_VM_NEXT_OPCODE();
19608 }
19609 
ZEND_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19610 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19611 {
19612 	USE_OPLINE
19613 	zend_free_op free_op1;
19614 
19615 	SAVE_OPLINE();
19616 	shift_left_function(&EX_T(opline->result.var).tmp_var,
19617 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19618 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19619 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19620 
19621 	CHECK_EXCEPTION();
19622 	ZEND_VM_NEXT_OPCODE();
19623 }
19624 
ZEND_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19625 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19626 {
19627 	USE_OPLINE
19628 	zend_free_op free_op1;
19629 
19630 	SAVE_OPLINE();
19631 	shift_right_function(&EX_T(opline->result.var).tmp_var,
19632 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19633 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19634 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19635 
19636 	CHECK_EXCEPTION();
19637 	ZEND_VM_NEXT_OPCODE();
19638 }
19639 
ZEND_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19640 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19641 {
19642 	USE_OPLINE
19643 	zend_free_op free_op1;
19644 
19645 	SAVE_OPLINE();
19646 	concat_function(&EX_T(opline->result.var).tmp_var,
19647 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19648 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19649 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19650 
19651 	CHECK_EXCEPTION();
19652 	ZEND_VM_NEXT_OPCODE();
19653 }
19654 
ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19655 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19656 {
19657 	USE_OPLINE
19658 	zend_free_op free_op1;
19659 
19660 	SAVE_OPLINE();
19661 	is_identical_function(&EX_T(opline->result.var).tmp_var,
19662 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19663 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19664 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19665 
19666 	CHECK_EXCEPTION();
19667 	ZEND_VM_NEXT_OPCODE();
19668 }
19669 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19670 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19671 {
19672 	USE_OPLINE
19673 	zend_free_op free_op1;
19674 	zval *result = &EX_T(opline->result.var).tmp_var;
19675 
19676 	SAVE_OPLINE();
19677 	is_identical_function(result,
19678 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19679 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19680 	Z_LVAL_P(result) = !Z_LVAL_P(result);
19681 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19682 
19683 	CHECK_EXCEPTION();
19684 	ZEND_VM_NEXT_OPCODE();
19685 }
19686 
ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19687 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19688 {
19689 	USE_OPLINE
19690 	zend_free_op free_op1;
19691 	zval *result = &EX_T(opline->result.var).tmp_var;
19692 
19693 	SAVE_OPLINE();
19694 	ZVAL_BOOL(result, fast_equal_function(result,
19695 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19696 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
19697 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19698 
19699 	CHECK_EXCEPTION();
19700 	ZEND_VM_NEXT_OPCODE();
19701 }
19702 
ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19703 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19704 {
19705 	USE_OPLINE
19706 	zend_free_op free_op1;
19707 	zval *result = &EX_T(opline->result.var).tmp_var;
19708 
19709 	SAVE_OPLINE();
19710 	ZVAL_BOOL(result, fast_not_equal_function(result,
19711 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19712 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
19713 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19714 
19715 	CHECK_EXCEPTION();
19716 	ZEND_VM_NEXT_OPCODE();
19717 }
19718 
ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19719 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19720 {
19721 	USE_OPLINE
19722 	zend_free_op free_op1;
19723 	zval *result = &EX_T(opline->result.var).tmp_var;
19724 
19725 	SAVE_OPLINE();
19726 	ZVAL_BOOL(result, fast_is_smaller_function(result,
19727 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19728 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
19729 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19730 
19731 	CHECK_EXCEPTION();
19732 	ZEND_VM_NEXT_OPCODE();
19733 }
19734 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19735 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19736 {
19737 	USE_OPLINE
19738 	zend_free_op free_op1;
19739 	zval *result = &EX_T(opline->result.var).tmp_var;
19740 
19741 	SAVE_OPLINE();
19742 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
19743 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19744 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
19745 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19746 
19747 	CHECK_EXCEPTION();
19748 	ZEND_VM_NEXT_OPCODE();
19749 }
19750 
ZEND_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19751 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19752 {
19753 	USE_OPLINE
19754 	zend_free_op free_op1;
19755 
19756 	SAVE_OPLINE();
19757 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
19758 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19759 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19760 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19761 
19762 	CHECK_EXCEPTION();
19763 	ZEND_VM_NEXT_OPCODE();
19764 }
19765 
ZEND_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19766 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19767 {
19768 	USE_OPLINE
19769 	zend_free_op free_op1;
19770 
19771 	SAVE_OPLINE();
19772 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
19773 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19774 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19775 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19776 
19777 	CHECK_EXCEPTION();
19778 	ZEND_VM_NEXT_OPCODE();
19779 }
19780 
ZEND_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19781 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19782 {
19783 	USE_OPLINE
19784 	zend_free_op free_op1;
19785 
19786 	SAVE_OPLINE();
19787 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
19788 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19789 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19790 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19791 
19792 	CHECK_EXCEPTION();
19793 	ZEND_VM_NEXT_OPCODE();
19794 }
19795 
ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19796 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19797 {
19798 	USE_OPLINE
19799 	zend_free_op free_op1;
19800 
19801 	SAVE_OPLINE();
19802 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
19803 		_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
19804 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
19805 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19806 
19807 	CHECK_EXCEPTION();
19808 	ZEND_VM_NEXT_OPCODE();
19809 }
19810 
zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)19811 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
19812 {
19813 	USE_OPLINE
19814 	zend_free_op free_op1, free_op_data1;
19815 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19816 	zval *object;
19817 	zval *property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
19818 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
19819 	int have_get_ptr = 0;
19820 
19821 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19822 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
19823 	}
19824 
19825 	make_real_object(object_ptr TSRMLS_CC);
19826 	object = *object_ptr;
19827 
19828 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
19829 		zend_error(E_WARNING, "Attempt to assign property of non-object");
19830 
19831 		FREE_OP(free_op_data1);
19832 
19833 		if (RETURN_VALUE_USED(opline)) {
19834 			PZVAL_LOCK(&EG(uninitialized_zval));
19835 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
19836 			EX_T(opline->result.var).var.ptr_ptr = NULL;
19837 		}
19838 	} else {
19839 		/* here we are sure we are dealing with an object */
19840 		if (0) {
19841 			MAKE_REAL_ZVAL_PTR(property);
19842 		}
19843 
19844 		/* here property is a string */
19845 		if (opline->extended_value == ZEND_ASSIGN_OBJ
19846 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
19847 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19848 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
19849 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
19850 
19851 				have_get_ptr = 1;
19852 				binary_op(*zptr, *zptr, value TSRMLS_CC);
19853 				if (RETURN_VALUE_USED(opline)) {
19854 					PZVAL_LOCK(*zptr);
19855 					EX_T(opline->result.var).var.ptr = *zptr;
19856 					EX_T(opline->result.var).var.ptr_ptr = NULL;
19857 				}
19858 			}
19859 		}
19860 
19861 		if (!have_get_ptr) {
19862 			zval *z = NULL;
19863 
19864 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
19865 				if (Z_OBJ_HT_P(object)->read_property) {
19866 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19867 				}
19868 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
19869 				if (Z_OBJ_HT_P(object)->read_dimension) {
19870 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
19871 				}
19872 			}
19873 			if (z) {
19874 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
19875 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
19876 
19877 					if (Z_REFCOUNT_P(z) == 0) {
19878 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
19879 						zval_dtor(z);
19880 						FREE_ZVAL(z);
19881 					}
19882 					z = value;
19883 				}
19884 				Z_ADDREF_P(z);
19885 				SEPARATE_ZVAL_IF_NOT_REF(&z);
19886 				binary_op(z, z, value TSRMLS_CC);
19887 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
19888 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19889 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
19890 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
19891 				}
19892 				if (RETURN_VALUE_USED(opline)) {
19893 					PZVAL_LOCK(z);
19894 					EX_T(opline->result.var).var.ptr = z;
19895 					EX_T(opline->result.var).var.ptr_ptr = NULL;
19896 				}
19897 				zval_ptr_dtor(&z);
19898 			} else {
19899 				zend_error(E_WARNING, "Attempt to assign property of non-object");
19900 				if (RETURN_VALUE_USED(opline)) {
19901 					PZVAL_LOCK(&EG(uninitialized_zval));
19902 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
19903 					EX_T(opline->result.var).var.ptr_ptr = NULL;
19904 				}
19905 			}
19906 		}
19907 
19908 		if (0) {
19909 			zval_ptr_dtor(&property);
19910 		} else {
19911 
19912 		}
19913 		FREE_OP(free_op_data1);
19914 	}
19915 
19916 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19917 	/* assign_obj has two opcodes! */
19918 	CHECK_EXCEPTION();
19919 	ZEND_VM_INC_OPCODE();
19920 	ZEND_VM_NEXT_OPCODE();
19921 }
19922 
zend_binary_assign_op_helper_SPEC_VAR_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)19923 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
19924 {
19925 	USE_OPLINE
19926 	zend_free_op free_op1, free_op_data2, free_op_data1;
19927 	zval **var_ptr;
19928 	zval *value;
19929 
19930 	SAVE_OPLINE();
19931 	switch (opline->extended_value) {
19932 		case ZEND_ASSIGN_OBJ:
19933 			return zend_binary_assign_op_obj_helper_SPEC_VAR_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19934 			break;
19935 		case ZEND_ASSIGN_DIM: {
19936 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19937 
19938 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19939 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19940 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
19941 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
19942 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
19943 					}
19944 					return zend_binary_assign_op_obj_helper_SPEC_VAR_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19945 				} else {
19946 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
19947 
19948 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
19949 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
19950 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
19951 				}
19952 			}
19953 			break;
19954 		default:
19955 			value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
19956 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
19957 			/* do nothing */
19958 			break;
19959 	}
19960 
19961 	if (UNEXPECTED(var_ptr == NULL)) {
19962 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
19963 	}
19964 
19965 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
19966 		if (RETURN_VALUE_USED(opline)) {
19967 			PZVAL_LOCK(&EG(uninitialized_zval));
19968 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19969 		}
19970 
19971 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19972 		CHECK_EXCEPTION();
19973 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
19974 			ZEND_VM_INC_OPCODE();
19975 		}
19976 		ZEND_VM_NEXT_OPCODE();
19977 	}
19978 
19979 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
19980 
19981 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
19982 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
19983 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
19984 		/* proxy object */
19985 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
19986 		Z_ADDREF_P(objval);
19987 		binary_op(objval, objval, value TSRMLS_CC);
19988 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
19989 		zval_ptr_dtor(&objval);
19990 	} else {
19991 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
19992 	}
19993 
19994 	if (RETURN_VALUE_USED(opline)) {
19995 		PZVAL_LOCK(*var_ptr);
19996 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
19997 	}
19998 
19999 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
20000 		FREE_OP(free_op_data1);
20001 		FREE_OP_VAR_PTR(free_op_data2);
20002 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20003 		CHECK_EXCEPTION();
20004 		ZEND_VM_INC_OPCODE();
20005 	} else {
20006 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20007 		CHECK_EXCEPTION();
20008 	}
20009 	ZEND_VM_NEXT_OPCODE();
20010 }
20011 
ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20012 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20013 {
20014 	return zend_binary_assign_op_helper_SPEC_VAR_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20015 }
20016 
ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20017 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20018 {
20019 	return zend_binary_assign_op_helper_SPEC_VAR_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20020 }
20021 
ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20022 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20023 {
20024 	return zend_binary_assign_op_helper_SPEC_VAR_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20025 }
20026 
ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20027 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20028 {
20029 	return zend_binary_assign_op_helper_SPEC_VAR_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20030 }
20031 
ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20032 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20033 {
20034 	return zend_binary_assign_op_helper_SPEC_VAR_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20035 }
20036 
ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20037 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20038 {
20039 	return zend_binary_assign_op_helper_SPEC_VAR_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20040 }
20041 
ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20042 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20043 {
20044 	return zend_binary_assign_op_helper_SPEC_VAR_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20045 }
20046 
ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20047 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20048 {
20049 	return zend_binary_assign_op_helper_SPEC_VAR_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20050 }
20051 
ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20052 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20053 {
20054 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20055 }
20056 
ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20057 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20058 {
20059 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20060 }
20061 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20062 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20063 {
20064 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20065 }
20066 
zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)20067 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
20068 {
20069 	USE_OPLINE
20070 	zend_free_op free_op1;
20071 	zval **object_ptr;
20072 	zval *object;
20073 	zval *property;
20074 	zval **retval;
20075 	int have_get_ptr = 0;
20076 
20077 	SAVE_OPLINE();
20078 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20079 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20080 	retval = &EX_T(opline->result.var).var.ptr;
20081 
20082 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
20083 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
20084 	}
20085 
20086 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
20087 	object = *object_ptr;
20088 
20089 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
20090 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
20091 
20092 		if (RETURN_VALUE_USED(opline)) {
20093 			PZVAL_LOCK(&EG(uninitialized_zval));
20094 			*retval = &EG(uninitialized_zval);
20095 		}
20096 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20097 		CHECK_EXCEPTION();
20098 		ZEND_VM_NEXT_OPCODE();
20099 	}
20100 
20101 	/* here we are sure we are dealing with an object */
20102 
20103 	if (0) {
20104 		MAKE_REAL_ZVAL_PTR(property);
20105 	}
20106 
20107 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
20108 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20109 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
20110 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
20111 
20112 			have_get_ptr = 1;
20113 			incdec_op(*zptr);
20114 			if (RETURN_VALUE_USED(opline)) {
20115 				*retval = *zptr;
20116 				PZVAL_LOCK(*retval);
20117 			}
20118 		}
20119 	}
20120 
20121 	if (!have_get_ptr) {
20122 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
20123 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20124 
20125 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
20126 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
20127 
20128 				if (Z_REFCOUNT_P(z) == 0) {
20129 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
20130 					zval_dtor(z);
20131 					FREE_ZVAL(z);
20132 				}
20133 				z = value;
20134 			}
20135 			Z_ADDREF_P(z);
20136 			SEPARATE_ZVAL_IF_NOT_REF(&z);
20137 			incdec_op(z);
20138 			*retval = z;
20139 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20140 			SELECTIVE_PZVAL_LOCK(*retval, opline);
20141 			zval_ptr_dtor(&z);
20142 		} else {
20143 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
20144 			if (RETURN_VALUE_USED(opline)) {
20145 				PZVAL_LOCK(&EG(uninitialized_zval));
20146 				*retval = &EG(uninitialized_zval);
20147 			}
20148 		}
20149 	}
20150 
20151 	if (0) {
20152 		zval_ptr_dtor(&property);
20153 	} else {
20154 
20155 	}
20156 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20157 	CHECK_EXCEPTION();
20158 	ZEND_VM_NEXT_OPCODE();
20159 }
20160 
ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20161 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20162 {
20163 	return zend_pre_incdec_property_helper_SPEC_VAR_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20164 }
20165 
ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20166 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20167 {
20168 	return zend_pre_incdec_property_helper_SPEC_VAR_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20169 }
20170 
zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)20171 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
20172 {
20173 	USE_OPLINE
20174 	zend_free_op free_op1;
20175 	zval **object_ptr;
20176 	zval *object;
20177 	zval *property;
20178 	zval *retval;
20179 	int have_get_ptr = 0;
20180 
20181 	SAVE_OPLINE();
20182 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20183 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20184 	retval = &EX_T(opline->result.var).tmp_var;
20185 
20186 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
20187 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
20188 	}
20189 
20190 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
20191 	object = *object_ptr;
20192 
20193 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
20194 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
20195 
20196 		ZVAL_NULL(retval);
20197 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20198 		CHECK_EXCEPTION();
20199 		ZEND_VM_NEXT_OPCODE();
20200 	}
20201 
20202 	/* here we are sure we are dealing with an object */
20203 
20204 	if (0) {
20205 		MAKE_REAL_ZVAL_PTR(property);
20206 	}
20207 
20208 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
20209 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20210 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
20211 			have_get_ptr = 1;
20212 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
20213 
20214 			ZVAL_COPY_VALUE(retval, *zptr);
20215 			zendi_zval_copy_ctor(*retval);
20216 
20217 			incdec_op(*zptr);
20218 
20219 		}
20220 	}
20221 
20222 	if (!have_get_ptr) {
20223 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
20224 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20225 			zval *z_copy;
20226 
20227 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
20228 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
20229 
20230 				if (Z_REFCOUNT_P(z) == 0) {
20231 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
20232 					zval_dtor(z);
20233 					FREE_ZVAL(z);
20234 				}
20235 				z = value;
20236 			}
20237 			ZVAL_COPY_VALUE(retval, z);
20238 			zendi_zval_copy_ctor(*retval);
20239 			ALLOC_ZVAL(z_copy);
20240 			INIT_PZVAL_COPY(z_copy, z);
20241 			zendi_zval_copy_ctor(*z_copy);
20242 			incdec_op(z_copy);
20243 			Z_ADDREF_P(z);
20244 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20245 			zval_ptr_dtor(&z_copy);
20246 			zval_ptr_dtor(&z);
20247 		} else {
20248 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
20249 			ZVAL_NULL(retval);
20250 		}
20251 	}
20252 
20253 	if (0) {
20254 		zval_ptr_dtor(&property);
20255 	} else {
20256 
20257 	}
20258 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20259 	CHECK_EXCEPTION();
20260 	ZEND_VM_NEXT_OPCODE();
20261 }
20262 
ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20263 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20264 {
20265 	return zend_post_incdec_property_helper_SPEC_VAR_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20266 }
20267 
ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20268 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20269 {
20270 	return zend_post_incdec_property_helper_SPEC_VAR_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20271 }
20272 
ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20273 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20274 {
20275 	USE_OPLINE
20276 	zend_free_op free_op1;
20277 	zval *container;
20278 
20279 	SAVE_OPLINE();
20280 
20281 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
20282 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
20283 	}
20284 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20285 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
20286 
20287 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20288 	CHECK_EXCEPTION();
20289 	ZEND_VM_NEXT_OPCODE();
20290 }
20291 
ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20292 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20293 {
20294 	USE_OPLINE
20295 	zend_free_op free_op1;
20296 	zval **container;
20297 
20298 	SAVE_OPLINE();
20299 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20300 
20301 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20302 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20303 	}
20304 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
20305 
20306 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20307 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20308 	}
20309 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20310 
20311 	/* We are going to assign the result by reference */
20312 	if (UNEXPECTED(opline->extended_value != 0)) {
20313 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
20314 
20315 		if (retval_ptr) {
20316 			Z_DELREF_PP(retval_ptr);
20317 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
20318 			Z_ADDREF_PP(retval_ptr);
20319 		}
20320 	}
20321 
20322 	CHECK_EXCEPTION();
20323 	ZEND_VM_NEXT_OPCODE();
20324 }
20325 
ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20326 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20327 {
20328 	USE_OPLINE
20329 	zend_free_op free_op1;
20330 	zval **container;
20331 
20332 	SAVE_OPLINE();
20333 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20334 
20335 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20336 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20337 	}
20338 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_RW TSRMLS_CC);
20339 
20340 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20341 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20342 	}
20343 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20344 	CHECK_EXCEPTION();
20345 	ZEND_VM_NEXT_OPCODE();
20346 }
20347 
ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20348 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20349 {
20350 	USE_OPLINE
20351 	zend_free_op free_op1;
20352 	zval *container;
20353 
20354 	SAVE_OPLINE();
20355 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20356 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_IS TSRMLS_CC);
20357 
20358 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20359 	CHECK_EXCEPTION();
20360 	ZEND_VM_NEXT_OPCODE();
20361 }
20362 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20363 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20364 {
20365 	USE_OPLINE
20366 	zend_free_op free_op1;
20367 
20368 	SAVE_OPLINE();
20369 
20370 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
20371 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20372 
20373 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20374 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20375 		}
20376 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
20377 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20378 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20379 		}
20380 
20381 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20382 	} else {
20383 		zval *container;
20384 
20385 		if (IS_CV == IS_UNUSED) {
20386 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
20387 		}
20388 		container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20389 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
20390 
20391 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20392 	}
20393 	CHECK_EXCEPTION();
20394 	ZEND_VM_NEXT_OPCODE();
20395 }
20396 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20397 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20398 {
20399 	USE_OPLINE
20400 	zend_free_op free_op1;
20401 	zval **container;
20402 
20403 	SAVE_OPLINE();
20404 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20405 
20406 	if (IS_VAR == IS_CV) {
20407 		if (container != &EG(uninitialized_zval_ptr)) {
20408 			SEPARATE_ZVAL_IF_NOT_REF(container);
20409 		}
20410 	}
20411 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20412 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20413 	}
20414 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_UNSET TSRMLS_CC);
20415 
20416 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20417 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20418 	}
20419 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20420 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
20421 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
20422 	} else {
20423 		zend_free_op free_res;
20424 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
20425 
20426 		PZVAL_UNLOCK(*retval_ptr, &free_res);
20427 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
20428 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
20429 		}
20430 		PZVAL_LOCK(*retval_ptr);
20431 		FREE_OP_VAR_PTR(free_res);
20432 		CHECK_EXCEPTION();
20433 		ZEND_VM_NEXT_OPCODE();
20434 	}
20435 }
20436 
zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS)20437 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS)
20438 {
20439 	USE_OPLINE
20440 	zend_free_op free_op1;
20441 	zval *container;
20442 
20443 	zval *offset;
20444 
20445 	SAVE_OPLINE();
20446 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20447 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20448 
20449 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
20450 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
20451 		zend_error(E_NOTICE, "Trying to get property of non-object");
20452 		PZVAL_LOCK(&EG(uninitialized_zval));
20453 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20454 
20455 	} else {
20456 		zval *retval;
20457 
20458 		if (0) {
20459 			MAKE_REAL_ZVAL_PTR(offset);
20460 		}
20461 
20462 		/* here we are sure we are dealing with an object */
20463 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20464 
20465 		PZVAL_LOCK(retval);
20466 		AI_SET_PTR(&EX_T(opline->result.var), retval);
20467 
20468 		if (0) {
20469 			zval_ptr_dtor(&offset);
20470 		} else {
20471 
20472 		}
20473 	}
20474 
20475 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20476 	CHECK_EXCEPTION();
20477 	ZEND_VM_NEXT_OPCODE();
20478 }
20479 
ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20480 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20481 {
20482 	return zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20483 }
20484 
ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20485 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20486 {
20487 	USE_OPLINE
20488 	zend_free_op free_op1;
20489 	zval *property;
20490 	zval **container;
20491 
20492 	SAVE_OPLINE();
20493 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20494 
20495 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
20496 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
20497 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
20498 	}
20499 
20500 	if (0) {
20501 		MAKE_REAL_ZVAL_PTR(property);
20502 	}
20503 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20504 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20505 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
20506 	}
20507 
20508 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
20509 	if (0) {
20510 		zval_ptr_dtor(&property);
20511 	} else {
20512 
20513 	}
20514 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20515 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20516 	}
20517 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20518 
20519 	/* We are going to assign the result by reference */
20520 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
20521 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
20522 
20523 		Z_DELREF_PP(retval_ptr);
20524 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
20525 		Z_ADDREF_PP(retval_ptr);
20526 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
20527 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
20528 	}
20529 
20530 	CHECK_EXCEPTION();
20531 	ZEND_VM_NEXT_OPCODE();
20532 }
20533 
ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20534 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20535 {
20536 	USE_OPLINE
20537 	zend_free_op free_op1;
20538 	zval *property;
20539 	zval **container;
20540 
20541 	SAVE_OPLINE();
20542 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20543 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20544 
20545 	if (0) {
20546 		MAKE_REAL_ZVAL_PTR(property);
20547 	}
20548 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20549 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
20550 	}
20551 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
20552 	if (0) {
20553 		zval_ptr_dtor(&property);
20554 	} else {
20555 
20556 	}
20557 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20558 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20559 	}
20560 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20561 	CHECK_EXCEPTION();
20562 	ZEND_VM_NEXT_OPCODE();
20563 }
20564 
ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20565 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20566 {
20567 	USE_OPLINE
20568 	zend_free_op free_op1;
20569 	zval *container;
20570 
20571 	zval *offset;
20572 
20573 	SAVE_OPLINE();
20574 	container = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20575 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20576 
20577 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
20578 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
20579 		PZVAL_LOCK(&EG(uninitialized_zval));
20580 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20581 
20582 	} else {
20583 		zval *retval;
20584 
20585 		if (0) {
20586 			MAKE_REAL_ZVAL_PTR(offset);
20587 		}
20588 
20589 		/* here we are sure we are dealing with an object */
20590 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20591 
20592 		PZVAL_LOCK(retval);
20593 		AI_SET_PTR(&EX_T(opline->result.var), retval);
20594 
20595 		if (0) {
20596 			zval_ptr_dtor(&offset);
20597 		} else {
20598 
20599 		}
20600 	}
20601 
20602 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20603 	CHECK_EXCEPTION();
20604 	ZEND_VM_NEXT_OPCODE();
20605 }
20606 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20607 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20608 {
20609 	USE_OPLINE
20610 
20611 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
20612 		/* Behave like FETCH_OBJ_W */
20613 		zend_free_op free_op1;
20614 		zval *property;
20615 		zval **container;
20616 
20617 		SAVE_OPLINE();
20618 		property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20619 		container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20620 
20621 		if (0) {
20622 			MAKE_REAL_ZVAL_PTR(property);
20623 		}
20624 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20625 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
20626 		}
20627 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
20628 		if (0) {
20629 			zval_ptr_dtor(&property);
20630 		} else {
20631 
20632 		}
20633 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20634 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20635 		}
20636 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20637 		CHECK_EXCEPTION();
20638 		ZEND_VM_NEXT_OPCODE();
20639 	} else {
20640 		return zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20641 	}
20642 }
20643 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20644 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20645 {
20646 	USE_OPLINE
20647 	zend_free_op free_op1, free_res;
20648 	zval **container;
20649 	zval *property;
20650 
20651 	SAVE_OPLINE();
20652 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20653 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20654 
20655 	if (IS_VAR == IS_CV) {
20656 		if (container != &EG(uninitialized_zval_ptr)) {
20657 			SEPARATE_ZVAL_IF_NOT_REF(container);
20658 		}
20659 	}
20660 	if (0) {
20661 		MAKE_REAL_ZVAL_PTR(property);
20662 	}
20663 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
20664 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
20665 	}
20666 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
20667 	if (0) {
20668 		zval_ptr_dtor(&property);
20669 	} else {
20670 
20671 	}
20672 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
20673 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
20674 	}
20675 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20676 
20677 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
20678 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
20679 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
20680 	}
20681 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
20682 	FREE_OP_VAR_PTR(free_res);
20683 	CHECK_EXCEPTION();
20684 	ZEND_VM_NEXT_OPCODE();
20685 }
20686 
ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20687 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20688 {
20689 	USE_OPLINE
20690 	zend_free_op free_op1;
20691 	zval **object_ptr;
20692 	zval *property_name;
20693 
20694 	SAVE_OPLINE();
20695 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20696 	property_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20697 
20698 	if (0) {
20699 		MAKE_REAL_ZVAL_PTR(property_name);
20700 	}
20701 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
20702 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20703 	}
20704 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20705 	if (0) {
20706 		zval_ptr_dtor(&property_name);
20707 	} else {
20708 
20709 	}
20710 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20711 	/* assign_obj has two opcodes! */
20712 	CHECK_EXCEPTION();
20713 	ZEND_VM_INC_OPCODE();
20714 	ZEND_VM_NEXT_OPCODE();
20715 }
20716 
ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20717 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20718 {
20719 	USE_OPLINE
20720 	zend_free_op free_op1;
20721 	zval **object_ptr;
20722 
20723 	SAVE_OPLINE();
20724 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20725 
20726 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
20727 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
20728 	}
20729 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
20730 
20731 		zval *property_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20732 
20733 		if (0) {
20734 			MAKE_REAL_ZVAL_PTR(property_name);
20735 		}
20736 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20737 		if (0) {
20738 			zval_ptr_dtor(&property_name);
20739 		} else {
20740 
20741 		}
20742 	} else {
20743 		zend_free_op free_op_data1, free_op_data2;
20744 		zval *value;
20745 		zval *dim = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20746 		zval **variable_ptr_ptr;
20747 
20748 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CV, BP_VAR_W TSRMLS_CC);
20749 
20750 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
20751 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
20752 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
20753 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
20754 				if (RETURN_VALUE_USED(opline)) {
20755 					zval *retval;
20756 
20757 					ALLOC_ZVAL(retval);
20758 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
20759 					INIT_PZVAL(retval);
20760 					AI_SET_PTR(&EX_T(opline->result.var), retval);
20761 				}
20762 			} else if (RETURN_VALUE_USED(opline)) {
20763 				PZVAL_LOCK(&EG(uninitialized_zval));
20764 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20765 			}
20766 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
20767 			if (IS_TMP_FREE(free_op_data1)) {
20768 				zval_dtor(value);
20769 			}
20770 			if (RETURN_VALUE_USED(opline)) {
20771 				PZVAL_LOCK(&EG(uninitialized_zval));
20772 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20773 			}
20774 		} else {
20775 			if ((opline+1)->op1_type == IS_TMP_VAR) {
20776 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20777 			} else if ((opline+1)->op1_type == IS_CONST) {
20778 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20779 			} else {
20780 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20781 			}
20782 			if (RETURN_VALUE_USED(opline)) {
20783 				PZVAL_LOCK(value);
20784 				AI_SET_PTR(&EX_T(opline->result.var), value);
20785 			}
20786 		}
20787 		FREE_OP_VAR_PTR(free_op_data2);
20788 	 	FREE_OP_IF_VAR(free_op_data1);
20789 	}
20790  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20791 	/* assign_dim has two opcodes! */
20792 	CHECK_EXCEPTION();
20793 	ZEND_VM_INC_OPCODE();
20794 	ZEND_VM_NEXT_OPCODE();
20795 }
20796 
ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20797 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20798 {
20799 	USE_OPLINE
20800 	zend_free_op free_op1;
20801 	zval *value;
20802 	zval **variable_ptr_ptr;
20803 
20804 	SAVE_OPLINE();
20805 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20806 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20807 
20808 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
20809 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CV TSRMLS_CC)) {
20810 			if (RETURN_VALUE_USED(opline)) {
20811 				zval *retval;
20812 
20813 				ALLOC_ZVAL(retval);
20814 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
20815 				INIT_PZVAL(retval);
20816 				AI_SET_PTR(&EX_T(opline->result.var), retval);
20817 			}
20818 		} else if (RETURN_VALUE_USED(opline)) {
20819 			PZVAL_LOCK(&EG(uninitialized_zval));
20820 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20821 		}
20822 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
20823 		if (0) {
20824 			zval_dtor(value);
20825 		}
20826 		if (RETURN_VALUE_USED(opline)) {
20827 			PZVAL_LOCK(&EG(uninitialized_zval));
20828 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
20829 		}
20830 	} else {
20831 		if (IS_CV == IS_TMP_VAR) {
20832 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20833 		} else if (IS_CV == IS_CONST) {
20834 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20835 		} else {
20836 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
20837 		}
20838 		if (RETURN_VALUE_USED(opline)) {
20839 			PZVAL_LOCK(value);
20840 			AI_SET_PTR(&EX_T(opline->result.var), value);
20841 		}
20842 	}
20843 
20844 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20845 
20846 	/* zend_assign_to_variable() always takes care of op2, never free it! */
20847 
20848 	CHECK_EXCEPTION();
20849 	ZEND_VM_NEXT_OPCODE();
20850 }
20851 
ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20852 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20853 {
20854 	USE_OPLINE
20855 	zend_free_op free_op1, free_op2;
20856 	zval **variable_ptr_ptr;
20857 	zval **value_ptr_ptr;
20858 
20859 	SAVE_OPLINE();
20860 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op2.var TSRMLS_CC);
20861 
20862 	if (IS_CV == IS_VAR &&
20863 	    value_ptr_ptr &&
20864 	    !Z_ISREF_PP(value_ptr_ptr) &&
20865 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
20866 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
20867 		if (free_op2.var == NULL) {
20868 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
20869 		}
20870 		zend_error(E_STRICT, "Only variables should be assigned by reference");
20871 		if (UNEXPECTED(EG(exception) != NULL)) {
20872 
20873 			HANDLE_EXCEPTION();
20874 		}
20875 		return ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20876 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
20877 		PZVAL_LOCK(*value_ptr_ptr);
20878 	}
20879 	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
20880 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
20881 	}
20882 
20883 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20884 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
20885 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
20886 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
20887 	}
20888 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
20889 
20890 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
20891 		Z_DELREF_PP(variable_ptr_ptr);
20892 	}
20893 
20894 	if (RETURN_VALUE_USED(opline)) {
20895 		PZVAL_LOCK(*variable_ptr_ptr);
20896 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
20897 	}
20898 
20899 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20900 
20901 	CHECK_EXCEPTION();
20902 	ZEND_VM_NEXT_OPCODE();
20903 }
20904 
ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20905 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20906 {
20907 	USE_OPLINE
20908 	zval *function_name;
20909 	char *function_name_strval;
20910 	int function_name_strlen;
20911 	zend_free_op free_op1;
20912 
20913 	SAVE_OPLINE();
20914 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
20915 
20916 	function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
20917 
20918 	if (IS_CV != IS_CONST &&
20919 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
20920 		zend_error_noreturn(E_ERROR, "Method name must be a string");
20921 	}
20922 
20923 	function_name_strval = Z_STRVAL_P(function_name);
20924 	function_name_strlen = Z_STRLEN_P(function_name);
20925 
20926 	EX(object) = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
20927 
20928 	if (EXPECTED(EX(object) != NULL) &&
20929 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
20930 		EX(called_scope) = Z_OBJCE_P(EX(object));
20931 
20932 		if (IS_CV != IS_CONST ||
20933 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
20934 		    zval *object = EX(object);
20935 
20936 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
20937 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
20938 			}
20939 
20940 			/* First, locate the function. */
20941 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
20942 			if (UNEXPECTED(EX(fbc) == NULL)) {
20943 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
20944 			}
20945 			if (IS_CV == IS_CONST &&
20946 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
20947 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
20948 			    EXPECTED(EX(object) == object)) {
20949 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
20950 			}
20951 		}
20952 	} else {
20953 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
20954 	}
20955 
20956 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
20957 		EX(object) = NULL;
20958 	} else {
20959 		if (!PZVAL_IS_REF(EX(object))) {
20960 			Z_ADDREF_P(EX(object)); /* For $this pointer */
20961 		} else {
20962 			zval *this_ptr;
20963 			ALLOC_ZVAL(this_ptr);
20964 			INIT_PZVAL_COPY(this_ptr, EX(object));
20965 			zval_copy_ctor(this_ptr);
20966 			EX(object) = this_ptr;
20967 		}
20968 	}
20969 
20970 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20971 
20972 	CHECK_EXCEPTION();
20973 	ZEND_VM_NEXT_OPCODE();
20974 }
20975 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20976 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20977 {
20978 	USE_OPLINE
20979 	zval *function_name;
20980 	zend_class_entry *ce;
20981 
20982 	SAVE_OPLINE();
20983 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
20984 
20985 	if (IS_VAR == IS_CONST) {
20986 		/* no function found. try a static method in class */
20987 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
20988 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
20989 		} else {
20990 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
20991 			if (UNEXPECTED(EG(exception) != NULL)) {
20992 				HANDLE_EXCEPTION();
20993 			}
20994 			if (UNEXPECTED(ce == NULL)) {
20995 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
20996 			}
20997 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
20998 		}
20999 		EX(called_scope) = ce;
21000 	} else {
21001 		ce = EX_T(opline->op1.var).class_entry;
21002 
21003 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
21004 			EX(called_scope) = EG(called_scope);
21005 		} else {
21006 			EX(called_scope) = ce;
21007 		}
21008 	}
21009 
21010 	if (IS_VAR == IS_CONST &&
21011 	    IS_CV == IS_CONST &&
21012 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
21013 		EX(fbc) = CACHED_PTR(opline->op2.literal->cache_slot);
21014 	} else if (IS_VAR != IS_CONST &&
21015 	           IS_CV == IS_CONST &&
21016 	           (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
21017 		/* do nothing */
21018 	} else if (IS_CV != IS_UNUSED) {
21019 		char *function_name_strval = NULL;
21020 		int function_name_strlen = 0;
21021 
21022 
21023 		if (IS_CV == IS_CONST) {
21024 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
21025 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
21026 		} else {
21027 			function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
21028 
21029 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
21030 				zend_error_noreturn(E_ERROR, "Function name must be a string");
21031 			} else {
21032 				function_name_strval = Z_STRVAL_P(function_name);
21033 				function_name_strlen = Z_STRLEN_P(function_name);
21034  			}
21035 		}
21036 
21037 		if (function_name_strval) {
21038 			if (ce->get_static_method) {
21039 				EX(fbc) = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
21040 			} else {
21041 				EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
21042 			}
21043 			if (UNEXPECTED(EX(fbc) == NULL)) {
21044 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
21045 			}
21046 			if (IS_CV == IS_CONST &&
21047 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
21048 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
21049 				if (IS_VAR == IS_CONST) {
21050 					CACHE_PTR(opline->op2.literal->cache_slot, EX(fbc));
21051 				} else {
21052 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, EX(fbc));
21053 				}
21054 			}
21055 		}
21056 		if (IS_CV != IS_CONST) {
21057 
21058 		}
21059 	} else {
21060 		if (UNEXPECTED(ce->constructor == NULL)) {
21061 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
21062 		}
21063 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
21064 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
21065 		}
21066 		EX(fbc) = ce->constructor;
21067 	}
21068 
21069 	if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
21070 		EX(object) = NULL;
21071 	} else {
21072 		if (EG(This) &&
21073 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
21074 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
21075 		    /* We are calling method of the other (incompatible) class,
21076 		       but passing $this. This is done for compatibility with php-4. */
21077 			if (EX(fbc)->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
21078 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
21079 			} else {
21080 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
21081 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", EX(fbc)->common.scope->name, EX(fbc)->common.function_name);
21082 			}
21083 		}
21084 		if ((EX(object) = EG(This))) {
21085 			Z_ADDREF_P(EX(object));
21086 			EX(called_scope) = Z_OBJCE_P(EX(object));
21087 		}
21088 	}
21089 
21090 	CHECK_EXCEPTION();
21091 	ZEND_VM_NEXT_OPCODE();
21092 }
21093 
ZEND_CASE_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21094 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21095 {
21096 	USE_OPLINE
21097 	zend_free_op free_op1;
21098 
21099 	SAVE_OPLINE();
21100 	if (IS_VAR==IS_VAR) {
21101 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
21102 	}
21103 	is_equal_function(&EX_T(opline->result.var).tmp_var,
21104 				 _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC),
21105 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
21106 
21107 	CHECK_EXCEPTION();
21108 	ZEND_VM_NEXT_OPCODE();
21109 }
21110 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21111 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21112 {
21113 	USE_OPLINE
21114 	zend_free_op free_op1;
21115 	zval *expr_ptr;
21116 
21117 	SAVE_OPLINE();
21118 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
21119 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
21120 
21121 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
21122 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
21123 		}
21124 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
21125 		expr_ptr = *expr_ptr_ptr;
21126 		Z_ADDREF_P(expr_ptr);
21127 	} else {
21128 		expr_ptr=_get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
21129 		if (0) { /* temporary variable */
21130 			zval *new_expr;
21131 
21132 			ALLOC_ZVAL(new_expr);
21133 			INIT_PZVAL_COPY(new_expr, expr_ptr);
21134 			expr_ptr = new_expr;
21135 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
21136 			zval *new_expr;
21137 
21138 			ALLOC_ZVAL(new_expr);
21139 			INIT_PZVAL_COPY(new_expr, expr_ptr);
21140 			expr_ptr = new_expr;
21141 			zendi_zval_copy_ctor(*expr_ptr);
21142 		} else {
21143 			Z_ADDREF_P(expr_ptr);
21144 		}
21145 	}
21146 
21147 	if (IS_CV != IS_UNUSED) {
21148 
21149 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
21150 		ulong hval;
21151 
21152 		switch (Z_TYPE_P(offset)) {
21153 			case IS_DOUBLE:
21154 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
21155 				goto num_index;
21156 			case IS_LONG:
21157 			case IS_BOOL:
21158 				hval = Z_LVAL_P(offset);
21159 num_index:
21160 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
21161 				break;
21162 			case IS_STRING:
21163 				if (IS_CV == IS_CONST) {
21164 					hval = Z_HASH_P(offset);
21165 				} else {
21166 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
21167 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
21168 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
21169 					} else {
21170 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
21171 					}
21172 				}
21173 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
21174 				break;
21175 			case IS_NULL:
21176 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
21177 				break;
21178 			default:
21179 				zend_error(E_WARNING, "Illegal offset type");
21180 				zval_ptr_dtor(&expr_ptr);
21181 				/* do nothing */
21182 				break;
21183 		}
21184 
21185 	} else {
21186 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
21187 	}
21188 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
21189 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21190 	} else {
21191 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21192 	}
21193 	CHECK_EXCEPTION();
21194 	ZEND_VM_NEXT_OPCODE();
21195 }
21196 
ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21197 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21198 {
21199 	USE_OPLINE
21200 
21201 	array_init(&EX_T(opline->result.var).tmp_var);
21202 	if (IS_VAR == IS_UNUSED) {
21203 		ZEND_VM_NEXT_OPCODE();
21204 #if 0 || IS_VAR != IS_UNUSED
21205 	} else {
21206 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21207 #endif
21208 	}
21209 }
21210 
ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21211 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21212 {
21213 	USE_OPLINE
21214 	zend_free_op free_op1;
21215 	zval **container;
21216 	zval *offset;
21217 	ulong hval;
21218 
21219 	SAVE_OPLINE();
21220 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
21221 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
21222 		SEPARATE_ZVAL_IF_NOT_REF(container);
21223 	}
21224 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
21225 
21226 	if (IS_VAR != IS_VAR || container) {
21227 		switch (Z_TYPE_PP(container)) {
21228 			case IS_ARRAY: {
21229 				HashTable *ht = Z_ARRVAL_PP(container);
21230 
21231 				switch (Z_TYPE_P(offset)) {
21232 					case IS_DOUBLE:
21233 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
21234 						zend_hash_index_del(ht, hval);
21235 						break;
21236 					case IS_RESOURCE:
21237 					case IS_BOOL:
21238 					case IS_LONG:
21239 						hval = Z_LVAL_P(offset);
21240 						zend_hash_index_del(ht, hval);
21241 						break;
21242 					case IS_STRING:
21243 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
21244 							Z_ADDREF_P(offset);
21245 						}
21246 						if (IS_CV == IS_CONST) {
21247 							hval = Z_HASH_P(offset);
21248 						} else {
21249 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
21250 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
21251 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
21252 							} else {
21253 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
21254 							}
21255 						}
21256 						if (ht == &EG(symbol_table)) {
21257 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
21258 						} else {
21259 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
21260 						}
21261 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
21262 							zval_ptr_dtor(&offset);
21263 						}
21264 						break;
21265 num_index_dim:
21266 						zend_hash_index_del(ht, hval);
21267 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
21268 							zval_ptr_dtor(&offset);
21269 						}
21270 						break;
21271 					case IS_NULL:
21272 						zend_hash_del(ht, "", sizeof(""));
21273 						break;
21274 					default:
21275 						zend_error(E_WARNING, "Illegal offset type in unset");
21276 						break;
21277 				}
21278 
21279 				break;
21280 			}
21281 			case IS_OBJECT:
21282 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
21283 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
21284 				}
21285 				if (0) {
21286 					MAKE_REAL_ZVAL_PTR(offset);
21287 				}
21288 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
21289 				if (0) {
21290 					zval_ptr_dtor(&offset);
21291 				} else {
21292 
21293 				}
21294 				break;
21295 			case IS_STRING:
21296 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
21297 				ZEND_VM_CONTINUE(); /* bailed out before */
21298 			default:
21299 
21300 				break;
21301 		}
21302 	} else {
21303 
21304 	}
21305 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21306 
21307 	CHECK_EXCEPTION();
21308 	ZEND_VM_NEXT_OPCODE();
21309 }
21310 
ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21311 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21312 {
21313 	USE_OPLINE
21314 	zend_free_op free_op1;
21315 	zval **container;
21316 	zval *offset;
21317 
21318 	SAVE_OPLINE();
21319 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
21320 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
21321 
21322 	if (IS_VAR != IS_VAR || container) {
21323 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
21324 			SEPARATE_ZVAL_IF_NOT_REF(container);
21325 		}
21326 		if (Z_TYPE_PP(container) == IS_OBJECT) {
21327 			if (0) {
21328 				MAKE_REAL_ZVAL_PTR(offset);
21329 			}
21330 			if (Z_OBJ_HT_P(*container)->unset_property) {
21331 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21332 			} else {
21333 				zend_error(E_NOTICE, "Trying to unset property of non-object");
21334 			}
21335 			if (0) {
21336 				zval_ptr_dtor(&offset);
21337 			} else {
21338 
21339 			}
21340 		} else {
21341 
21342 		}
21343 	} else {
21344 
21345 	}
21346 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21347 
21348 	CHECK_EXCEPTION();
21349 	ZEND_VM_NEXT_OPCODE();
21350 }
21351 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)21352 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
21353 {
21354 	USE_OPLINE
21355 	zend_free_op free_op1;
21356 	zval **container;
21357 	zval **value = NULL;
21358 	int result = 0;
21359 	ulong hval;
21360 	zval *offset;
21361 
21362 	SAVE_OPLINE();
21363 	container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
21364 
21365 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
21366 
21367 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
21368 		HashTable *ht;
21369 		int isset = 0;
21370 
21371 		ht = Z_ARRVAL_PP(container);
21372 
21373 		switch (Z_TYPE_P(offset)) {
21374 			case IS_DOUBLE:
21375 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
21376 				goto num_index_prop;
21377 			case IS_RESOURCE:
21378 			case IS_BOOL:
21379 			case IS_LONG:
21380 				hval = Z_LVAL_P(offset);
21381 num_index_prop:
21382 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
21383 					isset = 1;
21384 				}
21385 				break;
21386 			case IS_STRING:
21387 				if (IS_CV == IS_CONST) {
21388 					hval = Z_HASH_P(offset);
21389 				} else {
21390 					if (!prop_dim) {
21391 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
21392 					}
21393 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
21394 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
21395 					} else {
21396 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
21397 					}
21398 				}
21399 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
21400 					isset = 1;
21401 				}
21402 				break;
21403 			case IS_NULL:
21404 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
21405 					isset = 1;
21406 				}
21407 				break;
21408 			default:
21409 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
21410 				break;
21411 		}
21412 
21413 		if (opline->extended_value & ZEND_ISSET) {
21414 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
21415 				result = 0;
21416 			} else {
21417 				result = isset;
21418 			}
21419 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
21420 			if (!isset || !i_zend_is_true(*value)) {
21421 				result = 0;
21422 			} else {
21423 				result = 1;
21424 			}
21425 		}
21426 
21427 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
21428 		if (0) {
21429 			MAKE_REAL_ZVAL_PTR(offset);
21430 		}
21431 		if (prop_dim) {
21432 			if (Z_OBJ_HT_P(*container)->has_property) {
21433 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21434 			} else {
21435 				zend_error(E_NOTICE, "Trying to check property of non-object");
21436 				result = 0;
21437 			}
21438 		} else {
21439 			if (Z_OBJ_HT_P(*container)->has_dimension) {
21440 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
21441 			} else {
21442 				zend_error(E_NOTICE, "Trying to check element of non-array");
21443 				result = 0;
21444 			}
21445 		}
21446 		if (0) {
21447 			zval_ptr_dtor(&offset);
21448 		} else {
21449 
21450 		}
21451 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
21452 		zval tmp;
21453 
21454 		if (Z_TYPE_P(offset) != IS_LONG) {
21455 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
21456 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
21457 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
21458 				ZVAL_COPY_VALUE(&tmp, offset);
21459 				zval_copy_ctor(&tmp);
21460 				convert_to_long(&tmp);
21461 				offset = &tmp;
21462 			} else {
21463 				/* can not be converted to proper offset, return "not set" */
21464 				result = 0;
21465 			}
21466 		}
21467 		if (Z_TYPE_P(offset) == IS_LONG) {
21468 			if (opline->extended_value & ZEND_ISSET) {
21469 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
21470 					result = 1;
21471 				}
21472 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
21473 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
21474 					result = 1;
21475 				}
21476 			}
21477 		}
21478 
21479 	} else {
21480 
21481 	}
21482 
21483 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
21484 	if (opline->extended_value & ZEND_ISSET) {
21485 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
21486 	} else {
21487 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
21488 	}
21489 
21490 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21491 
21492 	CHECK_EXCEPTION();
21493 	ZEND_VM_NEXT_OPCODE();
21494 }
21495 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21496 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21497 {
21498 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21499 }
21500 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21501 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21502 {
21503 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21504 }
21505 
ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21506 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21507 {
21508 	USE_OPLINE
21509 
21510 	zval *obj;
21511 	zend_class_entry *ce;
21512 	zend_function *clone;
21513 	zend_object_clone_obj_t clone_call;
21514 
21515 	SAVE_OPLINE();
21516 	obj = _get_obj_zval_ptr_unused(TSRMLS_C);
21517 
21518 	if (IS_UNUSED == IS_CONST ||
21519 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
21520 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
21521 	}
21522 
21523 	ce = Z_OBJCE_P(obj);
21524 	clone = ce ? ce->clone : NULL;
21525 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
21526 	if (UNEXPECTED(clone_call == NULL)) {
21527 		if (ce) {
21528 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
21529 		} else {
21530 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
21531 		}
21532 	}
21533 
21534 	if (ce && clone) {
21535 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
21536 			/* Ensure that if we're calling a private function, we're allowed to do so.
21537 			 */
21538 			if (UNEXPECTED(ce != EG(scope))) {
21539 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
21540 			}
21541 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
21542 			/* Ensure that if we're calling a protected function, we're allowed to do so.
21543 			 */
21544 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
21545 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
21546 			}
21547 		}
21548 	}
21549 
21550 	if (EXPECTED(EG(exception) == NULL)) {
21551 		zval *retval;
21552 
21553 		ALLOC_ZVAL(retval);
21554 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
21555 		Z_TYPE_P(retval) = IS_OBJECT;
21556 		Z_SET_REFCOUNT_P(retval, 1);
21557 		Z_SET_ISREF_P(retval);
21558 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
21559 			zval_ptr_dtor(&retval);
21560 		} else {
21561 			AI_SET_PTR(&EX_T(opline->result.var), retval);
21562 		}
21563 	}
21564 
21565 	CHECK_EXCEPTION();
21566 	ZEND_VM_NEXT_OPCODE();
21567 }
21568 
ZEND_EXIT_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21569 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21570 {
21571 #if 0 || (IS_UNUSED != IS_UNUSED)
21572 	USE_OPLINE
21573 
21574 	SAVE_OPLINE();
21575 	if (IS_UNUSED != IS_UNUSED) {
21576 
21577 		zval *ptr = NULL;
21578 
21579 		if (Z_TYPE_P(ptr) == IS_LONG) {
21580 			EG(exit_status) = Z_LVAL_P(ptr);
21581 		} else {
21582 			zend_print_variable(ptr);
21583 		}
21584 
21585 	}
21586 #endif
21587 	zend_bailout();
21588 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
21589 }
21590 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)21591 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
21592 {
21593 	USE_OPLINE
21594 	zend_free_op free_op_data1;
21595 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
21596 	zval *object;
21597 	zval *property = opline->op2.zv;
21598 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
21599 	int have_get_ptr = 0;
21600 
21601 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
21602 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
21603 	}
21604 
21605 	make_real_object(object_ptr TSRMLS_CC);
21606 	object = *object_ptr;
21607 
21608 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
21609 		zend_error(E_WARNING, "Attempt to assign property of non-object");
21610 
21611 		FREE_OP(free_op_data1);
21612 
21613 		if (RETURN_VALUE_USED(opline)) {
21614 			PZVAL_LOCK(&EG(uninitialized_zval));
21615 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
21616 			EX_T(opline->result.var).var.ptr_ptr = NULL;
21617 		}
21618 	} else {
21619 		/* here we are sure we are dealing with an object */
21620 		if (0) {
21621 			MAKE_REAL_ZVAL_PTR(property);
21622 		}
21623 
21624 		/* here property is a string */
21625 		if (opline->extended_value == ZEND_ASSIGN_OBJ
21626 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
21627 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21628 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
21629 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
21630 
21631 				have_get_ptr = 1;
21632 				binary_op(*zptr, *zptr, value TSRMLS_CC);
21633 				if (RETURN_VALUE_USED(opline)) {
21634 					PZVAL_LOCK(*zptr);
21635 					EX_T(opline->result.var).var.ptr = *zptr;
21636 					EX_T(opline->result.var).var.ptr_ptr = NULL;
21637 				}
21638 			}
21639 		}
21640 
21641 		if (!have_get_ptr) {
21642 			zval *z = NULL;
21643 
21644 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
21645 				if (Z_OBJ_HT_P(object)->read_property) {
21646 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21647 				}
21648 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
21649 				if (Z_OBJ_HT_P(object)->read_dimension) {
21650 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
21651 				}
21652 			}
21653 			if (z) {
21654 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
21655 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
21656 
21657 					if (Z_REFCOUNT_P(z) == 0) {
21658 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
21659 						zval_dtor(z);
21660 						FREE_ZVAL(z);
21661 					}
21662 					z = value;
21663 				}
21664 				Z_ADDREF_P(z);
21665 				SEPARATE_ZVAL_IF_NOT_REF(&z);
21666 				binary_op(z, z, value TSRMLS_CC);
21667 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
21668 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21669 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
21670 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
21671 				}
21672 				if (RETURN_VALUE_USED(opline)) {
21673 					PZVAL_LOCK(z);
21674 					EX_T(opline->result.var).var.ptr = z;
21675 					EX_T(opline->result.var).var.ptr_ptr = NULL;
21676 				}
21677 				zval_ptr_dtor(&z);
21678 			} else {
21679 				zend_error(E_WARNING, "Attempt to assign property of non-object");
21680 				if (RETURN_VALUE_USED(opline)) {
21681 					PZVAL_LOCK(&EG(uninitialized_zval));
21682 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
21683 					EX_T(opline->result.var).var.ptr_ptr = NULL;
21684 				}
21685 			}
21686 		}
21687 
21688 		if (0) {
21689 			zval_ptr_dtor(&property);
21690 		} else {
21691 
21692 		}
21693 		FREE_OP(free_op_data1);
21694 	}
21695 
21696 	/* assign_obj has two opcodes! */
21697 	CHECK_EXCEPTION();
21698 	ZEND_VM_INC_OPCODE();
21699 	ZEND_VM_NEXT_OPCODE();
21700 }
21701 
zend_binary_assign_op_helper_SPEC_UNUSED_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)21702 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
21703 {
21704 	USE_OPLINE
21705 	zend_free_op free_op_data2, free_op_data1;
21706 	zval **var_ptr;
21707 	zval *value;
21708 
21709 	SAVE_OPLINE();
21710 	switch (opline->extended_value) {
21711 		case ZEND_ASSIGN_OBJ:
21712 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21713 			break;
21714 		case ZEND_ASSIGN_DIM: {
21715 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
21716 
21717 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
21718 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21719 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
21720 					if (IS_UNUSED == IS_VAR && !0) {
21721 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
21722 					}
21723 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21724 				} else {
21725 					zval *dim = opline->op2.zv;
21726 
21727 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
21728 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
21729 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
21730 				}
21731 			}
21732 			break;
21733 		default:
21734 			value = opline->op2.zv;
21735 			var_ptr = NULL;
21736 			/* do nothing */
21737 			break;
21738 	}
21739 
21740 	if (UNEXPECTED(var_ptr == NULL)) {
21741 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
21742 	}
21743 
21744 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
21745 		if (RETURN_VALUE_USED(opline)) {
21746 			PZVAL_LOCK(&EG(uninitialized_zval));
21747 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
21748 		}
21749 
21750 
21751 		CHECK_EXCEPTION();
21752 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
21753 			ZEND_VM_INC_OPCODE();
21754 		}
21755 		ZEND_VM_NEXT_OPCODE();
21756 	}
21757 
21758 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
21759 
21760 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
21761 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
21762 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
21763 		/* proxy object */
21764 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
21765 		Z_ADDREF_P(objval);
21766 		binary_op(objval, objval, value TSRMLS_CC);
21767 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
21768 		zval_ptr_dtor(&objval);
21769 	} else {
21770 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
21771 	}
21772 
21773 	if (RETURN_VALUE_USED(opline)) {
21774 		PZVAL_LOCK(*var_ptr);
21775 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
21776 	}
21777 
21778 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
21779 		FREE_OP(free_op_data1);
21780 		FREE_OP_VAR_PTR(free_op_data2);
21781 
21782 		CHECK_EXCEPTION();
21783 		ZEND_VM_INC_OPCODE();
21784 	} else {
21785 
21786 		CHECK_EXCEPTION();
21787 	}
21788 	ZEND_VM_NEXT_OPCODE();
21789 }
21790 
ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21791 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21792 {
21793 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21794 }
21795 
ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21796 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21797 {
21798 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21799 }
21800 
ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21801 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21802 {
21803 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21804 }
21805 
ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21806 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21807 {
21808 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21809 }
21810 
ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21811 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21812 {
21813 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21814 }
21815 
ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21816 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21817 {
21818 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21819 }
21820 
ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21821 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21822 {
21823 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21824 }
21825 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21826 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21827 {
21828 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21829 }
21830 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21831 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21832 {
21833 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21834 }
21835 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21836 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21837 {
21838 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21839 }
21840 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21841 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21842 {
21843 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21844 }
21845 
zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)21846 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
21847 {
21848 	USE_OPLINE
21849 
21850 	zval **object_ptr;
21851 	zval *object;
21852 	zval *property;
21853 	zval **retval;
21854 	int have_get_ptr = 0;
21855 
21856 	SAVE_OPLINE();
21857 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
21858 	property = opline->op2.zv;
21859 	retval = &EX_T(opline->result.var).var.ptr;
21860 
21861 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
21862 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
21863 	}
21864 
21865 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
21866 	object = *object_ptr;
21867 
21868 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
21869 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
21870 
21871 		if (RETURN_VALUE_USED(opline)) {
21872 			PZVAL_LOCK(&EG(uninitialized_zval));
21873 			*retval = &EG(uninitialized_zval);
21874 		}
21875 
21876 		CHECK_EXCEPTION();
21877 		ZEND_VM_NEXT_OPCODE();
21878 	}
21879 
21880 	/* here we are sure we are dealing with an object */
21881 
21882 	if (0) {
21883 		MAKE_REAL_ZVAL_PTR(property);
21884 	}
21885 
21886 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
21887 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21888 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
21889 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
21890 
21891 			have_get_ptr = 1;
21892 			incdec_op(*zptr);
21893 			if (RETURN_VALUE_USED(opline)) {
21894 				*retval = *zptr;
21895 				PZVAL_LOCK(*retval);
21896 			}
21897 		}
21898 	}
21899 
21900 	if (!have_get_ptr) {
21901 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
21902 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21903 
21904 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
21905 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
21906 
21907 				if (Z_REFCOUNT_P(z) == 0) {
21908 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
21909 					zval_dtor(z);
21910 					FREE_ZVAL(z);
21911 				}
21912 				z = value;
21913 			}
21914 			Z_ADDREF_P(z);
21915 			SEPARATE_ZVAL_IF_NOT_REF(&z);
21916 			incdec_op(z);
21917 			*retval = z;
21918 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21919 			SELECTIVE_PZVAL_LOCK(*retval, opline);
21920 			zval_ptr_dtor(&z);
21921 		} else {
21922 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
21923 			if (RETURN_VALUE_USED(opline)) {
21924 				PZVAL_LOCK(&EG(uninitialized_zval));
21925 				*retval = &EG(uninitialized_zval);
21926 			}
21927 		}
21928 	}
21929 
21930 	if (0) {
21931 		zval_ptr_dtor(&property);
21932 	} else {
21933 
21934 	}
21935 
21936 	CHECK_EXCEPTION();
21937 	ZEND_VM_NEXT_OPCODE();
21938 }
21939 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21940 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21941 {
21942 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21943 }
21944 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21945 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21946 {
21947 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21948 }
21949 
zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)21950 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
21951 {
21952 	USE_OPLINE
21953 
21954 	zval **object_ptr;
21955 	zval *object;
21956 	zval *property;
21957 	zval *retval;
21958 	int have_get_ptr = 0;
21959 
21960 	SAVE_OPLINE();
21961 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
21962 	property = opline->op2.zv;
21963 	retval = &EX_T(opline->result.var).tmp_var;
21964 
21965 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
21966 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
21967 	}
21968 
21969 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
21970 	object = *object_ptr;
21971 
21972 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
21973 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
21974 
21975 		ZVAL_NULL(retval);
21976 
21977 		CHECK_EXCEPTION();
21978 		ZEND_VM_NEXT_OPCODE();
21979 	}
21980 
21981 	/* here we are sure we are dealing with an object */
21982 
21983 	if (0) {
21984 		MAKE_REAL_ZVAL_PTR(property);
21985 	}
21986 
21987 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
21988 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21989 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
21990 			have_get_ptr = 1;
21991 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
21992 
21993 			ZVAL_COPY_VALUE(retval, *zptr);
21994 			zendi_zval_copy_ctor(*retval);
21995 
21996 			incdec_op(*zptr);
21997 
21998 		}
21999 	}
22000 
22001 	if (!have_get_ptr) {
22002 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
22003 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22004 			zval *z_copy;
22005 
22006 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
22007 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
22008 
22009 				if (Z_REFCOUNT_P(z) == 0) {
22010 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
22011 					zval_dtor(z);
22012 					FREE_ZVAL(z);
22013 				}
22014 				z = value;
22015 			}
22016 			ZVAL_COPY_VALUE(retval, z);
22017 			zendi_zval_copy_ctor(*retval);
22018 			ALLOC_ZVAL(z_copy);
22019 			INIT_PZVAL_COPY(z_copy, z);
22020 			zendi_zval_copy_ctor(*z_copy);
22021 			incdec_op(z_copy);
22022 			Z_ADDREF_P(z);
22023 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22024 			zval_ptr_dtor(&z_copy);
22025 			zval_ptr_dtor(&z);
22026 		} else {
22027 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
22028 			ZVAL_NULL(retval);
22029 		}
22030 	}
22031 
22032 	if (0) {
22033 		zval_ptr_dtor(&property);
22034 	} else {
22035 
22036 	}
22037 
22038 	CHECK_EXCEPTION();
22039 	ZEND_VM_NEXT_OPCODE();
22040 }
22041 
ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22042 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22043 {
22044 	return zend_post_incdec_property_helper_SPEC_UNUSED_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22045 }
22046 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22047 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22048 {
22049 	return zend_post_incdec_property_helper_SPEC_UNUSED_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22050 }
22051 
zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS)22052 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS)
22053 {
22054 	USE_OPLINE
22055 
22056 	zval *container;
22057 
22058 	zval *offset;
22059 
22060 	SAVE_OPLINE();
22061 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
22062 	offset  = opline->op2.zv;
22063 
22064 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
22065 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
22066 		zend_error(E_NOTICE, "Trying to get property of non-object");
22067 		PZVAL_LOCK(&EG(uninitialized_zval));
22068 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
22069 
22070 	} else {
22071 		zval *retval;
22072 
22073 		if (0) {
22074 			MAKE_REAL_ZVAL_PTR(offset);
22075 		}
22076 
22077 		/* here we are sure we are dealing with an object */
22078 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22079 
22080 		PZVAL_LOCK(retval);
22081 		AI_SET_PTR(&EX_T(opline->result.var), retval);
22082 
22083 		if (0) {
22084 			zval_ptr_dtor(&offset);
22085 		} else {
22086 
22087 		}
22088 	}
22089 
22090 	CHECK_EXCEPTION();
22091 	ZEND_VM_NEXT_OPCODE();
22092 }
22093 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22094 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22095 {
22096 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22097 }
22098 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22099 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22100 {
22101 	USE_OPLINE
22102 	zend_free_op free_op1;
22103 	zval *property;
22104 	zval **container;
22105 
22106 	SAVE_OPLINE();
22107 	property = opline->op2.zv;
22108 
22109 	if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
22110 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
22111 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
22112 	}
22113 
22114 	if (0) {
22115 		MAKE_REAL_ZVAL_PTR(property);
22116 	}
22117 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22118 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
22119 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22120 	}
22121 
22122 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
22123 	if (0) {
22124 		zval_ptr_dtor(&property);
22125 	} else {
22126 
22127 	}
22128 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
22129 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22130 	}
22131 
22132 	/* We are going to assign the result by reference */
22133 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
22134 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
22135 
22136 		Z_DELREF_PP(retval_ptr);
22137 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
22138 		Z_ADDREF_PP(retval_ptr);
22139 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
22140 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
22141 	}
22142 
22143 	CHECK_EXCEPTION();
22144 	ZEND_VM_NEXT_OPCODE();
22145 }
22146 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22147 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22148 {
22149 	USE_OPLINE
22150 	zend_free_op free_op1;
22151 	zval *property;
22152 	zval **container;
22153 
22154 	SAVE_OPLINE();
22155 	property = opline->op2.zv;
22156 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22157 
22158 	if (0) {
22159 		MAKE_REAL_ZVAL_PTR(property);
22160 	}
22161 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
22162 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22163 	}
22164 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
22165 	if (0) {
22166 		zval_ptr_dtor(&property);
22167 	} else {
22168 
22169 	}
22170 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
22171 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22172 	}
22173 
22174 	CHECK_EXCEPTION();
22175 	ZEND_VM_NEXT_OPCODE();
22176 }
22177 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22178 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22179 {
22180 	USE_OPLINE
22181 
22182 	zval *container;
22183 
22184 	zval *offset;
22185 
22186 	SAVE_OPLINE();
22187 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
22188 	offset  = opline->op2.zv;
22189 
22190 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
22191 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
22192 		PZVAL_LOCK(&EG(uninitialized_zval));
22193 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
22194 
22195 	} else {
22196 		zval *retval;
22197 
22198 		if (0) {
22199 			MAKE_REAL_ZVAL_PTR(offset);
22200 		}
22201 
22202 		/* here we are sure we are dealing with an object */
22203 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22204 
22205 		PZVAL_LOCK(retval);
22206 		AI_SET_PTR(&EX_T(opline->result.var), retval);
22207 
22208 		if (0) {
22209 			zval_ptr_dtor(&offset);
22210 		} else {
22211 
22212 		}
22213 	}
22214 
22215 	CHECK_EXCEPTION();
22216 	ZEND_VM_NEXT_OPCODE();
22217 }
22218 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22219 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22220 {
22221 	USE_OPLINE
22222 
22223 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
22224 		/* Behave like FETCH_OBJ_W */
22225 		zend_free_op free_op1;
22226 		zval *property;
22227 		zval **container;
22228 
22229 		SAVE_OPLINE();
22230 		property = opline->op2.zv;
22231 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22232 
22233 		if (0) {
22234 			MAKE_REAL_ZVAL_PTR(property);
22235 		}
22236 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
22237 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22238 		}
22239 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
22240 		if (0) {
22241 			zval_ptr_dtor(&property);
22242 		} else {
22243 
22244 		}
22245 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
22246 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22247 		}
22248 
22249 		CHECK_EXCEPTION();
22250 		ZEND_VM_NEXT_OPCODE();
22251 	} else {
22252 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22253 	}
22254 }
22255 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22256 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22257 {
22258 	USE_OPLINE
22259 	zend_free_op free_op1, free_res;
22260 	zval **container;
22261 	zval *property;
22262 
22263 	SAVE_OPLINE();
22264 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22265 	property = opline->op2.zv;
22266 
22267 	if (IS_UNUSED == IS_CV) {
22268 		if (container != &EG(uninitialized_zval_ptr)) {
22269 			SEPARATE_ZVAL_IF_NOT_REF(container);
22270 		}
22271 	}
22272 	if (0) {
22273 		MAKE_REAL_ZVAL_PTR(property);
22274 	}
22275 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
22276 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22277 	}
22278 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
22279 	if (0) {
22280 		zval_ptr_dtor(&property);
22281 	} else {
22282 
22283 	}
22284 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
22285 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22286 	}
22287 
22288 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
22289 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
22290 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
22291 	}
22292 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
22293 	FREE_OP_VAR_PTR(free_res);
22294 	CHECK_EXCEPTION();
22295 	ZEND_VM_NEXT_OPCODE();
22296 }
22297 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22298 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22299 {
22300 	USE_OPLINE
22301 
22302 	zval **object_ptr;
22303 	zval *property_name;
22304 
22305 	SAVE_OPLINE();
22306 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22307 	property_name = opline->op2.zv;
22308 
22309 	if (0) {
22310 		MAKE_REAL_ZVAL_PTR(property_name);
22311 	}
22312 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
22313 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22314 	}
22315 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22316 	if (0) {
22317 		zval_ptr_dtor(&property_name);
22318 	} else {
22319 
22320 	}
22321 
22322 	/* assign_obj has two opcodes! */
22323 	CHECK_EXCEPTION();
22324 	ZEND_VM_INC_OPCODE();
22325 	ZEND_VM_NEXT_OPCODE();
22326 }
22327 
ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22328 static int ZEND_FASTCALL  ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22329 {
22330 	USE_OPLINE
22331 	zval *str = &EX_T(opline->result.var).tmp_var;
22332 
22333 	SAVE_OPLINE();
22334 
22335 	if (IS_UNUSED == IS_UNUSED) {
22336 		/* Initialize for erealloc in add_char_to_string */
22337 		Z_STRVAL_P(str) = NULL;
22338 		Z_STRLEN_P(str) = 0;
22339 		Z_TYPE_P(str) = IS_STRING;
22340 
22341 		INIT_PZVAL(str);
22342 	}
22343 
22344 	add_char_to_string(str, str, opline->op2.zv);
22345 
22346 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
22347 	/*CHECK_EXCEPTION();*/
22348 	ZEND_VM_NEXT_OPCODE();
22349 }
22350 
ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22351 static int ZEND_FASTCALL  ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22352 {
22353 	USE_OPLINE
22354 	zval *str = &EX_T(opline->result.var).tmp_var;
22355 
22356 	SAVE_OPLINE();
22357 
22358 	if (IS_UNUSED == IS_UNUSED) {
22359 		/* Initialize for erealloc in add_string_to_string */
22360 		Z_STRVAL_P(str) = NULL;
22361 		Z_STRLEN_P(str) = 0;
22362 		Z_TYPE_P(str) = IS_STRING;
22363 
22364 		INIT_PZVAL(str);
22365 	}
22366 
22367 	add_string_to_string(str, str, opline->op2.zv);
22368 
22369 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
22370 	/*CHECK_EXCEPTION();*/
22371 	ZEND_VM_NEXT_OPCODE();
22372 }
22373 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22374 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22375 {
22376 	USE_OPLINE
22377 	zval *function_name;
22378 	char *function_name_strval;
22379 	int function_name_strlen;
22380 
22381 
22382 	SAVE_OPLINE();
22383 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
22384 
22385 	function_name = opline->op2.zv;
22386 
22387 	if (IS_CONST != IS_CONST &&
22388 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
22389 		zend_error_noreturn(E_ERROR, "Method name must be a string");
22390 	}
22391 
22392 	function_name_strval = Z_STRVAL_P(function_name);
22393 	function_name_strlen = Z_STRLEN_P(function_name);
22394 
22395 	EX(object) = _get_obj_zval_ptr_unused(TSRMLS_C);
22396 
22397 	if (EXPECTED(EX(object) != NULL) &&
22398 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
22399 		EX(called_scope) = Z_OBJCE_P(EX(object));
22400 
22401 		if (IS_CONST != IS_CONST ||
22402 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
22403 		    zval *object = EX(object);
22404 
22405 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
22406 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
22407 			}
22408 
22409 			/* First, locate the function. */
22410 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
22411 			if (UNEXPECTED(EX(fbc) == NULL)) {
22412 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
22413 			}
22414 			if (IS_CONST == IS_CONST &&
22415 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
22416 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
22417 			    EXPECTED(EX(object) == object)) {
22418 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
22419 			}
22420 		}
22421 	} else {
22422 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
22423 	}
22424 
22425 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
22426 		EX(object) = NULL;
22427 	} else {
22428 		if (!PZVAL_IS_REF(EX(object))) {
22429 			Z_ADDREF_P(EX(object)); /* For $this pointer */
22430 		} else {
22431 			zval *this_ptr;
22432 			ALLOC_ZVAL(this_ptr);
22433 			INIT_PZVAL_COPY(this_ptr, EX(object));
22434 			zval_copy_ctor(this_ptr);
22435 			EX(object) = this_ptr;
22436 		}
22437 	}
22438 
22439 
22440 	CHECK_EXCEPTION();
22441 	ZEND_VM_NEXT_OPCODE();
22442 }
22443 
ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22444 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22445 {
22446 	USE_OPLINE
22447 
22448 	SAVE_OPLINE();
22449 	if (IS_UNUSED == IS_UNUSED) {
22450 		zend_constant *c;
22451 		zval *retval;
22452 
22453 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
22454 			c = CACHED_PTR(opline->op2.literal->cache_slot);
22455 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
22456 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
22457 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
22458 				if(!actual) {
22459 					actual = Z_STRVAL_P(opline->op2.zv);
22460 				} else {
22461 					actual++;
22462 				}
22463 				/* non-qualified constant - allow text substitution */
22464 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
22465 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
22466 				CHECK_EXCEPTION();
22467 				ZEND_VM_NEXT_OPCODE();
22468 			} else {
22469 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
22470 			}
22471 		} else {
22472 			CACHE_PTR(opline->op2.literal->cache_slot, c);
22473 		}
22474 		retval = &EX_T(opline->result.var).tmp_var;
22475 		ZVAL_COPY_VALUE(retval, &c->value);
22476 		zval_copy_ctor(retval);
22477 		CHECK_EXCEPTION();
22478 		ZEND_VM_NEXT_OPCODE();
22479 	} else {
22480 		/* class constant */
22481 		zend_class_entry *ce;
22482 		zval **value;
22483 
22484 		if (IS_UNUSED == IS_CONST) {
22485 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
22486 				value = CACHED_PTR(opline->op2.literal->cache_slot);
22487 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
22488 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
22489 				CHECK_EXCEPTION();
22490 				ZEND_VM_NEXT_OPCODE();
22491 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
22492 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
22493 			} else {
22494 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
22495 				if (UNEXPECTED(EG(exception) != NULL)) {
22496 					HANDLE_EXCEPTION();
22497 				}
22498 				if (UNEXPECTED(ce == NULL)) {
22499 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
22500 				}
22501 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
22502 			}
22503 		} else {
22504 			ce = EX_T(opline->op1.var).class_entry;
22505 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
22506 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
22507 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
22508 				CHECK_EXCEPTION();
22509 				ZEND_VM_NEXT_OPCODE();
22510 			}
22511 		}
22512 
22513 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
22514 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
22515 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
22516 				zend_class_entry *old_scope = EG(scope);
22517 
22518 				EG(scope) = ce;
22519 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
22520 				EG(scope) = old_scope;
22521 			}
22522 			if (IS_UNUSED == IS_CONST) {
22523 				CACHE_PTR(opline->op2.literal->cache_slot, value);
22524 			} else {
22525 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
22526 			}
22527 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
22528 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
22529 		} else {
22530 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
22531 		}
22532 
22533 		CHECK_EXCEPTION();
22534 		ZEND_VM_NEXT_OPCODE();
22535 	}
22536 }
22537 
ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22538 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22539 {
22540 	USE_OPLINE
22541 
22542 	array_init(&EX_T(opline->result.var).tmp_var);
22543 	if (IS_UNUSED == IS_UNUSED) {
22544 		ZEND_VM_NEXT_OPCODE();
22545 #if 0 || IS_UNUSED != IS_UNUSED
22546 	} else {
22547 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22548 #endif
22549 	}
22550 }
22551 
ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22552 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22553 {
22554 	USE_OPLINE
22555 
22556 	zval **container;
22557 	zval *offset;
22558 	ulong hval;
22559 
22560 	SAVE_OPLINE();
22561 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22562 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
22563 		SEPARATE_ZVAL_IF_NOT_REF(container);
22564 	}
22565 	offset = opline->op2.zv;
22566 
22567 	if (IS_UNUSED != IS_VAR || container) {
22568 		switch (Z_TYPE_PP(container)) {
22569 			case IS_ARRAY: {
22570 				HashTable *ht = Z_ARRVAL_PP(container);
22571 
22572 				switch (Z_TYPE_P(offset)) {
22573 					case IS_DOUBLE:
22574 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
22575 						zend_hash_index_del(ht, hval);
22576 						break;
22577 					case IS_RESOURCE:
22578 					case IS_BOOL:
22579 					case IS_LONG:
22580 						hval = Z_LVAL_P(offset);
22581 						zend_hash_index_del(ht, hval);
22582 						break;
22583 					case IS_STRING:
22584 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
22585 							Z_ADDREF_P(offset);
22586 						}
22587 						if (IS_CONST == IS_CONST) {
22588 							hval = Z_HASH_P(offset);
22589 						} else {
22590 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
22591 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
22592 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
22593 							} else {
22594 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
22595 							}
22596 						}
22597 						if (ht == &EG(symbol_table)) {
22598 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
22599 						} else {
22600 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
22601 						}
22602 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
22603 							zval_ptr_dtor(&offset);
22604 						}
22605 						break;
22606 num_index_dim:
22607 						zend_hash_index_del(ht, hval);
22608 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
22609 							zval_ptr_dtor(&offset);
22610 						}
22611 						break;
22612 					case IS_NULL:
22613 						zend_hash_del(ht, "", sizeof(""));
22614 						break;
22615 					default:
22616 						zend_error(E_WARNING, "Illegal offset type in unset");
22617 						break;
22618 				}
22619 
22620 				break;
22621 			}
22622 			case IS_OBJECT:
22623 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
22624 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
22625 				}
22626 				if (0) {
22627 					MAKE_REAL_ZVAL_PTR(offset);
22628 				}
22629 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
22630 				if (0) {
22631 					zval_ptr_dtor(&offset);
22632 				} else {
22633 
22634 				}
22635 				break;
22636 			case IS_STRING:
22637 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
22638 				ZEND_VM_CONTINUE(); /* bailed out before */
22639 			default:
22640 
22641 				break;
22642 		}
22643 	} else {
22644 
22645 	}
22646 
22647 	CHECK_EXCEPTION();
22648 	ZEND_VM_NEXT_OPCODE();
22649 }
22650 
ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22651 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22652 {
22653 	USE_OPLINE
22654 
22655 	zval **container;
22656 	zval *offset;
22657 
22658 	SAVE_OPLINE();
22659 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22660 	offset = opline->op2.zv;
22661 
22662 	if (IS_UNUSED != IS_VAR || container) {
22663 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
22664 			SEPARATE_ZVAL_IF_NOT_REF(container);
22665 		}
22666 		if (Z_TYPE_PP(container) == IS_OBJECT) {
22667 			if (0) {
22668 				MAKE_REAL_ZVAL_PTR(offset);
22669 			}
22670 			if (Z_OBJ_HT_P(*container)->unset_property) {
22671 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22672 			} else {
22673 				zend_error(E_NOTICE, "Trying to unset property of non-object");
22674 			}
22675 			if (0) {
22676 				zval_ptr_dtor(&offset);
22677 			} else {
22678 
22679 			}
22680 		} else {
22681 
22682 		}
22683 	} else {
22684 
22685 	}
22686 
22687 	CHECK_EXCEPTION();
22688 	ZEND_VM_NEXT_OPCODE();
22689 }
22690 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)22691 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
22692 {
22693 	USE_OPLINE
22694 
22695 	zval **container;
22696 	zval **value = NULL;
22697 	int result = 0;
22698 	ulong hval;
22699 	zval *offset;
22700 
22701 	SAVE_OPLINE();
22702 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22703 
22704 	offset = opline->op2.zv;
22705 
22706 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
22707 		HashTable *ht;
22708 		int isset = 0;
22709 
22710 		ht = Z_ARRVAL_PP(container);
22711 
22712 		switch (Z_TYPE_P(offset)) {
22713 			case IS_DOUBLE:
22714 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
22715 				goto num_index_prop;
22716 			case IS_RESOURCE:
22717 			case IS_BOOL:
22718 			case IS_LONG:
22719 				hval = Z_LVAL_P(offset);
22720 num_index_prop:
22721 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
22722 					isset = 1;
22723 				}
22724 				break;
22725 			case IS_STRING:
22726 				if (IS_CONST == IS_CONST) {
22727 					hval = Z_HASH_P(offset);
22728 				} else {
22729 					if (!prop_dim) {
22730 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
22731 					}
22732 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
22733 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
22734 					} else {
22735 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
22736 					}
22737 				}
22738 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
22739 					isset = 1;
22740 				}
22741 				break;
22742 			case IS_NULL:
22743 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
22744 					isset = 1;
22745 				}
22746 				break;
22747 			default:
22748 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
22749 				break;
22750 		}
22751 
22752 		if (opline->extended_value & ZEND_ISSET) {
22753 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
22754 				result = 0;
22755 			} else {
22756 				result = isset;
22757 			}
22758 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
22759 			if (!isset || !i_zend_is_true(*value)) {
22760 				result = 0;
22761 			} else {
22762 				result = 1;
22763 			}
22764 		}
22765 
22766 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
22767 		if (0) {
22768 			MAKE_REAL_ZVAL_PTR(offset);
22769 		}
22770 		if (prop_dim) {
22771 			if (Z_OBJ_HT_P(*container)->has_property) {
22772 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22773 			} else {
22774 				zend_error(E_NOTICE, "Trying to check property of non-object");
22775 				result = 0;
22776 			}
22777 		} else {
22778 			if (Z_OBJ_HT_P(*container)->has_dimension) {
22779 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
22780 			} else {
22781 				zend_error(E_NOTICE, "Trying to check element of non-array");
22782 				result = 0;
22783 			}
22784 		}
22785 		if (0) {
22786 			zval_ptr_dtor(&offset);
22787 		} else {
22788 
22789 		}
22790 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
22791 		zval tmp;
22792 
22793 		if (Z_TYPE_P(offset) != IS_LONG) {
22794 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
22795 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
22796 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
22797 				ZVAL_COPY_VALUE(&tmp, offset);
22798 				zval_copy_ctor(&tmp);
22799 				convert_to_long(&tmp);
22800 				offset = &tmp;
22801 			} else {
22802 				/* can not be converted to proper offset, return "not set" */
22803 				result = 0;
22804 			}
22805 		}
22806 		if (Z_TYPE_P(offset) == IS_LONG) {
22807 			if (opline->extended_value & ZEND_ISSET) {
22808 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
22809 					result = 1;
22810 				}
22811 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
22812 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
22813 					result = 1;
22814 				}
22815 			}
22816 		}
22817 
22818 	} else {
22819 
22820 	}
22821 
22822 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
22823 	if (opline->extended_value & ZEND_ISSET) {
22824 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
22825 	} else {
22826 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
22827 	}
22828 
22829 	CHECK_EXCEPTION();
22830 	ZEND_VM_NEXT_OPCODE();
22831 }
22832 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22833 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22834 {
22835 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22836 }
22837 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22838 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22839 {
22840 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22841 }
22842 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)22843 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
22844 {
22845 	USE_OPLINE
22846 	zend_free_op free_op2, free_op_data1;
22847 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22848 	zval *object;
22849 	zval *property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
22850 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
22851 	int have_get_ptr = 0;
22852 
22853 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
22854 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22855 	}
22856 
22857 	make_real_object(object_ptr TSRMLS_CC);
22858 	object = *object_ptr;
22859 
22860 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
22861 		zend_error(E_WARNING, "Attempt to assign property of non-object");
22862 		zval_dtor(free_op2.var);
22863 		FREE_OP(free_op_data1);
22864 
22865 		if (RETURN_VALUE_USED(opline)) {
22866 			PZVAL_LOCK(&EG(uninitialized_zval));
22867 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
22868 			EX_T(opline->result.var).var.ptr_ptr = NULL;
22869 		}
22870 	} else {
22871 		/* here we are sure we are dealing with an object */
22872 		if (1) {
22873 			MAKE_REAL_ZVAL_PTR(property);
22874 		}
22875 
22876 		/* here property is a string */
22877 		if (opline->extended_value == ZEND_ASSIGN_OBJ
22878 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
22879 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22880 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
22881 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
22882 
22883 				have_get_ptr = 1;
22884 				binary_op(*zptr, *zptr, value TSRMLS_CC);
22885 				if (RETURN_VALUE_USED(opline)) {
22886 					PZVAL_LOCK(*zptr);
22887 					EX_T(opline->result.var).var.ptr = *zptr;
22888 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22889 				}
22890 			}
22891 		}
22892 
22893 		if (!have_get_ptr) {
22894 			zval *z = NULL;
22895 
22896 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
22897 				if (Z_OBJ_HT_P(object)->read_property) {
22898 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22899 				}
22900 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
22901 				if (Z_OBJ_HT_P(object)->read_dimension) {
22902 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
22903 				}
22904 			}
22905 			if (z) {
22906 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
22907 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
22908 
22909 					if (Z_REFCOUNT_P(z) == 0) {
22910 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
22911 						zval_dtor(z);
22912 						FREE_ZVAL(z);
22913 					}
22914 					z = value;
22915 				}
22916 				Z_ADDREF_P(z);
22917 				SEPARATE_ZVAL_IF_NOT_REF(&z);
22918 				binary_op(z, z, value TSRMLS_CC);
22919 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
22920 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22921 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
22922 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
22923 				}
22924 				if (RETURN_VALUE_USED(opline)) {
22925 					PZVAL_LOCK(z);
22926 					EX_T(opline->result.var).var.ptr = z;
22927 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22928 				}
22929 				zval_ptr_dtor(&z);
22930 			} else {
22931 				zend_error(E_WARNING, "Attempt to assign property of non-object");
22932 				if (RETURN_VALUE_USED(opline)) {
22933 					PZVAL_LOCK(&EG(uninitialized_zval));
22934 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
22935 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22936 				}
22937 			}
22938 		}
22939 
22940 		if (1) {
22941 			zval_ptr_dtor(&property);
22942 		} else {
22943 			zval_dtor(free_op2.var);
22944 		}
22945 		FREE_OP(free_op_data1);
22946 	}
22947 
22948 	/* assign_obj has two opcodes! */
22949 	CHECK_EXCEPTION();
22950 	ZEND_VM_INC_OPCODE();
22951 	ZEND_VM_NEXT_OPCODE();
22952 }
22953 
zend_binary_assign_op_helper_SPEC_UNUSED_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)22954 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
22955 {
22956 	USE_OPLINE
22957 	zend_free_op free_op2, free_op_data2, free_op_data1;
22958 	zval **var_ptr;
22959 	zval *value;
22960 
22961 	SAVE_OPLINE();
22962 	switch (opline->extended_value) {
22963 		case ZEND_ASSIGN_OBJ:
22964 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22965 			break;
22966 		case ZEND_ASSIGN_DIM: {
22967 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
22968 
22969 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
22970 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22971 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
22972 					if (IS_UNUSED == IS_VAR && !0) {
22973 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
22974 					}
22975 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22976 				} else {
22977 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
22978 
22979 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
22980 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
22981 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
22982 				}
22983 			}
22984 			break;
22985 		default:
22986 			value = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
22987 			var_ptr = NULL;
22988 			/* do nothing */
22989 			break;
22990 	}
22991 
22992 	if (UNEXPECTED(var_ptr == NULL)) {
22993 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
22994 	}
22995 
22996 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
22997 		if (RETURN_VALUE_USED(opline)) {
22998 			PZVAL_LOCK(&EG(uninitialized_zval));
22999 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23000 		}
23001 		zval_dtor(free_op2.var);
23002 
23003 		CHECK_EXCEPTION();
23004 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
23005 			ZEND_VM_INC_OPCODE();
23006 		}
23007 		ZEND_VM_NEXT_OPCODE();
23008 	}
23009 
23010 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
23011 
23012 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
23013 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
23014 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
23015 		/* proxy object */
23016 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
23017 		Z_ADDREF_P(objval);
23018 		binary_op(objval, objval, value TSRMLS_CC);
23019 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
23020 		zval_ptr_dtor(&objval);
23021 	} else {
23022 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
23023 	}
23024 
23025 	if (RETURN_VALUE_USED(opline)) {
23026 		PZVAL_LOCK(*var_ptr);
23027 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
23028 	}
23029 	zval_dtor(free_op2.var);
23030 
23031 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
23032 		FREE_OP(free_op_data1);
23033 		FREE_OP_VAR_PTR(free_op_data2);
23034 
23035 		CHECK_EXCEPTION();
23036 		ZEND_VM_INC_OPCODE();
23037 	} else {
23038 
23039 		CHECK_EXCEPTION();
23040 	}
23041 	ZEND_VM_NEXT_OPCODE();
23042 }
23043 
ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23044 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23045 {
23046 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23047 }
23048 
ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23049 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23050 {
23051 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23052 }
23053 
ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23054 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23055 {
23056 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23057 }
23058 
ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23059 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23060 {
23061 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23062 }
23063 
ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23064 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23065 {
23066 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23067 }
23068 
ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23069 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23070 {
23071 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23072 }
23073 
ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23074 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23075 {
23076 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23077 }
23078 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23079 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23080 {
23081 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23082 }
23083 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23084 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23085 {
23086 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23087 }
23088 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23089 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23090 {
23091 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23092 }
23093 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23094 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23095 {
23096 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23097 }
23098 
zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)23099 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
23100 {
23101 	USE_OPLINE
23102 	zend_free_op free_op2;
23103 	zval **object_ptr;
23104 	zval *object;
23105 	zval *property;
23106 	zval **retval;
23107 	int have_get_ptr = 0;
23108 
23109 	SAVE_OPLINE();
23110 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23111 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23112 	retval = &EX_T(opline->result.var).var.ptr;
23113 
23114 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
23115 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
23116 	}
23117 
23118 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
23119 	object = *object_ptr;
23120 
23121 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
23122 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
23123 		zval_dtor(free_op2.var);
23124 		if (RETURN_VALUE_USED(opline)) {
23125 			PZVAL_LOCK(&EG(uninitialized_zval));
23126 			*retval = &EG(uninitialized_zval);
23127 		}
23128 
23129 		CHECK_EXCEPTION();
23130 		ZEND_VM_NEXT_OPCODE();
23131 	}
23132 
23133 	/* here we are sure we are dealing with an object */
23134 
23135 	if (1) {
23136 		MAKE_REAL_ZVAL_PTR(property);
23137 	}
23138 
23139 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
23140 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23141 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
23142 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
23143 
23144 			have_get_ptr = 1;
23145 			incdec_op(*zptr);
23146 			if (RETURN_VALUE_USED(opline)) {
23147 				*retval = *zptr;
23148 				PZVAL_LOCK(*retval);
23149 			}
23150 		}
23151 	}
23152 
23153 	if (!have_get_ptr) {
23154 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
23155 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23156 
23157 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
23158 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
23159 
23160 				if (Z_REFCOUNT_P(z) == 0) {
23161 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
23162 					zval_dtor(z);
23163 					FREE_ZVAL(z);
23164 				}
23165 				z = value;
23166 			}
23167 			Z_ADDREF_P(z);
23168 			SEPARATE_ZVAL_IF_NOT_REF(&z);
23169 			incdec_op(z);
23170 			*retval = z;
23171 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23172 			SELECTIVE_PZVAL_LOCK(*retval, opline);
23173 			zval_ptr_dtor(&z);
23174 		} else {
23175 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
23176 			if (RETURN_VALUE_USED(opline)) {
23177 				PZVAL_LOCK(&EG(uninitialized_zval));
23178 				*retval = &EG(uninitialized_zval);
23179 			}
23180 		}
23181 	}
23182 
23183 	if (1) {
23184 		zval_ptr_dtor(&property);
23185 	} else {
23186 		zval_dtor(free_op2.var);
23187 	}
23188 
23189 	CHECK_EXCEPTION();
23190 	ZEND_VM_NEXT_OPCODE();
23191 }
23192 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23193 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23194 {
23195 	return zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23196 }
23197 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23198 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23199 {
23200 	return zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23201 }
23202 
zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)23203 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
23204 {
23205 	USE_OPLINE
23206 	zend_free_op free_op2;
23207 	zval **object_ptr;
23208 	zval *object;
23209 	zval *property;
23210 	zval *retval;
23211 	int have_get_ptr = 0;
23212 
23213 	SAVE_OPLINE();
23214 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23215 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23216 	retval = &EX_T(opline->result.var).tmp_var;
23217 
23218 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
23219 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
23220 	}
23221 
23222 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
23223 	object = *object_ptr;
23224 
23225 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
23226 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
23227 		zval_dtor(free_op2.var);
23228 		ZVAL_NULL(retval);
23229 
23230 		CHECK_EXCEPTION();
23231 		ZEND_VM_NEXT_OPCODE();
23232 	}
23233 
23234 	/* here we are sure we are dealing with an object */
23235 
23236 	if (1) {
23237 		MAKE_REAL_ZVAL_PTR(property);
23238 	}
23239 
23240 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
23241 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23242 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
23243 			have_get_ptr = 1;
23244 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
23245 
23246 			ZVAL_COPY_VALUE(retval, *zptr);
23247 			zendi_zval_copy_ctor(*retval);
23248 
23249 			incdec_op(*zptr);
23250 
23251 		}
23252 	}
23253 
23254 	if (!have_get_ptr) {
23255 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
23256 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23257 			zval *z_copy;
23258 
23259 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
23260 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
23261 
23262 				if (Z_REFCOUNT_P(z) == 0) {
23263 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
23264 					zval_dtor(z);
23265 					FREE_ZVAL(z);
23266 				}
23267 				z = value;
23268 			}
23269 			ZVAL_COPY_VALUE(retval, z);
23270 			zendi_zval_copy_ctor(*retval);
23271 			ALLOC_ZVAL(z_copy);
23272 			INIT_PZVAL_COPY(z_copy, z);
23273 			zendi_zval_copy_ctor(*z_copy);
23274 			incdec_op(z_copy);
23275 			Z_ADDREF_P(z);
23276 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23277 			zval_ptr_dtor(&z_copy);
23278 			zval_ptr_dtor(&z);
23279 		} else {
23280 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
23281 			ZVAL_NULL(retval);
23282 		}
23283 	}
23284 
23285 	if (1) {
23286 		zval_ptr_dtor(&property);
23287 	} else {
23288 		zval_dtor(free_op2.var);
23289 	}
23290 
23291 	CHECK_EXCEPTION();
23292 	ZEND_VM_NEXT_OPCODE();
23293 }
23294 
ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23295 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23296 {
23297 	return zend_post_incdec_property_helper_SPEC_UNUSED_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23298 }
23299 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23300 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23301 {
23302 	return zend_post_incdec_property_helper_SPEC_UNUSED_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23303 }
23304 
zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS)23305 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS)
23306 {
23307 	USE_OPLINE
23308 
23309 	zval *container;
23310 	zend_free_op free_op2;
23311 	zval *offset;
23312 
23313 	SAVE_OPLINE();
23314 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
23315 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23316 
23317 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
23318 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
23319 		zend_error(E_NOTICE, "Trying to get property of non-object");
23320 		PZVAL_LOCK(&EG(uninitialized_zval));
23321 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23322 		zval_dtor(free_op2.var);
23323 	} else {
23324 		zval *retval;
23325 
23326 		if (1) {
23327 			MAKE_REAL_ZVAL_PTR(offset);
23328 		}
23329 
23330 		/* here we are sure we are dealing with an object */
23331 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23332 
23333 		PZVAL_LOCK(retval);
23334 		AI_SET_PTR(&EX_T(opline->result.var), retval);
23335 
23336 		if (1) {
23337 			zval_ptr_dtor(&offset);
23338 		} else {
23339 			zval_dtor(free_op2.var);
23340 		}
23341 	}
23342 
23343 	CHECK_EXCEPTION();
23344 	ZEND_VM_NEXT_OPCODE();
23345 }
23346 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23347 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23348 {
23349 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23350 }
23351 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23352 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23353 {
23354 	USE_OPLINE
23355 	zend_free_op free_op1, free_op2;
23356 	zval *property;
23357 	zval **container;
23358 
23359 	SAVE_OPLINE();
23360 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23361 
23362 	if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
23363 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
23364 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
23365 	}
23366 
23367 	if (1) {
23368 		MAKE_REAL_ZVAL_PTR(property);
23369 	}
23370 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23371 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
23372 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23373 	}
23374 
23375 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
23376 	if (1) {
23377 		zval_ptr_dtor(&property);
23378 	} else {
23379 		zval_dtor(free_op2.var);
23380 	}
23381 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
23382 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23383 	}
23384 
23385 	/* We are going to assign the result by reference */
23386 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
23387 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
23388 
23389 		Z_DELREF_PP(retval_ptr);
23390 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
23391 		Z_ADDREF_PP(retval_ptr);
23392 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
23393 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
23394 	}
23395 
23396 	CHECK_EXCEPTION();
23397 	ZEND_VM_NEXT_OPCODE();
23398 }
23399 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23400 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23401 {
23402 	USE_OPLINE
23403 	zend_free_op free_op1, free_op2;
23404 	zval *property;
23405 	zval **container;
23406 
23407 	SAVE_OPLINE();
23408 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23409 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23410 
23411 	if (1) {
23412 		MAKE_REAL_ZVAL_PTR(property);
23413 	}
23414 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
23415 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23416 	}
23417 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
23418 	if (1) {
23419 		zval_ptr_dtor(&property);
23420 	} else {
23421 		zval_dtor(free_op2.var);
23422 	}
23423 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
23424 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23425 	}
23426 
23427 	CHECK_EXCEPTION();
23428 	ZEND_VM_NEXT_OPCODE();
23429 }
23430 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23431 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23432 {
23433 	USE_OPLINE
23434 
23435 	zval *container;
23436 	zend_free_op free_op2;
23437 	zval *offset;
23438 
23439 	SAVE_OPLINE();
23440 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
23441 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23442 
23443 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
23444 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
23445 		PZVAL_LOCK(&EG(uninitialized_zval));
23446 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23447 		zval_dtor(free_op2.var);
23448 	} else {
23449 		zval *retval;
23450 
23451 		if (1) {
23452 			MAKE_REAL_ZVAL_PTR(offset);
23453 		}
23454 
23455 		/* here we are sure we are dealing with an object */
23456 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23457 
23458 		PZVAL_LOCK(retval);
23459 		AI_SET_PTR(&EX_T(opline->result.var), retval);
23460 
23461 		if (1) {
23462 			zval_ptr_dtor(&offset);
23463 		} else {
23464 			zval_dtor(free_op2.var);
23465 		}
23466 	}
23467 
23468 	CHECK_EXCEPTION();
23469 	ZEND_VM_NEXT_OPCODE();
23470 }
23471 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23472 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23473 {
23474 	USE_OPLINE
23475 
23476 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
23477 		/* Behave like FETCH_OBJ_W */
23478 		zend_free_op free_op1, free_op2;
23479 		zval *property;
23480 		zval **container;
23481 
23482 		SAVE_OPLINE();
23483 		property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23484 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23485 
23486 		if (1) {
23487 			MAKE_REAL_ZVAL_PTR(property);
23488 		}
23489 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
23490 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23491 		}
23492 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
23493 		if (1) {
23494 			zval_ptr_dtor(&property);
23495 		} else {
23496 			zval_dtor(free_op2.var);
23497 		}
23498 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
23499 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23500 		}
23501 
23502 		CHECK_EXCEPTION();
23503 		ZEND_VM_NEXT_OPCODE();
23504 	} else {
23505 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23506 	}
23507 }
23508 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23509 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23510 {
23511 	USE_OPLINE
23512 	zend_free_op free_op1, free_op2, free_res;
23513 	zval **container;
23514 	zval *property;
23515 
23516 	SAVE_OPLINE();
23517 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23518 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23519 
23520 	if (IS_UNUSED == IS_CV) {
23521 		if (container != &EG(uninitialized_zval_ptr)) {
23522 			SEPARATE_ZVAL_IF_NOT_REF(container);
23523 		}
23524 	}
23525 	if (1) {
23526 		MAKE_REAL_ZVAL_PTR(property);
23527 	}
23528 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
23529 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23530 	}
23531 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
23532 	if (1) {
23533 		zval_ptr_dtor(&property);
23534 	} else {
23535 		zval_dtor(free_op2.var);
23536 	}
23537 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
23538 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23539 	}
23540 
23541 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
23542 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
23543 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
23544 	}
23545 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
23546 	FREE_OP_VAR_PTR(free_res);
23547 	CHECK_EXCEPTION();
23548 	ZEND_VM_NEXT_OPCODE();
23549 }
23550 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23551 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23552 {
23553 	USE_OPLINE
23554 	zend_free_op free_op2;
23555 	zval **object_ptr;
23556 	zval *property_name;
23557 
23558 	SAVE_OPLINE();
23559 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23560 	property_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23561 
23562 	if (1) {
23563 		MAKE_REAL_ZVAL_PTR(property_name);
23564 	}
23565 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
23566 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
23567 	}
23568 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23569 	if (1) {
23570 		zval_ptr_dtor(&property_name);
23571 	} else {
23572 		zval_dtor(free_op2.var);
23573 	}
23574 
23575 	/* assign_obj has two opcodes! */
23576 	CHECK_EXCEPTION();
23577 	ZEND_VM_INC_OPCODE();
23578 	ZEND_VM_NEXT_OPCODE();
23579 }
23580 
ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23581 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23582 {
23583 	USE_OPLINE
23584 	zend_free_op free_op2;
23585 	zval *str = &EX_T(opline->result.var).tmp_var;
23586 	zval *var;
23587 	zval var_copy;
23588 	int use_copy = 0;
23589 
23590 	SAVE_OPLINE();
23591 	var = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23592 
23593 	if (IS_UNUSED == IS_UNUSED) {
23594 		/* Initialize for erealloc in add_string_to_string */
23595 		Z_STRVAL_P(str) = NULL;
23596 		Z_STRLEN_P(str) = 0;
23597 		Z_TYPE_P(str) = IS_STRING;
23598 
23599 		INIT_PZVAL(str);
23600 	}
23601 
23602 	if (Z_TYPE_P(var) != IS_STRING) {
23603 		zend_make_printable_zval(var, &var_copy, &use_copy);
23604 
23605 		if (use_copy) {
23606 			var = &var_copy;
23607 		}
23608 	}
23609 	add_string_to_string(str, str, var);
23610 
23611 	if (use_copy) {
23612 		zval_dtor(var);
23613 	}
23614 	/* original comment, possibly problematic:
23615 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
23616 	 * (Zeev):  I don't think it's problematic, we only use variables
23617 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
23618 	 * string offsets or overloaded objects
23619 	 */
23620 	zval_dtor(free_op2.var);
23621 
23622 	CHECK_EXCEPTION();
23623 	ZEND_VM_NEXT_OPCODE();
23624 }
23625 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23626 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23627 {
23628 	USE_OPLINE
23629 	zval *function_name;
23630 	char *function_name_strval;
23631 	int function_name_strlen;
23632 	zend_free_op free_op2;
23633 
23634 	SAVE_OPLINE();
23635 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
23636 
23637 	function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23638 
23639 	if (IS_TMP_VAR != IS_CONST &&
23640 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
23641 		zend_error_noreturn(E_ERROR, "Method name must be a string");
23642 	}
23643 
23644 	function_name_strval = Z_STRVAL_P(function_name);
23645 	function_name_strlen = Z_STRLEN_P(function_name);
23646 
23647 	EX(object) = _get_obj_zval_ptr_unused(TSRMLS_C);
23648 
23649 	if (EXPECTED(EX(object) != NULL) &&
23650 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
23651 		EX(called_scope) = Z_OBJCE_P(EX(object));
23652 
23653 		if (IS_TMP_VAR != IS_CONST ||
23654 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
23655 		    zval *object = EX(object);
23656 
23657 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
23658 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
23659 			}
23660 
23661 			/* First, locate the function. */
23662 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
23663 			if (UNEXPECTED(EX(fbc) == NULL)) {
23664 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
23665 			}
23666 			if (IS_TMP_VAR == IS_CONST &&
23667 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
23668 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
23669 			    EXPECTED(EX(object) == object)) {
23670 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
23671 			}
23672 		}
23673 	} else {
23674 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
23675 	}
23676 
23677 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
23678 		EX(object) = NULL;
23679 	} else {
23680 		if (!PZVAL_IS_REF(EX(object))) {
23681 			Z_ADDREF_P(EX(object)); /* For $this pointer */
23682 		} else {
23683 			zval *this_ptr;
23684 			ALLOC_ZVAL(this_ptr);
23685 			INIT_PZVAL_COPY(this_ptr, EX(object));
23686 			zval_copy_ctor(this_ptr);
23687 			EX(object) = this_ptr;
23688 		}
23689 	}
23690 
23691 	zval_dtor(free_op2.var);
23692 
23693 	CHECK_EXCEPTION();
23694 	ZEND_VM_NEXT_OPCODE();
23695 }
23696 
ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23697 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23698 {
23699 	USE_OPLINE
23700 
23701 	array_init(&EX_T(opline->result.var).tmp_var);
23702 	if (IS_UNUSED == IS_UNUSED) {
23703 		ZEND_VM_NEXT_OPCODE();
23704 #if 0 || IS_UNUSED != IS_UNUSED
23705 	} else {
23706 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23707 #endif
23708 	}
23709 }
23710 
ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23711 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23712 {
23713 	USE_OPLINE
23714 	zend_free_op free_op2;
23715 	zval **container;
23716 	zval *offset;
23717 	ulong hval;
23718 
23719 	SAVE_OPLINE();
23720 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23721 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
23722 		SEPARATE_ZVAL_IF_NOT_REF(container);
23723 	}
23724 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23725 
23726 	if (IS_UNUSED != IS_VAR || container) {
23727 		switch (Z_TYPE_PP(container)) {
23728 			case IS_ARRAY: {
23729 				HashTable *ht = Z_ARRVAL_PP(container);
23730 
23731 				switch (Z_TYPE_P(offset)) {
23732 					case IS_DOUBLE:
23733 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
23734 						zend_hash_index_del(ht, hval);
23735 						break;
23736 					case IS_RESOURCE:
23737 					case IS_BOOL:
23738 					case IS_LONG:
23739 						hval = Z_LVAL_P(offset);
23740 						zend_hash_index_del(ht, hval);
23741 						break;
23742 					case IS_STRING:
23743 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
23744 							Z_ADDREF_P(offset);
23745 						}
23746 						if (IS_TMP_VAR == IS_CONST) {
23747 							hval = Z_HASH_P(offset);
23748 						} else {
23749 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
23750 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
23751 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
23752 							} else {
23753 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
23754 							}
23755 						}
23756 						if (ht == &EG(symbol_table)) {
23757 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
23758 						} else {
23759 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
23760 						}
23761 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
23762 							zval_ptr_dtor(&offset);
23763 						}
23764 						break;
23765 num_index_dim:
23766 						zend_hash_index_del(ht, hval);
23767 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
23768 							zval_ptr_dtor(&offset);
23769 						}
23770 						break;
23771 					case IS_NULL:
23772 						zend_hash_del(ht, "", sizeof(""));
23773 						break;
23774 					default:
23775 						zend_error(E_WARNING, "Illegal offset type in unset");
23776 						break;
23777 				}
23778 				zval_dtor(free_op2.var);
23779 				break;
23780 			}
23781 			case IS_OBJECT:
23782 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
23783 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
23784 				}
23785 				if (1) {
23786 					MAKE_REAL_ZVAL_PTR(offset);
23787 				}
23788 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
23789 				if (1) {
23790 					zval_ptr_dtor(&offset);
23791 				} else {
23792 					zval_dtor(free_op2.var);
23793 				}
23794 				break;
23795 			case IS_STRING:
23796 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
23797 				ZEND_VM_CONTINUE(); /* bailed out before */
23798 			default:
23799 				zval_dtor(free_op2.var);
23800 				break;
23801 		}
23802 	} else {
23803 		zval_dtor(free_op2.var);
23804 	}
23805 
23806 	CHECK_EXCEPTION();
23807 	ZEND_VM_NEXT_OPCODE();
23808 }
23809 
ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23810 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23811 {
23812 	USE_OPLINE
23813 	zend_free_op free_op2;
23814 	zval **container;
23815 	zval *offset;
23816 
23817 	SAVE_OPLINE();
23818 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23819 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23820 
23821 	if (IS_UNUSED != IS_VAR || container) {
23822 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
23823 			SEPARATE_ZVAL_IF_NOT_REF(container);
23824 		}
23825 		if (Z_TYPE_PP(container) == IS_OBJECT) {
23826 			if (1) {
23827 				MAKE_REAL_ZVAL_PTR(offset);
23828 			}
23829 			if (Z_OBJ_HT_P(*container)->unset_property) {
23830 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23831 			} else {
23832 				zend_error(E_NOTICE, "Trying to unset property of non-object");
23833 			}
23834 			if (1) {
23835 				zval_ptr_dtor(&offset);
23836 			} else {
23837 				zval_dtor(free_op2.var);
23838 			}
23839 		} else {
23840 			zval_dtor(free_op2.var);
23841 		}
23842 	} else {
23843 		zval_dtor(free_op2.var);
23844 	}
23845 
23846 	CHECK_EXCEPTION();
23847 	ZEND_VM_NEXT_OPCODE();
23848 }
23849 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)23850 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
23851 {
23852 	USE_OPLINE
23853 	zend_free_op free_op2;
23854 	zval **container;
23855 	zval **value = NULL;
23856 	int result = 0;
23857 	ulong hval;
23858 	zval *offset;
23859 
23860 	SAVE_OPLINE();
23861 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
23862 
23863 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
23864 
23865 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
23866 		HashTable *ht;
23867 		int isset = 0;
23868 
23869 		ht = Z_ARRVAL_PP(container);
23870 
23871 		switch (Z_TYPE_P(offset)) {
23872 			case IS_DOUBLE:
23873 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
23874 				goto num_index_prop;
23875 			case IS_RESOURCE:
23876 			case IS_BOOL:
23877 			case IS_LONG:
23878 				hval = Z_LVAL_P(offset);
23879 num_index_prop:
23880 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
23881 					isset = 1;
23882 				}
23883 				break;
23884 			case IS_STRING:
23885 				if (IS_TMP_VAR == IS_CONST) {
23886 					hval = Z_HASH_P(offset);
23887 				} else {
23888 					if (!prop_dim) {
23889 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
23890 					}
23891 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
23892 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
23893 					} else {
23894 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
23895 					}
23896 				}
23897 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
23898 					isset = 1;
23899 				}
23900 				break;
23901 			case IS_NULL:
23902 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
23903 					isset = 1;
23904 				}
23905 				break;
23906 			default:
23907 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
23908 				break;
23909 		}
23910 
23911 		if (opline->extended_value & ZEND_ISSET) {
23912 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
23913 				result = 0;
23914 			} else {
23915 				result = isset;
23916 			}
23917 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
23918 			if (!isset || !i_zend_is_true(*value)) {
23919 				result = 0;
23920 			} else {
23921 				result = 1;
23922 			}
23923 		}
23924 		zval_dtor(free_op2.var);
23925 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
23926 		if (1) {
23927 			MAKE_REAL_ZVAL_PTR(offset);
23928 		}
23929 		if (prop_dim) {
23930 			if (Z_OBJ_HT_P(*container)->has_property) {
23931 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23932 			} else {
23933 				zend_error(E_NOTICE, "Trying to check property of non-object");
23934 				result = 0;
23935 			}
23936 		} else {
23937 			if (Z_OBJ_HT_P(*container)->has_dimension) {
23938 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
23939 			} else {
23940 				zend_error(E_NOTICE, "Trying to check element of non-array");
23941 				result = 0;
23942 			}
23943 		}
23944 		if (1) {
23945 			zval_ptr_dtor(&offset);
23946 		} else {
23947 			zval_dtor(free_op2.var);
23948 		}
23949 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
23950 		zval tmp;
23951 
23952 		if (Z_TYPE_P(offset) != IS_LONG) {
23953 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
23954 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
23955 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
23956 				ZVAL_COPY_VALUE(&tmp, offset);
23957 				zval_copy_ctor(&tmp);
23958 				convert_to_long(&tmp);
23959 				offset = &tmp;
23960 			} else {
23961 				/* can not be converted to proper offset, return "not set" */
23962 				result = 0;
23963 			}
23964 		}
23965 		if (Z_TYPE_P(offset) == IS_LONG) {
23966 			if (opline->extended_value & ZEND_ISSET) {
23967 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
23968 					result = 1;
23969 				}
23970 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
23971 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
23972 					result = 1;
23973 				}
23974 			}
23975 		}
23976 		zval_dtor(free_op2.var);
23977 	} else {
23978 		zval_dtor(free_op2.var);
23979 	}
23980 
23981 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
23982 	if (opline->extended_value & ZEND_ISSET) {
23983 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
23984 	} else {
23985 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
23986 	}
23987 
23988 	CHECK_EXCEPTION();
23989 	ZEND_VM_NEXT_OPCODE();
23990 }
23991 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23992 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23993 {
23994 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23995 }
23996 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23997 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23998 {
23999 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24000 }
24001 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)24002 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
24003 {
24004 	USE_OPLINE
24005 	zend_free_op free_op2, free_op_data1;
24006 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24007 	zval *object;
24008 	zval *property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24009 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
24010 	int have_get_ptr = 0;
24011 
24012 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24013 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24014 	}
24015 
24016 	make_real_object(object_ptr TSRMLS_CC);
24017 	object = *object_ptr;
24018 
24019 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24020 		zend_error(E_WARNING, "Attempt to assign property of non-object");
24021 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24022 		FREE_OP(free_op_data1);
24023 
24024 		if (RETURN_VALUE_USED(opline)) {
24025 			PZVAL_LOCK(&EG(uninitialized_zval));
24026 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
24027 			EX_T(opline->result.var).var.ptr_ptr = NULL;
24028 		}
24029 	} else {
24030 		/* here we are sure we are dealing with an object */
24031 		if (0) {
24032 			MAKE_REAL_ZVAL_PTR(property);
24033 		}
24034 
24035 		/* here property is a string */
24036 		if (opline->extended_value == ZEND_ASSIGN_OBJ
24037 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24038 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24039 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24040 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
24041 
24042 				have_get_ptr = 1;
24043 				binary_op(*zptr, *zptr, value TSRMLS_CC);
24044 				if (RETURN_VALUE_USED(opline)) {
24045 					PZVAL_LOCK(*zptr);
24046 					EX_T(opline->result.var).var.ptr = *zptr;
24047 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24048 				}
24049 			}
24050 		}
24051 
24052 		if (!have_get_ptr) {
24053 			zval *z = NULL;
24054 
24055 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
24056 				if (Z_OBJ_HT_P(object)->read_property) {
24057 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24058 				}
24059 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
24060 				if (Z_OBJ_HT_P(object)->read_dimension) {
24061 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
24062 				}
24063 			}
24064 			if (z) {
24065 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
24066 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24067 
24068 					if (Z_REFCOUNT_P(z) == 0) {
24069 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
24070 						zval_dtor(z);
24071 						FREE_ZVAL(z);
24072 					}
24073 					z = value;
24074 				}
24075 				Z_ADDREF_P(z);
24076 				SEPARATE_ZVAL_IF_NOT_REF(&z);
24077 				binary_op(z, z, value TSRMLS_CC);
24078 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
24079 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24080 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
24081 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
24082 				}
24083 				if (RETURN_VALUE_USED(opline)) {
24084 					PZVAL_LOCK(z);
24085 					EX_T(opline->result.var).var.ptr = z;
24086 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24087 				}
24088 				zval_ptr_dtor(&z);
24089 			} else {
24090 				zend_error(E_WARNING, "Attempt to assign property of non-object");
24091 				if (RETURN_VALUE_USED(opline)) {
24092 					PZVAL_LOCK(&EG(uninitialized_zval));
24093 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
24094 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24095 				}
24096 			}
24097 		}
24098 
24099 		if (0) {
24100 			zval_ptr_dtor(&property);
24101 		} else {
24102 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24103 		}
24104 		FREE_OP(free_op_data1);
24105 	}
24106 
24107 	/* assign_obj has two opcodes! */
24108 	CHECK_EXCEPTION();
24109 	ZEND_VM_INC_OPCODE();
24110 	ZEND_VM_NEXT_OPCODE();
24111 }
24112 
zend_binary_assign_op_helper_SPEC_UNUSED_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)24113 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
24114 {
24115 	USE_OPLINE
24116 	zend_free_op free_op2, free_op_data2, free_op_data1;
24117 	zval **var_ptr;
24118 	zval *value;
24119 
24120 	SAVE_OPLINE();
24121 	switch (opline->extended_value) {
24122 		case ZEND_ASSIGN_OBJ:
24123 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24124 			break;
24125 		case ZEND_ASSIGN_DIM: {
24126 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24127 
24128 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24129 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
24130 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
24131 					if (IS_UNUSED == IS_VAR && !0) {
24132 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
24133 					}
24134 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24135 				} else {
24136 					zval *dim = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24137 
24138 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
24139 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
24140 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
24141 				}
24142 			}
24143 			break;
24144 		default:
24145 			value = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24146 			var_ptr = NULL;
24147 			/* do nothing */
24148 			break;
24149 	}
24150 
24151 	if (UNEXPECTED(var_ptr == NULL)) {
24152 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
24153 	}
24154 
24155 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
24156 		if (RETURN_VALUE_USED(opline)) {
24157 			PZVAL_LOCK(&EG(uninitialized_zval));
24158 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24159 		}
24160 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24161 
24162 		CHECK_EXCEPTION();
24163 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
24164 			ZEND_VM_INC_OPCODE();
24165 		}
24166 		ZEND_VM_NEXT_OPCODE();
24167 	}
24168 
24169 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
24170 
24171 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
24172 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
24173 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
24174 		/* proxy object */
24175 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
24176 		Z_ADDREF_P(objval);
24177 		binary_op(objval, objval, value TSRMLS_CC);
24178 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
24179 		zval_ptr_dtor(&objval);
24180 	} else {
24181 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
24182 	}
24183 
24184 	if (RETURN_VALUE_USED(opline)) {
24185 		PZVAL_LOCK(*var_ptr);
24186 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
24187 	}
24188 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24189 
24190 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
24191 		FREE_OP(free_op_data1);
24192 		FREE_OP_VAR_PTR(free_op_data2);
24193 
24194 		CHECK_EXCEPTION();
24195 		ZEND_VM_INC_OPCODE();
24196 	} else {
24197 
24198 		CHECK_EXCEPTION();
24199 	}
24200 	ZEND_VM_NEXT_OPCODE();
24201 }
24202 
ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24203 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24204 {
24205 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24206 }
24207 
ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24208 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24209 {
24210 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24211 }
24212 
ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24213 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24214 {
24215 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24216 }
24217 
ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24218 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24219 {
24220 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24221 }
24222 
ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24223 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24224 {
24225 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24226 }
24227 
ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24228 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24229 {
24230 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24231 }
24232 
ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24233 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24234 {
24235 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24236 }
24237 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24238 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24239 {
24240 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24241 }
24242 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24243 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24244 {
24245 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24246 }
24247 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24248 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24249 {
24250 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24251 }
24252 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24253 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24254 {
24255 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24256 }
24257 
zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)24258 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
24259 {
24260 	USE_OPLINE
24261 	zend_free_op free_op2;
24262 	zval **object_ptr;
24263 	zval *object;
24264 	zval *property;
24265 	zval **retval;
24266 	int have_get_ptr = 0;
24267 
24268 	SAVE_OPLINE();
24269 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24270 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24271 	retval = &EX_T(opline->result.var).var.ptr;
24272 
24273 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24274 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
24275 	}
24276 
24277 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
24278 	object = *object_ptr;
24279 
24280 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24281 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24282 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24283 		if (RETURN_VALUE_USED(opline)) {
24284 			PZVAL_LOCK(&EG(uninitialized_zval));
24285 			*retval = &EG(uninitialized_zval);
24286 		}
24287 
24288 		CHECK_EXCEPTION();
24289 		ZEND_VM_NEXT_OPCODE();
24290 	}
24291 
24292 	/* here we are sure we are dealing with an object */
24293 
24294 	if (0) {
24295 		MAKE_REAL_ZVAL_PTR(property);
24296 	}
24297 
24298 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24299 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24300 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24301 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
24302 
24303 			have_get_ptr = 1;
24304 			incdec_op(*zptr);
24305 			if (RETURN_VALUE_USED(opline)) {
24306 				*retval = *zptr;
24307 				PZVAL_LOCK(*retval);
24308 			}
24309 		}
24310 	}
24311 
24312 	if (!have_get_ptr) {
24313 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
24314 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24315 
24316 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
24317 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24318 
24319 				if (Z_REFCOUNT_P(z) == 0) {
24320 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
24321 					zval_dtor(z);
24322 					FREE_ZVAL(z);
24323 				}
24324 				z = value;
24325 			}
24326 			Z_ADDREF_P(z);
24327 			SEPARATE_ZVAL_IF_NOT_REF(&z);
24328 			incdec_op(z);
24329 			*retval = z;
24330 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24331 			SELECTIVE_PZVAL_LOCK(*retval, opline);
24332 			zval_ptr_dtor(&z);
24333 		} else {
24334 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24335 			if (RETURN_VALUE_USED(opline)) {
24336 				PZVAL_LOCK(&EG(uninitialized_zval));
24337 				*retval = &EG(uninitialized_zval);
24338 			}
24339 		}
24340 	}
24341 
24342 	if (0) {
24343 		zval_ptr_dtor(&property);
24344 	} else {
24345 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24346 	}
24347 
24348 	CHECK_EXCEPTION();
24349 	ZEND_VM_NEXT_OPCODE();
24350 }
24351 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24352 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24353 {
24354 	return zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24355 }
24356 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24357 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24358 {
24359 	return zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24360 }
24361 
zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)24362 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
24363 {
24364 	USE_OPLINE
24365 	zend_free_op free_op2;
24366 	zval **object_ptr;
24367 	zval *object;
24368 	zval *property;
24369 	zval *retval;
24370 	int have_get_ptr = 0;
24371 
24372 	SAVE_OPLINE();
24373 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24374 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24375 	retval = &EX_T(opline->result.var).tmp_var;
24376 
24377 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24378 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
24379 	}
24380 
24381 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
24382 	object = *object_ptr;
24383 
24384 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24385 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24386 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24387 		ZVAL_NULL(retval);
24388 
24389 		CHECK_EXCEPTION();
24390 		ZEND_VM_NEXT_OPCODE();
24391 	}
24392 
24393 	/* here we are sure we are dealing with an object */
24394 
24395 	if (0) {
24396 		MAKE_REAL_ZVAL_PTR(property);
24397 	}
24398 
24399 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24400 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24401 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24402 			have_get_ptr = 1;
24403 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
24404 
24405 			ZVAL_COPY_VALUE(retval, *zptr);
24406 			zendi_zval_copy_ctor(*retval);
24407 
24408 			incdec_op(*zptr);
24409 
24410 		}
24411 	}
24412 
24413 	if (!have_get_ptr) {
24414 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
24415 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24416 			zval *z_copy;
24417 
24418 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
24419 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24420 
24421 				if (Z_REFCOUNT_P(z) == 0) {
24422 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
24423 					zval_dtor(z);
24424 					FREE_ZVAL(z);
24425 				}
24426 				z = value;
24427 			}
24428 			ZVAL_COPY_VALUE(retval, z);
24429 			zendi_zval_copy_ctor(*retval);
24430 			ALLOC_ZVAL(z_copy);
24431 			INIT_PZVAL_COPY(z_copy, z);
24432 			zendi_zval_copy_ctor(*z_copy);
24433 			incdec_op(z_copy);
24434 			Z_ADDREF_P(z);
24435 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24436 			zval_ptr_dtor(&z_copy);
24437 			zval_ptr_dtor(&z);
24438 		} else {
24439 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24440 			ZVAL_NULL(retval);
24441 		}
24442 	}
24443 
24444 	if (0) {
24445 		zval_ptr_dtor(&property);
24446 	} else {
24447 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24448 	}
24449 
24450 	CHECK_EXCEPTION();
24451 	ZEND_VM_NEXT_OPCODE();
24452 }
24453 
ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24454 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24455 {
24456 	return zend_post_incdec_property_helper_SPEC_UNUSED_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24457 }
24458 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24459 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24460 {
24461 	return zend_post_incdec_property_helper_SPEC_UNUSED_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24462 }
24463 
zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS)24464 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS)
24465 {
24466 	USE_OPLINE
24467 
24468 	zval *container;
24469 	zend_free_op free_op2;
24470 	zval *offset;
24471 
24472 	SAVE_OPLINE();
24473 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
24474 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24475 
24476 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
24477 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
24478 		zend_error(E_NOTICE, "Trying to get property of non-object");
24479 		PZVAL_LOCK(&EG(uninitialized_zval));
24480 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24481 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24482 	} else {
24483 		zval *retval;
24484 
24485 		if (0) {
24486 			MAKE_REAL_ZVAL_PTR(offset);
24487 		}
24488 
24489 		/* here we are sure we are dealing with an object */
24490 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24491 
24492 		PZVAL_LOCK(retval);
24493 		AI_SET_PTR(&EX_T(opline->result.var), retval);
24494 
24495 		if (0) {
24496 			zval_ptr_dtor(&offset);
24497 		} else {
24498 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24499 		}
24500 	}
24501 
24502 	CHECK_EXCEPTION();
24503 	ZEND_VM_NEXT_OPCODE();
24504 }
24505 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24506 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24507 {
24508 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24509 }
24510 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24511 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24512 {
24513 	USE_OPLINE
24514 	zend_free_op free_op1, free_op2;
24515 	zval *property;
24516 	zval **container;
24517 
24518 	SAVE_OPLINE();
24519 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24520 
24521 	if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
24522 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
24523 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
24524 	}
24525 
24526 	if (0) {
24527 		MAKE_REAL_ZVAL_PTR(property);
24528 	}
24529 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24530 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24531 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24532 	}
24533 
24534 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
24535 	if (0) {
24536 		zval_ptr_dtor(&property);
24537 	} else {
24538 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24539 	}
24540 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24541 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24542 	}
24543 
24544 	/* We are going to assign the result by reference */
24545 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
24546 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
24547 
24548 		Z_DELREF_PP(retval_ptr);
24549 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
24550 		Z_ADDREF_PP(retval_ptr);
24551 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
24552 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
24553 	}
24554 
24555 	CHECK_EXCEPTION();
24556 	ZEND_VM_NEXT_OPCODE();
24557 }
24558 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24559 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24560 {
24561 	USE_OPLINE
24562 	zend_free_op free_op1, free_op2;
24563 	zval *property;
24564 	zval **container;
24565 
24566 	SAVE_OPLINE();
24567 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24568 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24569 
24570 	if (0) {
24571 		MAKE_REAL_ZVAL_PTR(property);
24572 	}
24573 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24574 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24575 	}
24576 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
24577 	if (0) {
24578 		zval_ptr_dtor(&property);
24579 	} else {
24580 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24581 	}
24582 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24583 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24584 	}
24585 
24586 	CHECK_EXCEPTION();
24587 	ZEND_VM_NEXT_OPCODE();
24588 }
24589 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24590 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24591 {
24592 	USE_OPLINE
24593 
24594 	zval *container;
24595 	zend_free_op free_op2;
24596 	zval *offset;
24597 
24598 	SAVE_OPLINE();
24599 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
24600 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24601 
24602 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
24603 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
24604 		PZVAL_LOCK(&EG(uninitialized_zval));
24605 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24606 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24607 	} else {
24608 		zval *retval;
24609 
24610 		if (0) {
24611 			MAKE_REAL_ZVAL_PTR(offset);
24612 		}
24613 
24614 		/* here we are sure we are dealing with an object */
24615 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24616 
24617 		PZVAL_LOCK(retval);
24618 		AI_SET_PTR(&EX_T(opline->result.var), retval);
24619 
24620 		if (0) {
24621 			zval_ptr_dtor(&offset);
24622 		} else {
24623 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24624 		}
24625 	}
24626 
24627 	CHECK_EXCEPTION();
24628 	ZEND_VM_NEXT_OPCODE();
24629 }
24630 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24631 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24632 {
24633 	USE_OPLINE
24634 
24635 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
24636 		/* Behave like FETCH_OBJ_W */
24637 		zend_free_op free_op1, free_op2;
24638 		zval *property;
24639 		zval **container;
24640 
24641 		SAVE_OPLINE();
24642 		property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24643 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24644 
24645 		if (0) {
24646 			MAKE_REAL_ZVAL_PTR(property);
24647 		}
24648 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24649 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24650 		}
24651 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
24652 		if (0) {
24653 			zval_ptr_dtor(&property);
24654 		} else {
24655 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24656 		}
24657 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24658 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24659 		}
24660 
24661 		CHECK_EXCEPTION();
24662 		ZEND_VM_NEXT_OPCODE();
24663 	} else {
24664 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24665 	}
24666 }
24667 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24668 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24669 {
24670 	USE_OPLINE
24671 	zend_free_op free_op1, free_op2, free_res;
24672 	zval **container;
24673 	zval *property;
24674 
24675 	SAVE_OPLINE();
24676 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24677 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24678 
24679 	if (IS_UNUSED == IS_CV) {
24680 		if (container != &EG(uninitialized_zval_ptr)) {
24681 			SEPARATE_ZVAL_IF_NOT_REF(container);
24682 		}
24683 	}
24684 	if (0) {
24685 		MAKE_REAL_ZVAL_PTR(property);
24686 	}
24687 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24688 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24689 	}
24690 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
24691 	if (0) {
24692 		zval_ptr_dtor(&property);
24693 	} else {
24694 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24695 	}
24696 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24697 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24698 	}
24699 
24700 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
24701 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
24702 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
24703 	}
24704 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
24705 	FREE_OP_VAR_PTR(free_res);
24706 	CHECK_EXCEPTION();
24707 	ZEND_VM_NEXT_OPCODE();
24708 }
24709 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24710 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24711 {
24712 	USE_OPLINE
24713 	zend_free_op free_op2;
24714 	zval **object_ptr;
24715 	zval *property_name;
24716 
24717 	SAVE_OPLINE();
24718 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24719 	property_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24720 
24721 	if (0) {
24722 		MAKE_REAL_ZVAL_PTR(property_name);
24723 	}
24724 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24725 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
24726 	}
24727 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24728 	if (0) {
24729 		zval_ptr_dtor(&property_name);
24730 	} else {
24731 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24732 	}
24733 
24734 	/* assign_obj has two opcodes! */
24735 	CHECK_EXCEPTION();
24736 	ZEND_VM_INC_OPCODE();
24737 	ZEND_VM_NEXT_OPCODE();
24738 }
24739 
ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24740 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24741 {
24742 	USE_OPLINE
24743 	zend_free_op free_op2;
24744 	zval *str = &EX_T(opline->result.var).tmp_var;
24745 	zval *var;
24746 	zval var_copy;
24747 	int use_copy = 0;
24748 
24749 	SAVE_OPLINE();
24750 	var = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24751 
24752 	if (IS_UNUSED == IS_UNUSED) {
24753 		/* Initialize for erealloc in add_string_to_string */
24754 		Z_STRVAL_P(str) = NULL;
24755 		Z_STRLEN_P(str) = 0;
24756 		Z_TYPE_P(str) = IS_STRING;
24757 
24758 		INIT_PZVAL(str);
24759 	}
24760 
24761 	if (Z_TYPE_P(var) != IS_STRING) {
24762 		zend_make_printable_zval(var, &var_copy, &use_copy);
24763 
24764 		if (use_copy) {
24765 			var = &var_copy;
24766 		}
24767 	}
24768 	add_string_to_string(str, str, var);
24769 
24770 	if (use_copy) {
24771 		zval_dtor(var);
24772 	}
24773 	/* original comment, possibly problematic:
24774 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
24775 	 * (Zeev):  I don't think it's problematic, we only use variables
24776 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
24777 	 * string offsets or overloaded objects
24778 	 */
24779 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24780 
24781 	CHECK_EXCEPTION();
24782 	ZEND_VM_NEXT_OPCODE();
24783 }
24784 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24785 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24786 {
24787 	USE_OPLINE
24788 	zval *function_name;
24789 	char *function_name_strval;
24790 	int function_name_strlen;
24791 	zend_free_op free_op2;
24792 
24793 	SAVE_OPLINE();
24794 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
24795 
24796 	function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24797 
24798 	if (IS_VAR != IS_CONST &&
24799 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
24800 		zend_error_noreturn(E_ERROR, "Method name must be a string");
24801 	}
24802 
24803 	function_name_strval = Z_STRVAL_P(function_name);
24804 	function_name_strlen = Z_STRLEN_P(function_name);
24805 
24806 	EX(object) = _get_obj_zval_ptr_unused(TSRMLS_C);
24807 
24808 	if (EXPECTED(EX(object) != NULL) &&
24809 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
24810 		EX(called_scope) = Z_OBJCE_P(EX(object));
24811 
24812 		if (IS_VAR != IS_CONST ||
24813 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
24814 		    zval *object = EX(object);
24815 
24816 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
24817 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
24818 			}
24819 
24820 			/* First, locate the function. */
24821 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
24822 			if (UNEXPECTED(EX(fbc) == NULL)) {
24823 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
24824 			}
24825 			if (IS_VAR == IS_CONST &&
24826 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
24827 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
24828 			    EXPECTED(EX(object) == object)) {
24829 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
24830 			}
24831 		}
24832 	} else {
24833 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
24834 	}
24835 
24836 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
24837 		EX(object) = NULL;
24838 	} else {
24839 		if (!PZVAL_IS_REF(EX(object))) {
24840 			Z_ADDREF_P(EX(object)); /* For $this pointer */
24841 		} else {
24842 			zval *this_ptr;
24843 			ALLOC_ZVAL(this_ptr);
24844 			INIT_PZVAL_COPY(this_ptr, EX(object));
24845 			zval_copy_ctor(this_ptr);
24846 			EX(object) = this_ptr;
24847 		}
24848 	}
24849 
24850 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24851 
24852 	CHECK_EXCEPTION();
24853 	ZEND_VM_NEXT_OPCODE();
24854 }
24855 
ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24856 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24857 {
24858 	USE_OPLINE
24859 
24860 	array_init(&EX_T(opline->result.var).tmp_var);
24861 	if (IS_UNUSED == IS_UNUSED) {
24862 		ZEND_VM_NEXT_OPCODE();
24863 #if 0 || IS_UNUSED != IS_UNUSED
24864 	} else {
24865 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24866 #endif
24867 	}
24868 }
24869 
ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24870 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24871 {
24872 	USE_OPLINE
24873 	zend_free_op free_op2;
24874 	zval **container;
24875 	zval *offset;
24876 	ulong hval;
24877 
24878 	SAVE_OPLINE();
24879 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24880 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
24881 		SEPARATE_ZVAL_IF_NOT_REF(container);
24882 	}
24883 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24884 
24885 	if (IS_UNUSED != IS_VAR || container) {
24886 		switch (Z_TYPE_PP(container)) {
24887 			case IS_ARRAY: {
24888 				HashTable *ht = Z_ARRVAL_PP(container);
24889 
24890 				switch (Z_TYPE_P(offset)) {
24891 					case IS_DOUBLE:
24892 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
24893 						zend_hash_index_del(ht, hval);
24894 						break;
24895 					case IS_RESOURCE:
24896 					case IS_BOOL:
24897 					case IS_LONG:
24898 						hval = Z_LVAL_P(offset);
24899 						zend_hash_index_del(ht, hval);
24900 						break;
24901 					case IS_STRING:
24902 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
24903 							Z_ADDREF_P(offset);
24904 						}
24905 						if (IS_VAR == IS_CONST) {
24906 							hval = Z_HASH_P(offset);
24907 						} else {
24908 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
24909 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
24910 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
24911 							} else {
24912 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
24913 							}
24914 						}
24915 						if (ht == &EG(symbol_table)) {
24916 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
24917 						} else {
24918 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
24919 						}
24920 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
24921 							zval_ptr_dtor(&offset);
24922 						}
24923 						break;
24924 num_index_dim:
24925 						zend_hash_index_del(ht, hval);
24926 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
24927 							zval_ptr_dtor(&offset);
24928 						}
24929 						break;
24930 					case IS_NULL:
24931 						zend_hash_del(ht, "", sizeof(""));
24932 						break;
24933 					default:
24934 						zend_error(E_WARNING, "Illegal offset type in unset");
24935 						break;
24936 				}
24937 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24938 				break;
24939 			}
24940 			case IS_OBJECT:
24941 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
24942 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
24943 				}
24944 				if (0) {
24945 					MAKE_REAL_ZVAL_PTR(offset);
24946 				}
24947 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
24948 				if (0) {
24949 					zval_ptr_dtor(&offset);
24950 				} else {
24951 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24952 				}
24953 				break;
24954 			case IS_STRING:
24955 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
24956 				ZEND_VM_CONTINUE(); /* bailed out before */
24957 			default:
24958 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24959 				break;
24960 		}
24961 	} else {
24962 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24963 	}
24964 
24965 	CHECK_EXCEPTION();
24966 	ZEND_VM_NEXT_OPCODE();
24967 }
24968 
ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24969 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24970 {
24971 	USE_OPLINE
24972 	zend_free_op free_op2;
24973 	zval **container;
24974 	zval *offset;
24975 
24976 	SAVE_OPLINE();
24977 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24978 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
24979 
24980 	if (IS_UNUSED != IS_VAR || container) {
24981 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
24982 			SEPARATE_ZVAL_IF_NOT_REF(container);
24983 		}
24984 		if (Z_TYPE_PP(container) == IS_OBJECT) {
24985 			if (0) {
24986 				MAKE_REAL_ZVAL_PTR(offset);
24987 			}
24988 			if (Z_OBJ_HT_P(*container)->unset_property) {
24989 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24990 			} else {
24991 				zend_error(E_NOTICE, "Trying to unset property of non-object");
24992 			}
24993 			if (0) {
24994 				zval_ptr_dtor(&offset);
24995 			} else {
24996 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
24997 			}
24998 		} else {
24999 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25000 		}
25001 	} else {
25002 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25003 	}
25004 
25005 	CHECK_EXCEPTION();
25006 	ZEND_VM_NEXT_OPCODE();
25007 }
25008 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)25009 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
25010 {
25011 	USE_OPLINE
25012 	zend_free_op free_op2;
25013 	zval **container;
25014 	zval **value = NULL;
25015 	int result = 0;
25016 	ulong hval;
25017 	zval *offset;
25018 
25019 	SAVE_OPLINE();
25020 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25021 
25022 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
25023 
25024 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
25025 		HashTable *ht;
25026 		int isset = 0;
25027 
25028 		ht = Z_ARRVAL_PP(container);
25029 
25030 		switch (Z_TYPE_P(offset)) {
25031 			case IS_DOUBLE:
25032 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
25033 				goto num_index_prop;
25034 			case IS_RESOURCE:
25035 			case IS_BOOL:
25036 			case IS_LONG:
25037 				hval = Z_LVAL_P(offset);
25038 num_index_prop:
25039 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
25040 					isset = 1;
25041 				}
25042 				break;
25043 			case IS_STRING:
25044 				if (IS_VAR == IS_CONST) {
25045 					hval = Z_HASH_P(offset);
25046 				} else {
25047 					if (!prop_dim) {
25048 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
25049 					}
25050 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
25051 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
25052 					} else {
25053 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
25054 					}
25055 				}
25056 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
25057 					isset = 1;
25058 				}
25059 				break;
25060 			case IS_NULL:
25061 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
25062 					isset = 1;
25063 				}
25064 				break;
25065 			default:
25066 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
25067 				break;
25068 		}
25069 
25070 		if (opline->extended_value & ZEND_ISSET) {
25071 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
25072 				result = 0;
25073 			} else {
25074 				result = isset;
25075 			}
25076 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
25077 			if (!isset || !i_zend_is_true(*value)) {
25078 				result = 0;
25079 			} else {
25080 				result = 1;
25081 			}
25082 		}
25083 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25084 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
25085 		if (0) {
25086 			MAKE_REAL_ZVAL_PTR(offset);
25087 		}
25088 		if (prop_dim) {
25089 			if (Z_OBJ_HT_P(*container)->has_property) {
25090 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25091 			} else {
25092 				zend_error(E_NOTICE, "Trying to check property of non-object");
25093 				result = 0;
25094 			}
25095 		} else {
25096 			if (Z_OBJ_HT_P(*container)->has_dimension) {
25097 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
25098 			} else {
25099 				zend_error(E_NOTICE, "Trying to check element of non-array");
25100 				result = 0;
25101 			}
25102 		}
25103 		if (0) {
25104 			zval_ptr_dtor(&offset);
25105 		} else {
25106 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25107 		}
25108 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
25109 		zval tmp;
25110 
25111 		if (Z_TYPE_P(offset) != IS_LONG) {
25112 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
25113 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
25114 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
25115 				ZVAL_COPY_VALUE(&tmp, offset);
25116 				zval_copy_ctor(&tmp);
25117 				convert_to_long(&tmp);
25118 				offset = &tmp;
25119 			} else {
25120 				/* can not be converted to proper offset, return "not set" */
25121 				result = 0;
25122 			}
25123 		}
25124 		if (Z_TYPE_P(offset) == IS_LONG) {
25125 			if (opline->extended_value & ZEND_ISSET) {
25126 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
25127 					result = 1;
25128 				}
25129 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
25130 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
25131 					result = 1;
25132 				}
25133 			}
25134 		}
25135 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25136 	} else {
25137 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
25138 	}
25139 
25140 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
25141 	if (opline->extended_value & ZEND_ISSET) {
25142 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
25143 	} else {
25144 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
25145 	}
25146 
25147 	CHECK_EXCEPTION();
25148 	ZEND_VM_NEXT_OPCODE();
25149 }
25150 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25151 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25152 {
25153 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25154 }
25155 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25156 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25157 {
25158 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25159 }
25160 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25161 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25162 {
25163 	USE_OPLINE
25164 	zend_free_op free_op_data1;
25165 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25166 	zval *object;
25167 	zval *property = NULL;
25168 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
25169 	int have_get_ptr = 0;
25170 
25171 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25172 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
25173 	}
25174 
25175 	make_real_object(object_ptr TSRMLS_CC);
25176 	object = *object_ptr;
25177 
25178 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
25179 		zend_error(E_WARNING, "Attempt to assign property of non-object");
25180 
25181 		FREE_OP(free_op_data1);
25182 
25183 		if (RETURN_VALUE_USED(opline)) {
25184 			PZVAL_LOCK(&EG(uninitialized_zval));
25185 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25186 			EX_T(opline->result.var).var.ptr_ptr = NULL;
25187 		}
25188 	} else {
25189 		/* here we are sure we are dealing with an object */
25190 		if (0) {
25191 			MAKE_REAL_ZVAL_PTR(property);
25192 		}
25193 
25194 		/* here property is a string */
25195 		if (opline->extended_value == ZEND_ASSIGN_OBJ
25196 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
25197 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25198 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
25199 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
25200 
25201 				have_get_ptr = 1;
25202 				binary_op(*zptr, *zptr, value TSRMLS_CC);
25203 				if (RETURN_VALUE_USED(opline)) {
25204 					PZVAL_LOCK(*zptr);
25205 					EX_T(opline->result.var).var.ptr = *zptr;
25206 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25207 				}
25208 			}
25209 		}
25210 
25211 		if (!have_get_ptr) {
25212 			zval *z = NULL;
25213 
25214 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25215 				if (Z_OBJ_HT_P(object)->read_property) {
25216 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25217 				}
25218 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25219 				if (Z_OBJ_HT_P(object)->read_dimension) {
25220 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
25221 				}
25222 			}
25223 			if (z) {
25224 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
25225 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
25226 
25227 					if (Z_REFCOUNT_P(z) == 0) {
25228 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
25229 						zval_dtor(z);
25230 						FREE_ZVAL(z);
25231 					}
25232 					z = value;
25233 				}
25234 				Z_ADDREF_P(z);
25235 				SEPARATE_ZVAL_IF_NOT_REF(&z);
25236 				binary_op(z, z, value TSRMLS_CC);
25237 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25238 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25239 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25240 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
25241 				}
25242 				if (RETURN_VALUE_USED(opline)) {
25243 					PZVAL_LOCK(z);
25244 					EX_T(opline->result.var).var.ptr = z;
25245 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25246 				}
25247 				zval_ptr_dtor(&z);
25248 			} else {
25249 				zend_error(E_WARNING, "Attempt to assign property of non-object");
25250 				if (RETURN_VALUE_USED(opline)) {
25251 					PZVAL_LOCK(&EG(uninitialized_zval));
25252 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25253 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25254 				}
25255 			}
25256 		}
25257 
25258 		if (0) {
25259 			zval_ptr_dtor(&property);
25260 		} else {
25261 
25262 		}
25263 		FREE_OP(free_op_data1);
25264 	}
25265 
25266 	/* assign_obj has two opcodes! */
25267 	CHECK_EXCEPTION();
25268 	ZEND_VM_INC_OPCODE();
25269 	ZEND_VM_NEXT_OPCODE();
25270 }
25271 
zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25272 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25273 {
25274 	USE_OPLINE
25275 	zend_free_op free_op_data2, free_op_data1;
25276 	zval **var_ptr;
25277 	zval *value;
25278 
25279 	SAVE_OPLINE();
25280 	switch (opline->extended_value) {
25281 		case ZEND_ASSIGN_OBJ:
25282 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25283 			break;
25284 		case ZEND_ASSIGN_DIM: {
25285 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25286 
25287 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
25288 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
25289 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
25290 					if (IS_UNUSED == IS_VAR && !0) {
25291 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
25292 					}
25293 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25294 				} else {
25295 					zval *dim = NULL;
25296 
25297 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
25298 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
25299 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
25300 				}
25301 			}
25302 			break;
25303 		default:
25304 			value = NULL;
25305 			var_ptr = NULL;
25306 			/* do nothing */
25307 			break;
25308 	}
25309 
25310 	if (UNEXPECTED(var_ptr == NULL)) {
25311 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
25312 	}
25313 
25314 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
25315 		if (RETURN_VALUE_USED(opline)) {
25316 			PZVAL_LOCK(&EG(uninitialized_zval));
25317 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
25318 		}
25319 
25320 
25321 		CHECK_EXCEPTION();
25322 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
25323 			ZEND_VM_INC_OPCODE();
25324 		}
25325 		ZEND_VM_NEXT_OPCODE();
25326 	}
25327 
25328 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
25329 
25330 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
25331 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
25332 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
25333 		/* proxy object */
25334 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
25335 		Z_ADDREF_P(objval);
25336 		binary_op(objval, objval, value TSRMLS_CC);
25337 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
25338 		zval_ptr_dtor(&objval);
25339 	} else {
25340 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
25341 	}
25342 
25343 	if (RETURN_VALUE_USED(opline)) {
25344 		PZVAL_LOCK(*var_ptr);
25345 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
25346 	}
25347 
25348 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
25349 		FREE_OP(free_op_data1);
25350 		FREE_OP_VAR_PTR(free_op_data2);
25351 
25352 		CHECK_EXCEPTION();
25353 		ZEND_VM_INC_OPCODE();
25354 	} else {
25355 
25356 		CHECK_EXCEPTION();
25357 	}
25358 	ZEND_VM_NEXT_OPCODE();
25359 }
25360 
ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25361 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25362 {
25363 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25364 }
25365 
ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25366 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25367 {
25368 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25369 }
25370 
ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25371 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25372 {
25373 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25374 }
25375 
ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25376 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25377 {
25378 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25379 }
25380 
ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25381 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25382 {
25383 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25384 }
25385 
ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25386 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25387 {
25388 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25389 }
25390 
ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25391 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25392 {
25393 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25394 }
25395 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25396 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25397 {
25398 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25399 }
25400 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25401 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25402 {
25403 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25404 }
25405 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25406 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25407 {
25408 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25409 }
25410 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25411 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25412 {
25413 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25414 }
25415 
ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25416 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25417 {
25418 	USE_OPLINE
25419 
25420 	array_init(&EX_T(opline->result.var).tmp_var);
25421 	if (IS_UNUSED == IS_UNUSED) {
25422 		ZEND_VM_NEXT_OPCODE();
25423 #if 0 || IS_UNUSED != IS_UNUSED
25424 	} else {
25425 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25426 #endif
25427 	}
25428 }
25429 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25430 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25431 {
25432 	USE_OPLINE
25433 	zend_free_op free_op_data1;
25434 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25435 	zval *object;
25436 	zval *property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25437 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
25438 	int have_get_ptr = 0;
25439 
25440 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25441 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
25442 	}
25443 
25444 	make_real_object(object_ptr TSRMLS_CC);
25445 	object = *object_ptr;
25446 
25447 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
25448 		zend_error(E_WARNING, "Attempt to assign property of non-object");
25449 
25450 		FREE_OP(free_op_data1);
25451 
25452 		if (RETURN_VALUE_USED(opline)) {
25453 			PZVAL_LOCK(&EG(uninitialized_zval));
25454 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25455 			EX_T(opline->result.var).var.ptr_ptr = NULL;
25456 		}
25457 	} else {
25458 		/* here we are sure we are dealing with an object */
25459 		if (0) {
25460 			MAKE_REAL_ZVAL_PTR(property);
25461 		}
25462 
25463 		/* here property is a string */
25464 		if (opline->extended_value == ZEND_ASSIGN_OBJ
25465 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
25466 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25467 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
25468 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
25469 
25470 				have_get_ptr = 1;
25471 				binary_op(*zptr, *zptr, value TSRMLS_CC);
25472 				if (RETURN_VALUE_USED(opline)) {
25473 					PZVAL_LOCK(*zptr);
25474 					EX_T(opline->result.var).var.ptr = *zptr;
25475 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25476 				}
25477 			}
25478 		}
25479 
25480 		if (!have_get_ptr) {
25481 			zval *z = NULL;
25482 
25483 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25484 				if (Z_OBJ_HT_P(object)->read_property) {
25485 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25486 				}
25487 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25488 				if (Z_OBJ_HT_P(object)->read_dimension) {
25489 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
25490 				}
25491 			}
25492 			if (z) {
25493 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
25494 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
25495 
25496 					if (Z_REFCOUNT_P(z) == 0) {
25497 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
25498 						zval_dtor(z);
25499 						FREE_ZVAL(z);
25500 					}
25501 					z = value;
25502 				}
25503 				Z_ADDREF_P(z);
25504 				SEPARATE_ZVAL_IF_NOT_REF(&z);
25505 				binary_op(z, z, value TSRMLS_CC);
25506 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25507 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25508 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25509 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
25510 				}
25511 				if (RETURN_VALUE_USED(opline)) {
25512 					PZVAL_LOCK(z);
25513 					EX_T(opline->result.var).var.ptr = z;
25514 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25515 				}
25516 				zval_ptr_dtor(&z);
25517 			} else {
25518 				zend_error(E_WARNING, "Attempt to assign property of non-object");
25519 				if (RETURN_VALUE_USED(opline)) {
25520 					PZVAL_LOCK(&EG(uninitialized_zval));
25521 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25522 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25523 				}
25524 			}
25525 		}
25526 
25527 		if (0) {
25528 			zval_ptr_dtor(&property);
25529 		} else {
25530 
25531 		}
25532 		FREE_OP(free_op_data1);
25533 	}
25534 
25535 	/* assign_obj has two opcodes! */
25536 	CHECK_EXCEPTION();
25537 	ZEND_VM_INC_OPCODE();
25538 	ZEND_VM_NEXT_OPCODE();
25539 }
25540 
zend_binary_assign_op_helper_SPEC_UNUSED_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25541 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25542 {
25543 	USE_OPLINE
25544 	zend_free_op free_op_data2, free_op_data1;
25545 	zval **var_ptr;
25546 	zval *value;
25547 
25548 	SAVE_OPLINE();
25549 	switch (opline->extended_value) {
25550 		case ZEND_ASSIGN_OBJ:
25551 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25552 			break;
25553 		case ZEND_ASSIGN_DIM: {
25554 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25555 
25556 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
25557 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
25558 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
25559 					if (IS_UNUSED == IS_VAR && !0) {
25560 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
25561 					}
25562 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25563 				} else {
25564 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25565 
25566 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
25567 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
25568 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
25569 				}
25570 			}
25571 			break;
25572 		default:
25573 			value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25574 			var_ptr = NULL;
25575 			/* do nothing */
25576 			break;
25577 	}
25578 
25579 	if (UNEXPECTED(var_ptr == NULL)) {
25580 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
25581 	}
25582 
25583 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
25584 		if (RETURN_VALUE_USED(opline)) {
25585 			PZVAL_LOCK(&EG(uninitialized_zval));
25586 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
25587 		}
25588 
25589 
25590 		CHECK_EXCEPTION();
25591 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
25592 			ZEND_VM_INC_OPCODE();
25593 		}
25594 		ZEND_VM_NEXT_OPCODE();
25595 	}
25596 
25597 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
25598 
25599 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
25600 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
25601 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
25602 		/* proxy object */
25603 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
25604 		Z_ADDREF_P(objval);
25605 		binary_op(objval, objval, value TSRMLS_CC);
25606 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
25607 		zval_ptr_dtor(&objval);
25608 	} else {
25609 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
25610 	}
25611 
25612 	if (RETURN_VALUE_USED(opline)) {
25613 		PZVAL_LOCK(*var_ptr);
25614 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
25615 	}
25616 
25617 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
25618 		FREE_OP(free_op_data1);
25619 		FREE_OP_VAR_PTR(free_op_data2);
25620 
25621 		CHECK_EXCEPTION();
25622 		ZEND_VM_INC_OPCODE();
25623 	} else {
25624 
25625 		CHECK_EXCEPTION();
25626 	}
25627 	ZEND_VM_NEXT_OPCODE();
25628 }
25629 
ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25630 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25631 {
25632 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25633 }
25634 
ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25635 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25636 {
25637 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25638 }
25639 
ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25640 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25641 {
25642 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25643 }
25644 
ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25645 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25646 {
25647 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25648 }
25649 
ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25650 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25651 {
25652 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25653 }
25654 
ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25655 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25656 {
25657 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25658 }
25659 
ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25660 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25661 {
25662 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25663 }
25664 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25665 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25666 {
25667 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25668 }
25669 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25670 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25671 {
25672 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25673 }
25674 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25675 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25676 {
25677 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25678 }
25679 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25680 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25681 {
25682 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25683 }
25684 
zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)25685 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
25686 {
25687 	USE_OPLINE
25688 
25689 	zval **object_ptr;
25690 	zval *object;
25691 	zval *property;
25692 	zval **retval;
25693 	int have_get_ptr = 0;
25694 
25695 	SAVE_OPLINE();
25696 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25697 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25698 	retval = &EX_T(opline->result.var).var.ptr;
25699 
25700 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25701 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
25702 	}
25703 
25704 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
25705 	object = *object_ptr;
25706 
25707 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
25708 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
25709 
25710 		if (RETURN_VALUE_USED(opline)) {
25711 			PZVAL_LOCK(&EG(uninitialized_zval));
25712 			*retval = &EG(uninitialized_zval);
25713 		}
25714 
25715 		CHECK_EXCEPTION();
25716 		ZEND_VM_NEXT_OPCODE();
25717 	}
25718 
25719 	/* here we are sure we are dealing with an object */
25720 
25721 	if (0) {
25722 		MAKE_REAL_ZVAL_PTR(property);
25723 	}
25724 
25725 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
25726 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25727 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
25728 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
25729 
25730 			have_get_ptr = 1;
25731 			incdec_op(*zptr);
25732 			if (RETURN_VALUE_USED(opline)) {
25733 				*retval = *zptr;
25734 				PZVAL_LOCK(*retval);
25735 			}
25736 		}
25737 	}
25738 
25739 	if (!have_get_ptr) {
25740 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
25741 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25742 
25743 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
25744 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
25745 
25746 				if (Z_REFCOUNT_P(z) == 0) {
25747 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
25748 					zval_dtor(z);
25749 					FREE_ZVAL(z);
25750 				}
25751 				z = value;
25752 			}
25753 			Z_ADDREF_P(z);
25754 			SEPARATE_ZVAL_IF_NOT_REF(&z);
25755 			incdec_op(z);
25756 			*retval = z;
25757 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25758 			SELECTIVE_PZVAL_LOCK(*retval, opline);
25759 			zval_ptr_dtor(&z);
25760 		} else {
25761 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
25762 			if (RETURN_VALUE_USED(opline)) {
25763 				PZVAL_LOCK(&EG(uninitialized_zval));
25764 				*retval = &EG(uninitialized_zval);
25765 			}
25766 		}
25767 	}
25768 
25769 	if (0) {
25770 		zval_ptr_dtor(&property);
25771 	} else {
25772 
25773 	}
25774 
25775 	CHECK_EXCEPTION();
25776 	ZEND_VM_NEXT_OPCODE();
25777 }
25778 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25779 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25780 {
25781 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25782 }
25783 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25784 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25785 {
25786 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25787 }
25788 
zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)25789 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
25790 {
25791 	USE_OPLINE
25792 
25793 	zval **object_ptr;
25794 	zval *object;
25795 	zval *property;
25796 	zval *retval;
25797 	int have_get_ptr = 0;
25798 
25799 	SAVE_OPLINE();
25800 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25801 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25802 	retval = &EX_T(opline->result.var).tmp_var;
25803 
25804 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25805 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
25806 	}
25807 
25808 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
25809 	object = *object_ptr;
25810 
25811 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
25812 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
25813 
25814 		ZVAL_NULL(retval);
25815 
25816 		CHECK_EXCEPTION();
25817 		ZEND_VM_NEXT_OPCODE();
25818 	}
25819 
25820 	/* here we are sure we are dealing with an object */
25821 
25822 	if (0) {
25823 		MAKE_REAL_ZVAL_PTR(property);
25824 	}
25825 
25826 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
25827 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25828 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
25829 			have_get_ptr = 1;
25830 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
25831 
25832 			ZVAL_COPY_VALUE(retval, *zptr);
25833 			zendi_zval_copy_ctor(*retval);
25834 
25835 			incdec_op(*zptr);
25836 
25837 		}
25838 	}
25839 
25840 	if (!have_get_ptr) {
25841 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
25842 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25843 			zval *z_copy;
25844 
25845 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
25846 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
25847 
25848 				if (Z_REFCOUNT_P(z) == 0) {
25849 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
25850 					zval_dtor(z);
25851 					FREE_ZVAL(z);
25852 				}
25853 				z = value;
25854 			}
25855 			ZVAL_COPY_VALUE(retval, z);
25856 			zendi_zval_copy_ctor(*retval);
25857 			ALLOC_ZVAL(z_copy);
25858 			INIT_PZVAL_COPY(z_copy, z);
25859 			zendi_zval_copy_ctor(*z_copy);
25860 			incdec_op(z_copy);
25861 			Z_ADDREF_P(z);
25862 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25863 			zval_ptr_dtor(&z_copy);
25864 			zval_ptr_dtor(&z);
25865 		} else {
25866 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
25867 			ZVAL_NULL(retval);
25868 		}
25869 	}
25870 
25871 	if (0) {
25872 		zval_ptr_dtor(&property);
25873 	} else {
25874 
25875 	}
25876 
25877 	CHECK_EXCEPTION();
25878 	ZEND_VM_NEXT_OPCODE();
25879 }
25880 
ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25881 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25882 {
25883 	return zend_post_incdec_property_helper_SPEC_UNUSED_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25884 }
25885 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25886 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25887 {
25888 	return zend_post_incdec_property_helper_SPEC_UNUSED_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25889 }
25890 
zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS)25891 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS)
25892 {
25893 	USE_OPLINE
25894 
25895 	zval *container;
25896 
25897 	zval *offset;
25898 
25899 	SAVE_OPLINE();
25900 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
25901 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25902 
25903 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
25904 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
25905 		zend_error(E_NOTICE, "Trying to get property of non-object");
25906 		PZVAL_LOCK(&EG(uninitialized_zval));
25907 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
25908 
25909 	} else {
25910 		zval *retval;
25911 
25912 		if (0) {
25913 			MAKE_REAL_ZVAL_PTR(offset);
25914 		}
25915 
25916 		/* here we are sure we are dealing with an object */
25917 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25918 
25919 		PZVAL_LOCK(retval);
25920 		AI_SET_PTR(&EX_T(opline->result.var), retval);
25921 
25922 		if (0) {
25923 			zval_ptr_dtor(&offset);
25924 		} else {
25925 
25926 		}
25927 	}
25928 
25929 	CHECK_EXCEPTION();
25930 	ZEND_VM_NEXT_OPCODE();
25931 }
25932 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25933 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25934 {
25935 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25936 }
25937 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25938 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25939 {
25940 	USE_OPLINE
25941 	zend_free_op free_op1;
25942 	zval *property;
25943 	zval **container;
25944 
25945 	SAVE_OPLINE();
25946 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25947 
25948 	if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
25949 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
25950 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
25951 	}
25952 
25953 	if (0) {
25954 		MAKE_REAL_ZVAL_PTR(property);
25955 	}
25956 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25957 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
25958 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
25959 	}
25960 
25961 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
25962 	if (0) {
25963 		zval_ptr_dtor(&property);
25964 	} else {
25965 
25966 	}
25967 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
25968 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
25969 	}
25970 
25971 	/* We are going to assign the result by reference */
25972 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
25973 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
25974 
25975 		Z_DELREF_PP(retval_ptr);
25976 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
25977 		Z_ADDREF_PP(retval_ptr);
25978 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
25979 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
25980 	}
25981 
25982 	CHECK_EXCEPTION();
25983 	ZEND_VM_NEXT_OPCODE();
25984 }
25985 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25986 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25987 {
25988 	USE_OPLINE
25989 	zend_free_op free_op1;
25990 	zval *property;
25991 	zval **container;
25992 
25993 	SAVE_OPLINE();
25994 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
25995 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25996 
25997 	if (0) {
25998 		MAKE_REAL_ZVAL_PTR(property);
25999 	}
26000 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26001 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26002 	}
26003 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
26004 	if (0) {
26005 		zval_ptr_dtor(&property);
26006 	} else {
26007 
26008 	}
26009 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26010 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26011 	}
26012 
26013 	CHECK_EXCEPTION();
26014 	ZEND_VM_NEXT_OPCODE();
26015 }
26016 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26017 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26018 {
26019 	USE_OPLINE
26020 
26021 	zval *container;
26022 
26023 	zval *offset;
26024 
26025 	SAVE_OPLINE();
26026 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
26027 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26028 
26029 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
26030 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
26031 		PZVAL_LOCK(&EG(uninitialized_zval));
26032 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
26033 
26034 	} else {
26035 		zval *retval;
26036 
26037 		if (0) {
26038 			MAKE_REAL_ZVAL_PTR(offset);
26039 		}
26040 
26041 		/* here we are sure we are dealing with an object */
26042 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26043 
26044 		PZVAL_LOCK(retval);
26045 		AI_SET_PTR(&EX_T(opline->result.var), retval);
26046 
26047 		if (0) {
26048 			zval_ptr_dtor(&offset);
26049 		} else {
26050 
26051 		}
26052 	}
26053 
26054 	CHECK_EXCEPTION();
26055 	ZEND_VM_NEXT_OPCODE();
26056 }
26057 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26058 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26059 {
26060 	USE_OPLINE
26061 
26062 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
26063 		/* Behave like FETCH_OBJ_W */
26064 		zend_free_op free_op1;
26065 		zval *property;
26066 		zval **container;
26067 
26068 		SAVE_OPLINE();
26069 		property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26070 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26071 
26072 		if (0) {
26073 			MAKE_REAL_ZVAL_PTR(property);
26074 		}
26075 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26076 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26077 		}
26078 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
26079 		if (0) {
26080 			zval_ptr_dtor(&property);
26081 		} else {
26082 
26083 		}
26084 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26085 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26086 		}
26087 
26088 		CHECK_EXCEPTION();
26089 		ZEND_VM_NEXT_OPCODE();
26090 	} else {
26091 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26092 	}
26093 }
26094 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26095 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26096 {
26097 	USE_OPLINE
26098 	zend_free_op free_op1, free_res;
26099 	zval **container;
26100 	zval *property;
26101 
26102 	SAVE_OPLINE();
26103 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26104 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26105 
26106 	if (IS_UNUSED == IS_CV) {
26107 		if (container != &EG(uninitialized_zval_ptr)) {
26108 			SEPARATE_ZVAL_IF_NOT_REF(container);
26109 		}
26110 	}
26111 	if (0) {
26112 		MAKE_REAL_ZVAL_PTR(property);
26113 	}
26114 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26115 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26116 	}
26117 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
26118 	if (0) {
26119 		zval_ptr_dtor(&property);
26120 	} else {
26121 
26122 	}
26123 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26124 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26125 	}
26126 
26127 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
26128 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
26129 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
26130 	}
26131 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
26132 	FREE_OP_VAR_PTR(free_res);
26133 	CHECK_EXCEPTION();
26134 	ZEND_VM_NEXT_OPCODE();
26135 }
26136 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26137 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26138 {
26139 	USE_OPLINE
26140 
26141 	zval **object_ptr;
26142 	zval *property_name;
26143 
26144 	SAVE_OPLINE();
26145 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26146 	property_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26147 
26148 	if (0) {
26149 		MAKE_REAL_ZVAL_PTR(property_name);
26150 	}
26151 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
26152 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
26153 	}
26154 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26155 	if (0) {
26156 		zval_ptr_dtor(&property_name);
26157 	} else {
26158 
26159 	}
26160 
26161 	/* assign_obj has two opcodes! */
26162 	CHECK_EXCEPTION();
26163 	ZEND_VM_INC_OPCODE();
26164 	ZEND_VM_NEXT_OPCODE();
26165 }
26166 
ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26167 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26168 {
26169 	USE_OPLINE
26170 
26171 	zval *str = &EX_T(opline->result.var).tmp_var;
26172 	zval *var;
26173 	zval var_copy;
26174 	int use_copy = 0;
26175 
26176 	SAVE_OPLINE();
26177 	var = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26178 
26179 	if (IS_UNUSED == IS_UNUSED) {
26180 		/* Initialize for erealloc in add_string_to_string */
26181 		Z_STRVAL_P(str) = NULL;
26182 		Z_STRLEN_P(str) = 0;
26183 		Z_TYPE_P(str) = IS_STRING;
26184 
26185 		INIT_PZVAL(str);
26186 	}
26187 
26188 	if (Z_TYPE_P(var) != IS_STRING) {
26189 		zend_make_printable_zval(var, &var_copy, &use_copy);
26190 
26191 		if (use_copy) {
26192 			var = &var_copy;
26193 		}
26194 	}
26195 	add_string_to_string(str, str, var);
26196 
26197 	if (use_copy) {
26198 		zval_dtor(var);
26199 	}
26200 	/* original comment, possibly problematic:
26201 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
26202 	 * (Zeev):  I don't think it's problematic, we only use variables
26203 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
26204 	 * string offsets or overloaded objects
26205 	 */
26206 
26207 	CHECK_EXCEPTION();
26208 	ZEND_VM_NEXT_OPCODE();
26209 }
26210 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26211 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26212 {
26213 	USE_OPLINE
26214 	zval *function_name;
26215 	char *function_name_strval;
26216 	int function_name_strlen;
26217 
26218 
26219 	SAVE_OPLINE();
26220 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
26221 
26222 	function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26223 
26224 	if (IS_CV != IS_CONST &&
26225 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
26226 		zend_error_noreturn(E_ERROR, "Method name must be a string");
26227 	}
26228 
26229 	function_name_strval = Z_STRVAL_P(function_name);
26230 	function_name_strlen = Z_STRLEN_P(function_name);
26231 
26232 	EX(object) = _get_obj_zval_ptr_unused(TSRMLS_C);
26233 
26234 	if (EXPECTED(EX(object) != NULL) &&
26235 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
26236 		EX(called_scope) = Z_OBJCE_P(EX(object));
26237 
26238 		if (IS_CV != IS_CONST ||
26239 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
26240 		    zval *object = EX(object);
26241 
26242 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
26243 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
26244 			}
26245 
26246 			/* First, locate the function. */
26247 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
26248 			if (UNEXPECTED(EX(fbc) == NULL)) {
26249 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
26250 			}
26251 			if (IS_CV == IS_CONST &&
26252 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
26253 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
26254 			    EXPECTED(EX(object) == object)) {
26255 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
26256 			}
26257 		}
26258 	} else {
26259 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
26260 	}
26261 
26262 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
26263 		EX(object) = NULL;
26264 	} else {
26265 		if (!PZVAL_IS_REF(EX(object))) {
26266 			Z_ADDREF_P(EX(object)); /* For $this pointer */
26267 		} else {
26268 			zval *this_ptr;
26269 			ALLOC_ZVAL(this_ptr);
26270 			INIT_PZVAL_COPY(this_ptr, EX(object));
26271 			zval_copy_ctor(this_ptr);
26272 			EX(object) = this_ptr;
26273 		}
26274 	}
26275 
26276 
26277 	CHECK_EXCEPTION();
26278 	ZEND_VM_NEXT_OPCODE();
26279 }
26280 
ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26281 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26282 {
26283 	USE_OPLINE
26284 
26285 	array_init(&EX_T(opline->result.var).tmp_var);
26286 	if (IS_UNUSED == IS_UNUSED) {
26287 		ZEND_VM_NEXT_OPCODE();
26288 #if 0 || IS_UNUSED != IS_UNUSED
26289 	} else {
26290 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26291 #endif
26292 	}
26293 }
26294 
ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26295 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26296 {
26297 	USE_OPLINE
26298 
26299 	zval **container;
26300 	zval *offset;
26301 	ulong hval;
26302 
26303 	SAVE_OPLINE();
26304 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26305 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
26306 		SEPARATE_ZVAL_IF_NOT_REF(container);
26307 	}
26308 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26309 
26310 	if (IS_UNUSED != IS_VAR || container) {
26311 		switch (Z_TYPE_PP(container)) {
26312 			case IS_ARRAY: {
26313 				HashTable *ht = Z_ARRVAL_PP(container);
26314 
26315 				switch (Z_TYPE_P(offset)) {
26316 					case IS_DOUBLE:
26317 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
26318 						zend_hash_index_del(ht, hval);
26319 						break;
26320 					case IS_RESOURCE:
26321 					case IS_BOOL:
26322 					case IS_LONG:
26323 						hval = Z_LVAL_P(offset);
26324 						zend_hash_index_del(ht, hval);
26325 						break;
26326 					case IS_STRING:
26327 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
26328 							Z_ADDREF_P(offset);
26329 						}
26330 						if (IS_CV == IS_CONST) {
26331 							hval = Z_HASH_P(offset);
26332 						} else {
26333 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
26334 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
26335 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
26336 							} else {
26337 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
26338 							}
26339 						}
26340 						if (ht == &EG(symbol_table)) {
26341 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
26342 						} else {
26343 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
26344 						}
26345 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
26346 							zval_ptr_dtor(&offset);
26347 						}
26348 						break;
26349 num_index_dim:
26350 						zend_hash_index_del(ht, hval);
26351 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
26352 							zval_ptr_dtor(&offset);
26353 						}
26354 						break;
26355 					case IS_NULL:
26356 						zend_hash_del(ht, "", sizeof(""));
26357 						break;
26358 					default:
26359 						zend_error(E_WARNING, "Illegal offset type in unset");
26360 						break;
26361 				}
26362 
26363 				break;
26364 			}
26365 			case IS_OBJECT:
26366 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
26367 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
26368 				}
26369 				if (0) {
26370 					MAKE_REAL_ZVAL_PTR(offset);
26371 				}
26372 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
26373 				if (0) {
26374 					zval_ptr_dtor(&offset);
26375 				} else {
26376 
26377 				}
26378 				break;
26379 			case IS_STRING:
26380 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
26381 				ZEND_VM_CONTINUE(); /* bailed out before */
26382 			default:
26383 
26384 				break;
26385 		}
26386 	} else {
26387 
26388 	}
26389 
26390 	CHECK_EXCEPTION();
26391 	ZEND_VM_NEXT_OPCODE();
26392 }
26393 
ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26394 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26395 {
26396 	USE_OPLINE
26397 
26398 	zval **container;
26399 	zval *offset;
26400 
26401 	SAVE_OPLINE();
26402 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26403 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26404 
26405 	if (IS_UNUSED != IS_VAR || container) {
26406 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
26407 			SEPARATE_ZVAL_IF_NOT_REF(container);
26408 		}
26409 		if (Z_TYPE_PP(container) == IS_OBJECT) {
26410 			if (0) {
26411 				MAKE_REAL_ZVAL_PTR(offset);
26412 			}
26413 			if (Z_OBJ_HT_P(*container)->unset_property) {
26414 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26415 			} else {
26416 				zend_error(E_NOTICE, "Trying to unset property of non-object");
26417 			}
26418 			if (0) {
26419 				zval_ptr_dtor(&offset);
26420 			} else {
26421 
26422 			}
26423 		} else {
26424 
26425 		}
26426 	} else {
26427 
26428 	}
26429 
26430 	CHECK_EXCEPTION();
26431 	ZEND_VM_NEXT_OPCODE();
26432 }
26433 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)26434 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
26435 {
26436 	USE_OPLINE
26437 
26438 	zval **container;
26439 	zval **value = NULL;
26440 	int result = 0;
26441 	ulong hval;
26442 	zval *offset;
26443 
26444 	SAVE_OPLINE();
26445 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26446 
26447 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
26448 
26449 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
26450 		HashTable *ht;
26451 		int isset = 0;
26452 
26453 		ht = Z_ARRVAL_PP(container);
26454 
26455 		switch (Z_TYPE_P(offset)) {
26456 			case IS_DOUBLE:
26457 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
26458 				goto num_index_prop;
26459 			case IS_RESOURCE:
26460 			case IS_BOOL:
26461 			case IS_LONG:
26462 				hval = Z_LVAL_P(offset);
26463 num_index_prop:
26464 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
26465 					isset = 1;
26466 				}
26467 				break;
26468 			case IS_STRING:
26469 				if (IS_CV == IS_CONST) {
26470 					hval = Z_HASH_P(offset);
26471 				} else {
26472 					if (!prop_dim) {
26473 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
26474 					}
26475 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
26476 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
26477 					} else {
26478 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
26479 					}
26480 				}
26481 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
26482 					isset = 1;
26483 				}
26484 				break;
26485 			case IS_NULL:
26486 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
26487 					isset = 1;
26488 				}
26489 				break;
26490 			default:
26491 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
26492 				break;
26493 		}
26494 
26495 		if (opline->extended_value & ZEND_ISSET) {
26496 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
26497 				result = 0;
26498 			} else {
26499 				result = isset;
26500 			}
26501 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
26502 			if (!isset || !i_zend_is_true(*value)) {
26503 				result = 0;
26504 			} else {
26505 				result = 1;
26506 			}
26507 		}
26508 
26509 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
26510 		if (0) {
26511 			MAKE_REAL_ZVAL_PTR(offset);
26512 		}
26513 		if (prop_dim) {
26514 			if (Z_OBJ_HT_P(*container)->has_property) {
26515 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26516 			} else {
26517 				zend_error(E_NOTICE, "Trying to check property of non-object");
26518 				result = 0;
26519 			}
26520 		} else {
26521 			if (Z_OBJ_HT_P(*container)->has_dimension) {
26522 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
26523 			} else {
26524 				zend_error(E_NOTICE, "Trying to check element of non-array");
26525 				result = 0;
26526 			}
26527 		}
26528 		if (0) {
26529 			zval_ptr_dtor(&offset);
26530 		} else {
26531 
26532 		}
26533 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
26534 		zval tmp;
26535 
26536 		if (Z_TYPE_P(offset) != IS_LONG) {
26537 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
26538 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
26539 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
26540 				ZVAL_COPY_VALUE(&tmp, offset);
26541 				zval_copy_ctor(&tmp);
26542 				convert_to_long(&tmp);
26543 				offset = &tmp;
26544 			} else {
26545 				/* can not be converted to proper offset, return "not set" */
26546 				result = 0;
26547 			}
26548 		}
26549 		if (Z_TYPE_P(offset) == IS_LONG) {
26550 			if (opline->extended_value & ZEND_ISSET) {
26551 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
26552 					result = 1;
26553 				}
26554 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
26555 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
26556 					result = 1;
26557 				}
26558 			}
26559 		}
26560 
26561 	} else {
26562 
26563 	}
26564 
26565 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
26566 	if (opline->extended_value & ZEND_ISSET) {
26567 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
26568 	} else {
26569 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
26570 	}
26571 
26572 	CHECK_EXCEPTION();
26573 	ZEND_VM_NEXT_OPCODE();
26574 }
26575 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26576 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26577 {
26578 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26579 }
26580 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26581 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26582 {
26583 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26584 }
26585 
ZEND_BW_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26586 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26587 {
26588 	USE_OPLINE
26589 
26590 
26591 	SAVE_OPLINE();
26592 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
26593 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC) TSRMLS_CC);
26594 
26595 	CHECK_EXCEPTION();
26596 	ZEND_VM_NEXT_OPCODE();
26597 }
26598 
ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26599 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26600 {
26601 	USE_OPLINE
26602 
26603 
26604 	SAVE_OPLINE();
26605 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
26606 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC) TSRMLS_CC);
26607 
26608 	CHECK_EXCEPTION();
26609 	ZEND_VM_NEXT_OPCODE();
26610 }
26611 
ZEND_PRE_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26612 static int ZEND_FASTCALL  ZEND_PRE_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26613 {
26614 	USE_OPLINE
26615 
26616 	zval **var_ptr;
26617 
26618 	SAVE_OPLINE();
26619 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
26620 
26621 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
26622 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26623 	}
26624 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
26625 		if (RETURN_VALUE_USED(opline)) {
26626 			PZVAL_LOCK(&EG(uninitialized_zval));
26627 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
26628 		}
26629 
26630 		CHECK_EXCEPTION();
26631 		ZEND_VM_NEXT_OPCODE();
26632 	}
26633 
26634 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
26635 
26636 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
26637 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
26638 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
26639 		/* proxy object */
26640 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
26641 		Z_ADDREF_P(val);
26642 		fast_increment_function(val);
26643 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
26644 		zval_ptr_dtor(&val);
26645 	} else {
26646 		fast_increment_function(*var_ptr);
26647 	}
26648 
26649 	if (RETURN_VALUE_USED(opline)) {
26650 		PZVAL_LOCK(*var_ptr);
26651 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
26652 	}
26653 
26654 	CHECK_EXCEPTION();
26655 	ZEND_VM_NEXT_OPCODE();
26656 }
26657 
ZEND_PRE_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26658 static int ZEND_FASTCALL  ZEND_PRE_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26659 {
26660 	USE_OPLINE
26661 
26662 	zval **var_ptr;
26663 
26664 	SAVE_OPLINE();
26665 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
26666 
26667 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
26668 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26669 	}
26670 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
26671 		if (RETURN_VALUE_USED(opline)) {
26672 			PZVAL_LOCK(&EG(uninitialized_zval));
26673 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
26674 		}
26675 
26676 		CHECK_EXCEPTION();
26677 		ZEND_VM_NEXT_OPCODE();
26678 	}
26679 
26680 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
26681 
26682 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
26683 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
26684 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
26685 		/* proxy object */
26686 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
26687 		Z_ADDREF_P(val);
26688 		fast_decrement_function(val);
26689 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
26690 		zval_ptr_dtor(&val);
26691 	} else {
26692 		fast_decrement_function(*var_ptr);
26693 	}
26694 
26695 	if (RETURN_VALUE_USED(opline)) {
26696 		PZVAL_LOCK(*var_ptr);
26697 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
26698 	}
26699 
26700 	CHECK_EXCEPTION();
26701 	ZEND_VM_NEXT_OPCODE();
26702 }
26703 
ZEND_POST_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26704 static int ZEND_FASTCALL  ZEND_POST_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26705 {
26706 	USE_OPLINE
26707 
26708 	zval **var_ptr, *retval;
26709 
26710 	SAVE_OPLINE();
26711 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
26712 
26713 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
26714 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26715 	}
26716 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
26717 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
26718 
26719 		CHECK_EXCEPTION();
26720 		ZEND_VM_NEXT_OPCODE();
26721 	}
26722 
26723 	retval = &EX_T(opline->result.var).tmp_var;
26724 	ZVAL_COPY_VALUE(retval, *var_ptr);
26725 	zendi_zval_copy_ctor(*retval);
26726 
26727 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
26728 
26729 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
26730 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
26731 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
26732 		/* proxy object */
26733 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
26734 		Z_ADDREF_P(val);
26735 		fast_increment_function(val);
26736 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
26737 		zval_ptr_dtor(&val);
26738 	} else {
26739 		fast_increment_function(*var_ptr);
26740 	}
26741 
26742 	CHECK_EXCEPTION();
26743 	ZEND_VM_NEXT_OPCODE();
26744 }
26745 
ZEND_POST_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26746 static int ZEND_FASTCALL  ZEND_POST_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26747 {
26748 	USE_OPLINE
26749 
26750 	zval **var_ptr, *retval;
26751 
26752 	SAVE_OPLINE();
26753 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
26754 
26755 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
26756 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26757 	}
26758 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
26759 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
26760 
26761 		CHECK_EXCEPTION();
26762 		ZEND_VM_NEXT_OPCODE();
26763 	}
26764 
26765 	retval = &EX_T(opline->result.var).tmp_var;
26766 	ZVAL_COPY_VALUE(retval, *var_ptr);
26767 	zendi_zval_copy_ctor(*retval);
26768 
26769 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
26770 
26771 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
26772 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
26773 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
26774 		/* proxy object */
26775 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
26776 		Z_ADDREF_P(val);
26777 		fast_decrement_function(val);
26778 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
26779 		zval_ptr_dtor(&val);
26780 	} else {
26781 		fast_decrement_function(*var_ptr);
26782 	}
26783 
26784 	CHECK_EXCEPTION();
26785 	ZEND_VM_NEXT_OPCODE();
26786 }
26787 
ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26788 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26789 {
26790 	USE_OPLINE
26791 
26792 	zval *z;
26793 
26794 	SAVE_OPLINE();
26795 	z = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26796 
26797 	if (IS_CV == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
26798 		INIT_PZVAL(z);
26799 	}
26800 	zend_print_variable(z);
26801 
26802 	CHECK_EXCEPTION();
26803 	ZEND_VM_NEXT_OPCODE();
26804 }
26805 
ZEND_PRINT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26806 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26807 {
26808 	USE_OPLINE
26809 
26810 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
26811 	return ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26812 }
26813 
ZEND_JMPZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26814 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26815 {
26816 	USE_OPLINE
26817 
26818 	zval *val;
26819 	int ret;
26820 
26821 	SAVE_OPLINE();
26822 	val = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26823 
26824 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
26825 		ret = Z_LVAL_P(val);
26826 	} else {
26827 		ret = i_zend_is_true(val);
26828 
26829 		if (UNEXPECTED(EG(exception) != NULL)) {
26830 			HANDLE_EXCEPTION();
26831 		}
26832 	}
26833 	if (!ret) {
26834 #if DEBUG_ZEND>=2
26835 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
26836 #endif
26837 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
26838 		ZEND_VM_CONTINUE();
26839 	}
26840 
26841 	ZEND_VM_NEXT_OPCODE();
26842 }
26843 
ZEND_JMPNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26844 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26845 {
26846 	USE_OPLINE
26847 
26848 	zval *val;
26849 	int ret;
26850 
26851 	SAVE_OPLINE();
26852 	val = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26853 
26854 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
26855 		ret = Z_LVAL_P(val);
26856 	} else {
26857 		ret = i_zend_is_true(val);
26858 
26859 		if (UNEXPECTED(EG(exception) != NULL)) {
26860 			HANDLE_EXCEPTION();
26861 		}
26862 	}
26863 	if (ret) {
26864 #if DEBUG_ZEND>=2
26865 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
26866 #endif
26867 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
26868 		ZEND_VM_CONTINUE();
26869 	}
26870 
26871 	ZEND_VM_NEXT_OPCODE();
26872 }
26873 
ZEND_JMPZNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26874 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26875 {
26876 	USE_OPLINE
26877 
26878 	zval *val;
26879 	int retval;
26880 
26881 	SAVE_OPLINE();
26882 	val = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26883 
26884 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
26885 		retval = Z_LVAL_P(val);
26886 	} else {
26887 		retval = i_zend_is_true(val);
26888 
26889 		if (UNEXPECTED(EG(exception) != NULL)) {
26890 			HANDLE_EXCEPTION();
26891 		}
26892 	}
26893 	if (EXPECTED(retval != 0)) {
26894 #if DEBUG_ZEND>=2
26895 		printf("Conditional jmp on true to %d\n", opline->extended_value);
26896 #endif
26897 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
26898 		ZEND_VM_CONTINUE(); /* CHECK_ME */
26899 	} else {
26900 #if DEBUG_ZEND>=2
26901 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
26902 #endif
26903 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
26904 		ZEND_VM_CONTINUE(); /* CHECK_ME */
26905 	}
26906 }
26907 
ZEND_JMPZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26908 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26909 {
26910 	USE_OPLINE
26911 
26912 	zval *val;
26913 	int retval;
26914 
26915 	SAVE_OPLINE();
26916 	val = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26917 
26918 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
26919 		retval = Z_LVAL_P(val);
26920 	} else {
26921 		retval = i_zend_is_true(val);
26922 
26923 		if (UNEXPECTED(EG(exception) != NULL)) {
26924 			HANDLE_EXCEPTION();
26925 		}
26926 	}
26927 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
26928 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
26929 	if (!retval) {
26930 #if DEBUG_ZEND>=2
26931 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
26932 #endif
26933 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
26934 		ZEND_VM_CONTINUE();
26935 	}
26936 	ZEND_VM_NEXT_OPCODE();
26937 }
26938 
ZEND_JMPNZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26939 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26940 {
26941 	USE_OPLINE
26942 
26943 	zval *val;
26944 	int retval;
26945 
26946 	SAVE_OPLINE();
26947 	val = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26948 
26949 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
26950 		retval = Z_LVAL_P(val);
26951 	} else {
26952 		retval = i_zend_is_true(val);
26953 
26954 		if (UNEXPECTED(EG(exception) != NULL)) {
26955 			HANDLE_EXCEPTION();
26956 		}
26957 	}
26958 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
26959 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
26960 	if (retval) {
26961 #if DEBUG_ZEND>=2
26962 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
26963 #endif
26964 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
26965 		ZEND_VM_CONTINUE();
26966 	}
26967 	ZEND_VM_NEXT_OPCODE();
26968 }
26969 
ZEND_RETURN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26970 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26971 {
26972 	USE_OPLINE
26973 	zval *retval_ptr;
26974 
26975 
26976 	SAVE_OPLINE();
26977 	retval_ptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
26978 
26979 	if (!EG(return_value_ptr_ptr)) {
26980 		if (IS_CV == IS_TMP_VAR) {
26981 
26982 		}
26983 	} else if (!0) { /* Not a temp var */
26984 		if (IS_CV == IS_CONST ||
26985 		    (PZVAL_IS_REF(retval_ptr) && Z_REFCOUNT_P(retval_ptr) > 0)) {
26986 			zval *ret;
26987 
26988 			ALLOC_ZVAL(ret);
26989 			INIT_PZVAL_COPY(ret, retval_ptr);
26990 			zval_copy_ctor(ret);
26991 			*EG(return_value_ptr_ptr) = ret;
26992 		} else if ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
26993 		           retval_ptr == &EG(uninitialized_zval)) {
26994 			zval *ret;
26995 
26996 			ALLOC_INIT_ZVAL(ret);
26997 			*EG(return_value_ptr_ptr) = ret;
26998 		} else {
26999 			*EG(return_value_ptr_ptr) = retval_ptr;
27000 			Z_ADDREF_P(retval_ptr);
27001 		}
27002 	} else {
27003 		zval *ret;
27004 
27005 		ALLOC_ZVAL(ret);
27006 		INIT_PZVAL_COPY(ret, retval_ptr);
27007 		*EG(return_value_ptr_ptr) = ret;
27008 	}
27009 
27010 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27011 }
27012 
ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27013 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27014 {
27015 	USE_OPLINE
27016 	zval *retval_ptr;
27017 	zval **retval_ptr_ptr;
27018 
27019 
27020 	SAVE_OPLINE();
27021 
27022 	do {
27023 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
27024 			/* Not supposed to happen, but we'll allow it */
27025 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
27026 
27027 			retval_ptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27028 			if (!EG(return_value_ptr_ptr)) {
27029 				if (IS_CV == IS_TMP_VAR) {
27030 
27031 				}
27032 			} else if (!0) { /* Not a temp var */
27033 				zval *ret;
27034 
27035 				ALLOC_ZVAL(ret);
27036 				INIT_PZVAL_COPY(ret, retval_ptr);
27037 				zval_copy_ctor(ret);
27038 				*EG(return_value_ptr_ptr) = ret;
27039 			} else {
27040 				zval *ret;
27041 
27042 				ALLOC_ZVAL(ret);
27043 				INIT_PZVAL_COPY(ret, retval_ptr);
27044 				*EG(return_value_ptr_ptr) = ret;
27045 			}
27046 			break;
27047 		}
27048 
27049 		retval_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
27050 
27051 		if (IS_CV == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
27052 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
27053 		}
27054 
27055 		if (IS_CV == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
27056 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
27057 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
27058 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
27059 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
27060 				if (EG(return_value_ptr_ptr)) {
27061 					zval *ret;
27062 
27063 					ALLOC_ZVAL(ret);
27064 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
27065 					zval_copy_ctor(ret);
27066 					*EG(return_value_ptr_ptr) = ret;
27067 				}
27068 				break;
27069 			}
27070 		}
27071 
27072 		if (EG(return_value_ptr_ptr)) {
27073 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
27074 			Z_ADDREF_PP(retval_ptr_ptr);
27075 
27076 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
27077 		}
27078 	} while (0);
27079 
27080 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27081 }
27082 
ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27083 static int ZEND_FASTCALL  ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27084 {
27085 	USE_OPLINE
27086 	zval *value;
27087 	zval *exception;
27088 
27089 
27090 	SAVE_OPLINE();
27091 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27092 
27093 	if (IS_CV == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
27094 		zend_error_noreturn(E_ERROR, "Can only throw objects");
27095 	}
27096 	zend_exception_save(TSRMLS_C);
27097 	/* Not sure if a complete copy is what we want here */
27098 	ALLOC_ZVAL(exception);
27099 	INIT_PZVAL_COPY(exception, value);
27100 	if (!0) {
27101 		zval_copy_ctor(exception);
27102 	}
27103 
27104 	zend_throw_exception_object(exception TSRMLS_CC);
27105 	zend_exception_restore(TSRMLS_C);
27106 
27107 	HANDLE_EXCEPTION();
27108 }
27109 
zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS)27110 static int ZEND_FASTCALL zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS)
27111 {
27112 	USE_OPLINE
27113 	zval *varptr;
27114 
27115 	varptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27116 
27117 	if (varptr == &EG(uninitialized_zval)) {
27118 		ALLOC_ZVAL(varptr);
27119 		INIT_ZVAL(*varptr);
27120 		Z_SET_REFCOUNT_P(varptr, 0);
27121 	} else if (PZVAL_IS_REF(varptr)) {
27122 		zval *original_var = varptr;
27123 
27124 		ALLOC_ZVAL(varptr);
27125 		ZVAL_COPY_VALUE(varptr, original_var);
27126 		Z_UNSET_ISREF_P(varptr);
27127 		Z_SET_REFCOUNT_P(varptr, 0);
27128 		zval_copy_ctor(varptr);
27129 	}
27130 	Z_ADDREF_P(varptr);
27131 	zend_vm_stack_push(varptr TSRMLS_CC);
27132 	;  /* for string offsets */
27133 
27134 	CHECK_EXCEPTION();
27135 	ZEND_VM_NEXT_OPCODE();
27136 }
27137 
ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27138 static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27139 {
27140 	USE_OPLINE
27141 	zend_free_op free_op1;
27142 	zval *varptr;
27143 
27144 	SAVE_OPLINE();
27145 	if (opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) { /* Had function_ptr at compile_time */
27146 		if (!(opline->extended_value & ZEND_ARG_SEND_BY_REF)) {
27147 			return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27148 		}
27149 	} else if (!ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
27150 		return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27151 	}
27152 
27153 	if (IS_CV == IS_VAR &&
27154 		(opline->extended_value & ZEND_ARG_SEND_FUNCTION) &&
27155 		EX_T(opline->op1.var).var.fcall_returned_reference &&
27156 		EX_T(opline->op1.var).var.ptr) {
27157 		varptr = EX_T(opline->op1.var).var.ptr;
27158 		PZVAL_UNLOCK_EX(varptr, &free_op1, 0);
27159 	} else {
27160 		varptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27161 	}
27162 	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
27163 	     EX_T(opline->op1.var).var.fcall_returned_reference) &&
27164 	    varptr != &EG(uninitialized_zval) &&
27165 	    (PZVAL_IS_REF(varptr) ||
27166 	     (Z_REFCOUNT_P(varptr) == 1 && (IS_CV == IS_CV || free_op1.var)))) {
27167 		Z_SET_ISREF_P(varptr);
27168 		Z_ADDREF_P(varptr);
27169 		zend_vm_stack_push(varptr TSRMLS_CC);
27170 	} else {
27171 		zval *valptr;
27172 
27173 		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
27174 			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
27175 			!ARG_MAY_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
27176 			zend_error(E_STRICT, "Only variables should be passed by reference");
27177 		}
27178 		ALLOC_ZVAL(valptr);
27179 		INIT_PZVAL_COPY(valptr, varptr);
27180 		if (!0) {
27181 			zval_copy_ctor(valptr);
27182 		}
27183 		zend_vm_stack_push(valptr TSRMLS_CC);
27184 	}
27185 
27186 	CHECK_EXCEPTION();
27187 	ZEND_VM_NEXT_OPCODE();
27188 }
27189 
ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27190 static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27191 {
27192 	USE_OPLINE
27193 
27194 	zval **varptr_ptr;
27195 	zval *varptr;
27196 
27197 	SAVE_OPLINE();
27198 	varptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
27199 
27200 	if (IS_CV == IS_VAR && UNEXPECTED(varptr_ptr == NULL)) {
27201 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
27202 	}
27203 
27204 	if (IS_CV == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
27205 		ALLOC_INIT_ZVAL(varptr);
27206 		zend_vm_stack_push(varptr TSRMLS_CC);
27207 		CHECK_EXCEPTION();
27208 		ZEND_VM_NEXT_OPCODE();
27209 	}
27210 
27211 	if (opline->extended_value == ZEND_DO_FCALL_BY_NAME &&
27212 	    EX(function_state).function->type == ZEND_INTERNAL_FUNCTION &&
27213 	    !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
27214 		return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27215 	}
27216 
27217 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
27218 	varptr = *varptr_ptr;
27219 	Z_ADDREF_P(varptr);
27220 	zend_vm_stack_push(varptr TSRMLS_CC);
27221 
27222 	CHECK_EXCEPTION();
27223 	ZEND_VM_NEXT_OPCODE();
27224 }
27225 
ZEND_SEND_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27226 static int ZEND_FASTCALL  ZEND_SEND_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27227 {
27228 	USE_OPLINE
27229 
27230 	if ((opline->extended_value == ZEND_DO_FCALL_BY_NAME)
27231 		&& ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
27232 		return ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27233 	}
27234 	SAVE_OPLINE();
27235 	return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27236 }
27237 
ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27238 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27239 {
27240 	USE_OPLINE
27241 
27242 	zval *retval = &EX_T(opline->result.var).tmp_var;
27243 
27244 	SAVE_OPLINE();
27245 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
27246 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC)));
27247 
27248 	CHECK_EXCEPTION();
27249 	ZEND_VM_NEXT_OPCODE();
27250 }
27251 
ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27252 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27253 {
27254 	USE_OPLINE
27255 
27256 	zval *obj;
27257 	zend_class_entry *ce;
27258 	zend_function *clone;
27259 	zend_object_clone_obj_t clone_call;
27260 
27261 	SAVE_OPLINE();
27262 	obj = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27263 
27264 	if (IS_CV == IS_CONST ||
27265 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
27266 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
27267 	}
27268 
27269 	ce = Z_OBJCE_P(obj);
27270 	clone = ce ? ce->clone : NULL;
27271 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
27272 	if (UNEXPECTED(clone_call == NULL)) {
27273 		if (ce) {
27274 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
27275 		} else {
27276 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
27277 		}
27278 	}
27279 
27280 	if (ce && clone) {
27281 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
27282 			/* Ensure that if we're calling a private function, we're allowed to do so.
27283 			 */
27284 			if (UNEXPECTED(ce != EG(scope))) {
27285 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
27286 			}
27287 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
27288 			/* Ensure that if we're calling a protected function, we're allowed to do so.
27289 			 */
27290 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
27291 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
27292 			}
27293 		}
27294 	}
27295 
27296 	if (EXPECTED(EG(exception) == NULL)) {
27297 		zval *retval;
27298 
27299 		ALLOC_ZVAL(retval);
27300 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
27301 		Z_TYPE_P(retval) = IS_OBJECT;
27302 		Z_SET_REFCOUNT_P(retval, 1);
27303 		Z_SET_ISREF_P(retval);
27304 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
27305 			zval_ptr_dtor(&retval);
27306 		} else {
27307 			AI_SET_PTR(&EX_T(opline->result.var), retval);
27308 		}
27309 	}
27310 
27311 	CHECK_EXCEPTION();
27312 	ZEND_VM_NEXT_OPCODE();
27313 }
27314 
ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27315 static int ZEND_FASTCALL  ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27316 {
27317 	USE_OPLINE
27318 
27319 	zval *expr;
27320 	zval *result = &EX_T(opline->result.var).tmp_var;
27321 
27322 	SAVE_OPLINE();
27323 	expr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27324 
27325 	if (opline->extended_value != IS_STRING) {
27326 		ZVAL_COPY_VALUE(result, expr);
27327 		if (!0) {
27328 			zendi_zval_copy_ctor(*result);
27329 		}
27330 	}
27331 	switch (opline->extended_value) {
27332 		case IS_NULL:
27333 			convert_to_null(result);
27334 			break;
27335 		case IS_BOOL:
27336 			convert_to_boolean(result);
27337 			break;
27338 		case IS_LONG:
27339 			convert_to_long(result);
27340 			break;
27341 		case IS_DOUBLE:
27342 			convert_to_double(result);
27343 			break;
27344 		case IS_STRING: {
27345 			zval var_copy;
27346 			int use_copy;
27347 
27348 			zend_make_printable_zval(expr, &var_copy, &use_copy);
27349 			if (use_copy) {
27350 				ZVAL_COPY_VALUE(result, &var_copy);
27351 				if (0) {
27352 
27353 				}
27354 			} else {
27355 				ZVAL_COPY_VALUE(result, expr);
27356 				if (!0) {
27357 					zendi_zval_copy_ctor(*result);
27358 				}
27359 			}
27360 			break;
27361 		}
27362 		case IS_ARRAY:
27363 			convert_to_array(result);
27364 			break;
27365 		case IS_OBJECT:
27366 			convert_to_object(result);
27367 			break;
27368 	}
27369 
27370 	CHECK_EXCEPTION();
27371 	ZEND_VM_NEXT_OPCODE();
27372 }
27373 
ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27374 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27375 {
27376 	USE_OPLINE
27377 	zend_op_array *new_op_array=NULL;
27378 
27379 	zval *inc_filename;
27380     zval *tmp_inc_filename = NULL;
27381 	zend_bool failure_retval=0;
27382 
27383 	SAVE_OPLINE();
27384 	inc_filename = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27385 
27386 	if (inc_filename->type!=IS_STRING) {
27387 		MAKE_STD_ZVAL(tmp_inc_filename);
27388 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
27389 		zval_copy_ctor(tmp_inc_filename);
27390 		convert_to_string(tmp_inc_filename);
27391 		inc_filename = tmp_inc_filename;
27392 	}
27393 
27394 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
27395 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
27396 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
27397 		} else {
27398 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
27399 		}
27400 	} else {
27401 		switch (opline->extended_value) {
27402 			case ZEND_INCLUDE_ONCE:
27403 			case ZEND_REQUIRE_ONCE: {
27404 					zend_file_handle file_handle;
27405 					char *resolved_path;
27406 
27407 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
27408 					if (resolved_path) {
27409 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
27410 					} else {
27411 						resolved_path = Z_STRVAL_P(inc_filename);
27412 					}
27413 
27414 					if (failure_retval) {
27415 						/* do nothing, file already included */
27416 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
27417 
27418 						if (!file_handle.opened_path) {
27419 							file_handle.opened_path = estrdup(resolved_path);
27420 						}
27421 
27422 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
27423 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
27424 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
27425 						} else {
27426 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
27427 							failure_retval=1;
27428 						}
27429 					} else {
27430 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
27431 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
27432 						} else {
27433 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
27434 						}
27435 					}
27436 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
27437 						efree(resolved_path);
27438 					}
27439 				}
27440 				break;
27441 			case ZEND_INCLUDE:
27442 			case ZEND_REQUIRE:
27443 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
27444 				break;
27445 			case ZEND_EVAL: {
27446 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
27447 
27448 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
27449 					efree(eval_desc);
27450 				}
27451 				break;
27452 			EMPTY_SWITCH_DEFAULT_CASE()
27453 		}
27454 	}
27455 	if (tmp_inc_filename) {
27456 		zval_ptr_dtor(&tmp_inc_filename);
27457 	}
27458 
27459 	if (UNEXPECTED(EG(exception) != NULL)) {
27460 		HANDLE_EXCEPTION();
27461 	} else if (EXPECTED(new_op_array != NULL)) {
27462 		EX(original_return_value) = EG(return_value_ptr_ptr);
27463 		EG(active_op_array) = new_op_array;
27464 		if (RETURN_VALUE_USED(opline)) {
27465 			EX_T(opline->result.var).var.ptr = NULL;
27466 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27467 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
27468 		} else {
27469 			EG(return_value_ptr_ptr) = NULL;
27470 		}
27471 
27472 		EX(current_object) = EX(object);
27473 
27474 		EX(function_state).function = (zend_function *) new_op_array;
27475 		EX(object) = NULL;
27476 
27477 		if (!EG(active_symbol_table)) {
27478 			zend_rebuild_symbol_table(TSRMLS_C);
27479 		}
27480 
27481 		if (EXPECTED(zend_execute == execute)) {
27482 			ZEND_VM_ENTER();
27483 		} else {
27484 			zend_execute(new_op_array TSRMLS_CC);
27485 		}
27486 
27487 		EX(function_state).function = (zend_function *) EX(op_array);
27488 		EX(object) = EX(current_object);
27489 
27490 		EG(opline_ptr) = &EX(opline);
27491 		EG(active_op_array) = EX(op_array);
27492 		EG(return_value_ptr_ptr) = EX(original_return_value);
27493 		destroy_op_array(new_op_array TSRMLS_CC);
27494 		efree(new_op_array);
27495 		if (UNEXPECTED(EG(exception) != NULL)) {
27496 			zend_throw_exception_internal(NULL TSRMLS_CC);
27497 			HANDLE_EXCEPTION();
27498 		} else if (RETURN_VALUE_USED(opline)) {
27499 			if (!EX_T(opline->result.var).var.ptr) { /* there was no return statement */
27500 				zval *retval;
27501 
27502 				ALLOC_ZVAL(retval);
27503 				ZVAL_BOOL(retval, 1);
27504 				INIT_PZVAL(retval);
27505 				EX_T(opline->result.var).var.ptr = retval;
27506 			}
27507 		}
27508 
27509 	} else if (RETURN_VALUE_USED(opline)) {
27510 		zval *retval;
27511 
27512 		ALLOC_ZVAL(retval);
27513 		ZVAL_BOOL(retval, failure_retval);
27514 		INIT_PZVAL(retval);
27515 		AI_SET_PTR(&EX_T(opline->result.var), retval);
27516 	}
27517 	ZEND_VM_NEXT_OPCODE();
27518 }
27519 
ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27520 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27521 {
27522 	USE_OPLINE
27523 
27524 	zval *array_ptr, **array_ptr_ptr;
27525 	HashTable *fe_ht;
27526 	zend_object_iterator *iter = NULL;
27527 	zend_class_entry *ce = NULL;
27528 	zend_bool is_empty = 0;
27529 
27530 	SAVE_OPLINE();
27531 
27532 	if ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
27533 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
27534 		array_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27535 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
27536 			MAKE_STD_ZVAL(array_ptr);
27537 			ZVAL_NULL(array_ptr);
27538 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
27539 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
27540 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
27541 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
27542 			}
27543 
27544 			ce = Z_OBJCE_PP(array_ptr_ptr);
27545 			if (!ce || ce->get_iterator == NULL) {
27546 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
27547 				Z_ADDREF_PP(array_ptr_ptr);
27548 			}
27549 			array_ptr = *array_ptr_ptr;
27550 		} else {
27551 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
27552 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
27553 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
27554 					Z_SET_ISREF_PP(array_ptr_ptr);
27555 				}
27556 			}
27557 			array_ptr = *array_ptr_ptr;
27558 			Z_ADDREF_P(array_ptr);
27559 		}
27560 	} else {
27561 		array_ptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27562 		if (0) { /* IS_TMP_VAR */
27563 			zval *tmp;
27564 
27565 			ALLOC_ZVAL(tmp);
27566 			INIT_PZVAL_COPY(tmp, array_ptr);
27567 			array_ptr = tmp;
27568 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
27569 				ce = Z_OBJCE_P(array_ptr);
27570 				if (ce && ce->get_iterator) {
27571 					Z_DELREF_P(array_ptr);
27572 				}
27573 			}
27574 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
27575 			ce = Z_OBJCE_P(array_ptr);
27576 			if (!ce || !ce->get_iterator) {
27577 				Z_ADDREF_P(array_ptr);
27578 			}
27579 		} else if (IS_CV == IS_CONST ||
27580 		           ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
27581 		            !Z_ISREF_P(array_ptr) &&
27582 		            Z_REFCOUNT_P(array_ptr) > 1)) {
27583 			zval *tmp;
27584 
27585 			ALLOC_ZVAL(tmp);
27586 			INIT_PZVAL_COPY(tmp, array_ptr);
27587 			zval_copy_ctor(tmp);
27588 			array_ptr = tmp;
27589 		} else {
27590 			Z_ADDREF_P(array_ptr);
27591 		}
27592 	}
27593 
27594 	if (ce && ce->get_iterator) {
27595 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
27596 
27597 		if (iter && EXPECTED(EG(exception) == NULL)) {
27598 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
27599 		} else {
27600 
27601 			if (!EG(exception)) {
27602 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
27603 			}
27604 			zend_throw_exception_internal(NULL TSRMLS_CC);
27605 			HANDLE_EXCEPTION();
27606 		}
27607 	}
27608 
27609 	EX_T(opline->result.var).fe.ptr = array_ptr;
27610 
27611 	if (iter) {
27612 		iter->index = 0;
27613 		if (iter->funcs->rewind) {
27614 			iter->funcs->rewind(iter TSRMLS_CC);
27615 			if (UNEXPECTED(EG(exception) != NULL)) {
27616 				zval_ptr_dtor(&array_ptr);
27617 
27618 				HANDLE_EXCEPTION();
27619 			}
27620 		}
27621 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
27622 		if (UNEXPECTED(EG(exception) != NULL)) {
27623 			zval_ptr_dtor(&array_ptr);
27624 
27625 			HANDLE_EXCEPTION();
27626 		}
27627 		iter->index = -1; /* will be set to 0 before using next handler */
27628 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
27629 		zend_hash_internal_pointer_reset(fe_ht);
27630 		if (ce) {
27631 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
27632 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
27633 				char *str_key;
27634 				uint str_key_len;
27635 				ulong int_key;
27636 				zend_uchar key_type;
27637 
27638 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
27639 				if (key_type != HASH_KEY_NON_EXISTANT &&
27640 					(key_type == HASH_KEY_IS_LONG ||
27641 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
27642 					break;
27643 				}
27644 				zend_hash_move_forward(fe_ht);
27645 			}
27646 		}
27647 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
27648 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
27649 	} else {
27650 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
27651 		is_empty = 1;
27652 	}
27653 
27654 	if (is_empty) {
27655 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
27656 	} else {
27657 		CHECK_EXCEPTION();
27658 		ZEND_VM_NEXT_OPCODE();
27659 	}
27660 }
27661 
ZEND_EXIT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27662 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27663 {
27664 #if 0 || (IS_CV != IS_UNUSED)
27665 	USE_OPLINE
27666 
27667 	SAVE_OPLINE();
27668 	if (IS_CV != IS_UNUSED) {
27669 
27670 		zval *ptr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27671 
27672 		if (Z_TYPE_P(ptr) == IS_LONG) {
27673 			EG(exit_status) = Z_LVAL_P(ptr);
27674 		} else {
27675 			zend_print_variable(ptr);
27676 		}
27677 
27678 	}
27679 #endif
27680 	zend_bailout();
27681 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
27682 }
27683 
ZEND_JMP_SET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27684 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27685 {
27686 	USE_OPLINE
27687 
27688 	zval *value;
27689 
27690 	SAVE_OPLINE();
27691 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27692 
27693 	if (i_zend_is_true(value)) {
27694 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
27695 		if (!0) {
27696 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
27697 		}
27698 
27699 #if DEBUG_ZEND>=2
27700 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
27701 #endif
27702 		ZEND_VM_JMP(opline->op2.jmp_addr);
27703 	}
27704 
27705 	CHECK_EXCEPTION();
27706 	ZEND_VM_NEXT_OPCODE();
27707 }
27708 
ZEND_JMP_SET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27709 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27710 {
27711 	USE_OPLINE
27712 
27713 	zval *value, *ret;
27714 
27715 	SAVE_OPLINE();
27716 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27717 
27718 	if (i_zend_is_true(value)) {
27719 		if (IS_CV == IS_VAR || IS_CV == IS_CV) {
27720 			Z_ADDREF_P(value);
27721 			EX_T(opline->result.var).var.ptr = value;
27722 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27723 		} else {
27724 			ALLOC_ZVAL(ret);
27725 			INIT_PZVAL_COPY(ret, value);
27726 			EX_T(opline->result.var).var.ptr = ret;
27727 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27728 			if (!0) {
27729 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
27730 			}
27731 		}
27732 
27733 #if DEBUG_ZEND>=2
27734 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
27735 #endif
27736 		ZEND_VM_JMP(opline->op2.jmp_addr);
27737 	}
27738 
27739 	CHECK_EXCEPTION();
27740 	ZEND_VM_NEXT_OPCODE();
27741 }
27742 
ZEND_QM_ASSIGN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27743 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27744 {
27745 	USE_OPLINE
27746 
27747 	zval *value;
27748 
27749 	SAVE_OPLINE();
27750 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27751 
27752 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
27753 	if (!0) {
27754 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
27755 	}
27756 
27757 	CHECK_EXCEPTION();
27758 	ZEND_VM_NEXT_OPCODE();
27759 }
27760 
ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27761 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27762 {
27763 	USE_OPLINE
27764 
27765 	zval *value, *ret;
27766 
27767 	SAVE_OPLINE();
27768 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27769 
27770 	if (IS_CV == IS_VAR || IS_CV == IS_CV) {
27771 		Z_ADDREF_P(value);
27772 		EX_T(opline->result.var).var.ptr = value;
27773 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27774 	} else {
27775 		ALLOC_ZVAL(ret);
27776 		INIT_PZVAL_COPY(ret, value);
27777 		EX_T(opline->result.var).var.ptr = ret;
27778 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27779 		if (!0) {
27780 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
27781 		}
27782 	}
27783 
27784 	CHECK_EXCEPTION();
27785 	ZEND_VM_NEXT_OPCODE();
27786 }
27787 
ZEND_INSTANCEOF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27788 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27789 {
27790 	USE_OPLINE
27791 
27792 	zval *expr;
27793 	zend_bool result;
27794 
27795 	SAVE_OPLINE();
27796 	expr = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
27797 
27798 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
27799 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
27800 	} else {
27801 		result = 0;
27802 	}
27803 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
27804 
27805 	CHECK_EXCEPTION();
27806 	ZEND_VM_NEXT_OPCODE();
27807 }
27808 
ZEND_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27809 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27810 {
27811 	USE_OPLINE
27812 
27813 
27814 	SAVE_OPLINE();
27815 	fast_add_function(&EX_T(opline->result.var).tmp_var,
27816 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27817 		opline->op2.zv TSRMLS_CC);
27818 
27819 
27820 	CHECK_EXCEPTION();
27821 	ZEND_VM_NEXT_OPCODE();
27822 }
27823 
ZEND_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27824 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27825 {
27826 	USE_OPLINE
27827 
27828 
27829 	SAVE_OPLINE();
27830 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
27831 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27832 		opline->op2.zv TSRMLS_CC);
27833 
27834 
27835 	CHECK_EXCEPTION();
27836 	ZEND_VM_NEXT_OPCODE();
27837 }
27838 
ZEND_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27839 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27840 {
27841 	USE_OPLINE
27842 
27843 
27844 	SAVE_OPLINE();
27845 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
27846 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27847 		opline->op2.zv TSRMLS_CC);
27848 
27849 
27850 	CHECK_EXCEPTION();
27851 	ZEND_VM_NEXT_OPCODE();
27852 }
27853 
ZEND_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27854 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27855 {
27856 	USE_OPLINE
27857 
27858 
27859 	SAVE_OPLINE();
27860 	fast_div_function(&EX_T(opline->result.var).tmp_var,
27861 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27862 		opline->op2.zv TSRMLS_CC);
27863 
27864 
27865 	CHECK_EXCEPTION();
27866 	ZEND_VM_NEXT_OPCODE();
27867 }
27868 
ZEND_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27869 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27870 {
27871 	USE_OPLINE
27872 
27873 
27874 	SAVE_OPLINE();
27875 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
27876 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27877 		opline->op2.zv TSRMLS_CC);
27878 
27879 
27880 	CHECK_EXCEPTION();
27881 	ZEND_VM_NEXT_OPCODE();
27882 }
27883 
ZEND_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27884 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27885 {
27886 	USE_OPLINE
27887 
27888 
27889 	SAVE_OPLINE();
27890 	shift_left_function(&EX_T(opline->result.var).tmp_var,
27891 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27892 		opline->op2.zv TSRMLS_CC);
27893 
27894 
27895 	CHECK_EXCEPTION();
27896 	ZEND_VM_NEXT_OPCODE();
27897 }
27898 
ZEND_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27899 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27900 {
27901 	USE_OPLINE
27902 
27903 
27904 	SAVE_OPLINE();
27905 	shift_right_function(&EX_T(opline->result.var).tmp_var,
27906 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27907 		opline->op2.zv TSRMLS_CC);
27908 
27909 
27910 	CHECK_EXCEPTION();
27911 	ZEND_VM_NEXT_OPCODE();
27912 }
27913 
ZEND_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27914 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27915 {
27916 	USE_OPLINE
27917 
27918 
27919 	SAVE_OPLINE();
27920 	concat_function(&EX_T(opline->result.var).tmp_var,
27921 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27922 		opline->op2.zv TSRMLS_CC);
27923 
27924 
27925 	CHECK_EXCEPTION();
27926 	ZEND_VM_NEXT_OPCODE();
27927 }
27928 
ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27929 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27930 {
27931 	USE_OPLINE
27932 
27933 
27934 	SAVE_OPLINE();
27935 	is_identical_function(&EX_T(opline->result.var).tmp_var,
27936 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27937 		opline->op2.zv TSRMLS_CC);
27938 
27939 
27940 	CHECK_EXCEPTION();
27941 	ZEND_VM_NEXT_OPCODE();
27942 }
27943 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27944 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27945 {
27946 	USE_OPLINE
27947 
27948 	zval *result = &EX_T(opline->result.var).tmp_var;
27949 
27950 	SAVE_OPLINE();
27951 	is_identical_function(result,
27952 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27953 		opline->op2.zv TSRMLS_CC);
27954 	Z_LVAL_P(result) = !Z_LVAL_P(result);
27955 
27956 
27957 	CHECK_EXCEPTION();
27958 	ZEND_VM_NEXT_OPCODE();
27959 }
27960 
ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27961 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27962 {
27963 	USE_OPLINE
27964 
27965 	zval *result = &EX_T(opline->result.var).tmp_var;
27966 
27967 	SAVE_OPLINE();
27968 	ZVAL_BOOL(result, fast_equal_function(result,
27969 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27970 		opline->op2.zv TSRMLS_CC));
27971 
27972 
27973 	CHECK_EXCEPTION();
27974 	ZEND_VM_NEXT_OPCODE();
27975 }
27976 
ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27977 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27978 {
27979 	USE_OPLINE
27980 
27981 	zval *result = &EX_T(opline->result.var).tmp_var;
27982 
27983 	SAVE_OPLINE();
27984 	ZVAL_BOOL(result, fast_not_equal_function(result,
27985 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
27986 		opline->op2.zv TSRMLS_CC));
27987 
27988 
27989 	CHECK_EXCEPTION();
27990 	ZEND_VM_NEXT_OPCODE();
27991 }
27992 
ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27993 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27994 {
27995 	USE_OPLINE
27996 
27997 	zval *result = &EX_T(opline->result.var).tmp_var;
27998 
27999 	SAVE_OPLINE();
28000 	ZVAL_BOOL(result, fast_is_smaller_function(result,
28001 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28002 		opline->op2.zv TSRMLS_CC));
28003 
28004 
28005 	CHECK_EXCEPTION();
28006 	ZEND_VM_NEXT_OPCODE();
28007 }
28008 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28009 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28010 {
28011 	USE_OPLINE
28012 
28013 	zval *result = &EX_T(opline->result.var).tmp_var;
28014 
28015 	SAVE_OPLINE();
28016 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
28017 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28018 		opline->op2.zv TSRMLS_CC));
28019 
28020 
28021 	CHECK_EXCEPTION();
28022 	ZEND_VM_NEXT_OPCODE();
28023 }
28024 
ZEND_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28025 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28026 {
28027 	USE_OPLINE
28028 
28029 
28030 	SAVE_OPLINE();
28031 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
28032 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28033 		opline->op2.zv TSRMLS_CC);
28034 
28035 
28036 	CHECK_EXCEPTION();
28037 	ZEND_VM_NEXT_OPCODE();
28038 }
28039 
ZEND_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28040 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28041 {
28042 	USE_OPLINE
28043 
28044 
28045 	SAVE_OPLINE();
28046 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
28047 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28048 		opline->op2.zv TSRMLS_CC);
28049 
28050 
28051 	CHECK_EXCEPTION();
28052 	ZEND_VM_NEXT_OPCODE();
28053 }
28054 
ZEND_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28055 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28056 {
28057 	USE_OPLINE
28058 
28059 
28060 	SAVE_OPLINE();
28061 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
28062 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28063 		opline->op2.zv TSRMLS_CC);
28064 
28065 
28066 	CHECK_EXCEPTION();
28067 	ZEND_VM_NEXT_OPCODE();
28068 }
28069 
ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28070 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28071 {
28072 	USE_OPLINE
28073 
28074 
28075 	SAVE_OPLINE();
28076 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
28077 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
28078 		opline->op2.zv TSRMLS_CC);
28079 
28080 
28081 	CHECK_EXCEPTION();
28082 	ZEND_VM_NEXT_OPCODE();
28083 }
28084 
zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28085 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28086 {
28087 	USE_OPLINE
28088 	zend_free_op free_op_data1;
28089 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28090 	zval *object;
28091 	zval *property = opline->op2.zv;
28092 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
28093 	int have_get_ptr = 0;
28094 
28095 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
28096 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
28097 	}
28098 
28099 	make_real_object(object_ptr TSRMLS_CC);
28100 	object = *object_ptr;
28101 
28102 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
28103 		zend_error(E_WARNING, "Attempt to assign property of non-object");
28104 
28105 		FREE_OP(free_op_data1);
28106 
28107 		if (RETURN_VALUE_USED(opline)) {
28108 			PZVAL_LOCK(&EG(uninitialized_zval));
28109 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28110 			EX_T(opline->result.var).var.ptr_ptr = NULL;
28111 		}
28112 	} else {
28113 		/* here we are sure we are dealing with an object */
28114 		if (0) {
28115 			MAKE_REAL_ZVAL_PTR(property);
28116 		}
28117 
28118 		/* here property is a string */
28119 		if (opline->extended_value == ZEND_ASSIGN_OBJ
28120 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
28121 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28122 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
28123 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
28124 
28125 				have_get_ptr = 1;
28126 				binary_op(*zptr, *zptr, value TSRMLS_CC);
28127 				if (RETURN_VALUE_USED(opline)) {
28128 					PZVAL_LOCK(*zptr);
28129 					EX_T(opline->result.var).var.ptr = *zptr;
28130 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28131 				}
28132 			}
28133 		}
28134 
28135 		if (!have_get_ptr) {
28136 			zval *z = NULL;
28137 
28138 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28139 				if (Z_OBJ_HT_P(object)->read_property) {
28140 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28141 				}
28142 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28143 				if (Z_OBJ_HT_P(object)->read_dimension) {
28144 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
28145 				}
28146 			}
28147 			if (z) {
28148 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
28149 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
28150 
28151 					if (Z_REFCOUNT_P(z) == 0) {
28152 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
28153 						zval_dtor(z);
28154 						FREE_ZVAL(z);
28155 					}
28156 					z = value;
28157 				}
28158 				Z_ADDREF_P(z);
28159 				SEPARATE_ZVAL_IF_NOT_REF(&z);
28160 				binary_op(z, z, value TSRMLS_CC);
28161 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28162 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28163 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28164 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
28165 				}
28166 				if (RETURN_VALUE_USED(opline)) {
28167 					PZVAL_LOCK(z);
28168 					EX_T(opline->result.var).var.ptr = z;
28169 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28170 				}
28171 				zval_ptr_dtor(&z);
28172 			} else {
28173 				zend_error(E_WARNING, "Attempt to assign property of non-object");
28174 				if (RETURN_VALUE_USED(opline)) {
28175 					PZVAL_LOCK(&EG(uninitialized_zval));
28176 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28177 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28178 				}
28179 			}
28180 		}
28181 
28182 		if (0) {
28183 			zval_ptr_dtor(&property);
28184 		} else {
28185 
28186 		}
28187 		FREE_OP(free_op_data1);
28188 	}
28189 
28190 	/* assign_obj has two opcodes! */
28191 	CHECK_EXCEPTION();
28192 	ZEND_VM_INC_OPCODE();
28193 	ZEND_VM_NEXT_OPCODE();
28194 }
28195 
zend_binary_assign_op_helper_SPEC_CV_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28196 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28197 {
28198 	USE_OPLINE
28199 	zend_free_op free_op_data2, free_op_data1;
28200 	zval **var_ptr;
28201 	zval *value;
28202 
28203 	SAVE_OPLINE();
28204 	switch (opline->extended_value) {
28205 		case ZEND_ASSIGN_OBJ:
28206 			return zend_binary_assign_op_obj_helper_SPEC_CV_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28207 			break;
28208 		case ZEND_ASSIGN_DIM: {
28209 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28210 
28211 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28212 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28213 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
28214 					if (IS_CV == IS_VAR && !0) {
28215 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
28216 					}
28217 					return zend_binary_assign_op_obj_helper_SPEC_CV_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28218 				} else {
28219 					zval *dim = opline->op2.zv;
28220 
28221 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
28222 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
28223 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
28224 				}
28225 			}
28226 			break;
28227 		default:
28228 			value = opline->op2.zv;
28229 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28230 			/* do nothing */
28231 			break;
28232 	}
28233 
28234 	if (UNEXPECTED(var_ptr == NULL)) {
28235 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
28236 	}
28237 
28238 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
28239 		if (RETURN_VALUE_USED(opline)) {
28240 			PZVAL_LOCK(&EG(uninitialized_zval));
28241 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
28242 		}
28243 
28244 
28245 		CHECK_EXCEPTION();
28246 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
28247 			ZEND_VM_INC_OPCODE();
28248 		}
28249 		ZEND_VM_NEXT_OPCODE();
28250 	}
28251 
28252 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
28253 
28254 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
28255 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
28256 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
28257 		/* proxy object */
28258 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
28259 		Z_ADDREF_P(objval);
28260 		binary_op(objval, objval, value TSRMLS_CC);
28261 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
28262 		zval_ptr_dtor(&objval);
28263 	} else {
28264 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
28265 	}
28266 
28267 	if (RETURN_VALUE_USED(opline)) {
28268 		PZVAL_LOCK(*var_ptr);
28269 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
28270 	}
28271 
28272 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
28273 		FREE_OP(free_op_data1);
28274 		FREE_OP_VAR_PTR(free_op_data2);
28275 
28276 		CHECK_EXCEPTION();
28277 		ZEND_VM_INC_OPCODE();
28278 	} else {
28279 
28280 		CHECK_EXCEPTION();
28281 	}
28282 	ZEND_VM_NEXT_OPCODE();
28283 }
28284 
ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28285 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28286 {
28287 	return zend_binary_assign_op_helper_SPEC_CV_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28288 }
28289 
ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28290 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28291 {
28292 	return zend_binary_assign_op_helper_SPEC_CV_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28293 }
28294 
ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28295 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28296 {
28297 	return zend_binary_assign_op_helper_SPEC_CV_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28298 }
28299 
ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28300 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28301 {
28302 	return zend_binary_assign_op_helper_SPEC_CV_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28303 }
28304 
ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28305 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28306 {
28307 	return zend_binary_assign_op_helper_SPEC_CV_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28308 }
28309 
ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28310 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28311 {
28312 	return zend_binary_assign_op_helper_SPEC_CV_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28313 }
28314 
ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28315 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28316 {
28317 	return zend_binary_assign_op_helper_SPEC_CV_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28318 }
28319 
ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28320 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28321 {
28322 	return zend_binary_assign_op_helper_SPEC_CV_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28323 }
28324 
ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28325 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28326 {
28327 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28328 }
28329 
ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28330 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28331 {
28332 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28333 }
28334 
ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28335 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28336 {
28337 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28338 }
28339 
zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)28340 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
28341 {
28342 	USE_OPLINE
28343 
28344 	zval **object_ptr;
28345 	zval *object;
28346 	zval *property;
28347 	zval **retval;
28348 	int have_get_ptr = 0;
28349 
28350 	SAVE_OPLINE();
28351 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28352 	property = opline->op2.zv;
28353 	retval = &EX_T(opline->result.var).var.ptr;
28354 
28355 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
28356 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
28357 	}
28358 
28359 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
28360 	object = *object_ptr;
28361 
28362 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
28363 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
28364 
28365 		if (RETURN_VALUE_USED(opline)) {
28366 			PZVAL_LOCK(&EG(uninitialized_zval));
28367 			*retval = &EG(uninitialized_zval);
28368 		}
28369 
28370 		CHECK_EXCEPTION();
28371 		ZEND_VM_NEXT_OPCODE();
28372 	}
28373 
28374 	/* here we are sure we are dealing with an object */
28375 
28376 	if (0) {
28377 		MAKE_REAL_ZVAL_PTR(property);
28378 	}
28379 
28380 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
28381 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28382 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
28383 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
28384 
28385 			have_get_ptr = 1;
28386 			incdec_op(*zptr);
28387 			if (RETURN_VALUE_USED(opline)) {
28388 				*retval = *zptr;
28389 				PZVAL_LOCK(*retval);
28390 			}
28391 		}
28392 	}
28393 
28394 	if (!have_get_ptr) {
28395 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
28396 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28397 
28398 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
28399 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
28400 
28401 				if (Z_REFCOUNT_P(z) == 0) {
28402 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
28403 					zval_dtor(z);
28404 					FREE_ZVAL(z);
28405 				}
28406 				z = value;
28407 			}
28408 			Z_ADDREF_P(z);
28409 			SEPARATE_ZVAL_IF_NOT_REF(&z);
28410 			incdec_op(z);
28411 			*retval = z;
28412 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28413 			SELECTIVE_PZVAL_LOCK(*retval, opline);
28414 			zval_ptr_dtor(&z);
28415 		} else {
28416 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
28417 			if (RETURN_VALUE_USED(opline)) {
28418 				PZVAL_LOCK(&EG(uninitialized_zval));
28419 				*retval = &EG(uninitialized_zval);
28420 			}
28421 		}
28422 	}
28423 
28424 	if (0) {
28425 		zval_ptr_dtor(&property);
28426 	} else {
28427 
28428 	}
28429 
28430 	CHECK_EXCEPTION();
28431 	ZEND_VM_NEXT_OPCODE();
28432 }
28433 
ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28434 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28435 {
28436 	return zend_pre_incdec_property_helper_SPEC_CV_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28437 }
28438 
ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28439 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28440 {
28441 	return zend_pre_incdec_property_helper_SPEC_CV_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28442 }
28443 
zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)28444 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
28445 {
28446 	USE_OPLINE
28447 
28448 	zval **object_ptr;
28449 	zval *object;
28450 	zval *property;
28451 	zval *retval;
28452 	int have_get_ptr = 0;
28453 
28454 	SAVE_OPLINE();
28455 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28456 	property = opline->op2.zv;
28457 	retval = &EX_T(opline->result.var).tmp_var;
28458 
28459 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
28460 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
28461 	}
28462 
28463 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
28464 	object = *object_ptr;
28465 
28466 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
28467 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
28468 
28469 		ZVAL_NULL(retval);
28470 
28471 		CHECK_EXCEPTION();
28472 		ZEND_VM_NEXT_OPCODE();
28473 	}
28474 
28475 	/* here we are sure we are dealing with an object */
28476 
28477 	if (0) {
28478 		MAKE_REAL_ZVAL_PTR(property);
28479 	}
28480 
28481 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
28482 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28483 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
28484 			have_get_ptr = 1;
28485 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
28486 
28487 			ZVAL_COPY_VALUE(retval, *zptr);
28488 			zendi_zval_copy_ctor(*retval);
28489 
28490 			incdec_op(*zptr);
28491 
28492 		}
28493 	}
28494 
28495 	if (!have_get_ptr) {
28496 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
28497 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28498 			zval *z_copy;
28499 
28500 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
28501 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
28502 
28503 				if (Z_REFCOUNT_P(z) == 0) {
28504 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
28505 					zval_dtor(z);
28506 					FREE_ZVAL(z);
28507 				}
28508 				z = value;
28509 			}
28510 			ZVAL_COPY_VALUE(retval, z);
28511 			zendi_zval_copy_ctor(*retval);
28512 			ALLOC_ZVAL(z_copy);
28513 			INIT_PZVAL_COPY(z_copy, z);
28514 			zendi_zval_copy_ctor(*z_copy);
28515 			incdec_op(z_copy);
28516 			Z_ADDREF_P(z);
28517 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28518 			zval_ptr_dtor(&z_copy);
28519 			zval_ptr_dtor(&z);
28520 		} else {
28521 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
28522 			ZVAL_NULL(retval);
28523 		}
28524 	}
28525 
28526 	if (0) {
28527 		zval_ptr_dtor(&property);
28528 	} else {
28529 
28530 	}
28531 
28532 	CHECK_EXCEPTION();
28533 	ZEND_VM_NEXT_OPCODE();
28534 }
28535 
ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28536 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28537 {
28538 	return zend_post_incdec_property_helper_SPEC_CV_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28539 }
28540 
ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28541 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28542 {
28543 	return zend_post_incdec_property_helper_SPEC_CV_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28544 }
28545 
zend_fetch_var_address_helper_SPEC_CV_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)28546 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
28547 {
28548 	USE_OPLINE
28549 	zend_free_op free_op1;
28550 	zval *varname;
28551 	zval **retval;
28552 	zval tmp_varname;
28553 	HashTable *target_symbol_table;
28554 	ulong hash_value;
28555 
28556 	SAVE_OPLINE();
28557 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
28558 
28559  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
28560 		ZVAL_COPY_VALUE(&tmp_varname, varname);
28561 		zval_copy_ctor(&tmp_varname);
28562 		Z_SET_REFCOUNT(tmp_varname, 1);
28563 		Z_UNSET_ISREF(tmp_varname);
28564 		convert_to_string(&tmp_varname);
28565 		varname = &tmp_varname;
28566 	}
28567 
28568 	if (IS_CONST != IS_UNUSED) {
28569 		zend_class_entry *ce;
28570 
28571 		if (IS_CONST == IS_CONST) {
28572 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
28573 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
28574 			} else {
28575 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
28576 				if (UNEXPECTED(ce == NULL)) {
28577 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
28578 						zval_dtor(&tmp_varname);
28579 					}
28580 
28581 					CHECK_EXCEPTION();
28582 					ZEND_VM_NEXT_OPCODE();
28583 				}
28584 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
28585 			}
28586 		} else {
28587 			ce = EX_T(opline->op2.var).class_entry;
28588 		}
28589 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
28590 
28591 	} else {
28592 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
28593 /*
28594 		if (!target_symbol_table) {
28595 			CHECK_EXCEPTION();
28596 			ZEND_VM_NEXT_OPCODE();
28597 		}
28598 */
28599 		if (IS_CV == IS_CONST) {
28600 			hash_value = Z_HASH_P(varname);
28601 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
28602 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
28603 		} else {
28604 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
28605 		}
28606 
28607 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
28608 			switch (type) {
28609 				case BP_VAR_R:
28610 				case BP_VAR_UNSET:
28611 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
28612 					/* break missing intentionally */
28613 				case BP_VAR_IS:
28614 					retval = &EG(uninitialized_zval_ptr);
28615 					break;
28616 				case BP_VAR_RW:
28617 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
28618 					/* break missing intentionally */
28619 				case BP_VAR_W:
28620 					Z_ADDREF_P(&EG(uninitialized_zval));
28621 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
28622 					break;
28623 				EMPTY_SWITCH_DEFAULT_CASE()
28624 			}
28625 		}
28626 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
28627 			case ZEND_FETCH_GLOBAL:
28628 				if (IS_CV != IS_TMP_VAR) {
28629 
28630 				}
28631 				break;
28632 			case ZEND_FETCH_LOCAL:
28633 
28634 				break;
28635 			case ZEND_FETCH_STATIC:
28636 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
28637 				break;
28638 			case ZEND_FETCH_GLOBAL_LOCK:
28639 				if (IS_CV == IS_VAR && !free_op1.var) {
28640 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
28641 				}
28642 				break;
28643 		}
28644 	}
28645 
28646 
28647 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
28648 		zval_dtor(&tmp_varname);
28649 	}
28650 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
28651 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
28652 	}
28653 	PZVAL_LOCK(*retval);
28654 	switch (type) {
28655 		case BP_VAR_R:
28656 		case BP_VAR_IS:
28657 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
28658 			break;
28659 		case BP_VAR_UNSET: {
28660 			zend_free_op free_res;
28661 
28662 			PZVAL_UNLOCK(*retval, &free_res);
28663 			if (retval != &EG(uninitialized_zval_ptr)) {
28664 				SEPARATE_ZVAL_IF_NOT_REF(retval);
28665 			}
28666 			PZVAL_LOCK(*retval);
28667 			FREE_OP_VAR_PTR(free_res);
28668 		}
28669 		/* break missing intentionally */
28670 		default:
28671 			EX_T(opline->result.var).var.ptr_ptr = retval;
28672 			break;
28673 	}
28674 	CHECK_EXCEPTION();
28675 	ZEND_VM_NEXT_OPCODE();
28676 }
28677 
ZEND_FETCH_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28678 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28679 {
28680 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28681 }
28682 
ZEND_FETCH_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28683 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28684 {
28685 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28686 }
28687 
ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28688 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28689 {
28690 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28691 }
28692 
ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28693 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28694 {
28695 	USE_OPLINE
28696 
28697 	return zend_fetch_var_address_helper_SPEC_CV_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28698 }
28699 
ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28700 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28701 {
28702 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28703 }
28704 
ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28705 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28706 {
28707 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28708 }
28709 
ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28710 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28711 {
28712 	USE_OPLINE
28713 
28714 	zval *container;
28715 
28716 	SAVE_OPLINE();
28717 
28718 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
28719 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
28720 	}
28721 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
28722 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
28723 
28724 
28725 	CHECK_EXCEPTION();
28726 	ZEND_VM_NEXT_OPCODE();
28727 }
28728 
ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28729 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28730 {
28731 	USE_OPLINE
28732 	zend_free_op free_op1;
28733 	zval **container;
28734 
28735 	SAVE_OPLINE();
28736 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
28737 
28738 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28739 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28740 	}
28741 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
28742 
28743 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28744 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28745 	}
28746 
28747 	/* We are going to assign the result by reference */
28748 	if (UNEXPECTED(opline->extended_value != 0)) {
28749 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
28750 
28751 		if (retval_ptr) {
28752 			Z_DELREF_PP(retval_ptr);
28753 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
28754 			Z_ADDREF_PP(retval_ptr);
28755 		}
28756 	}
28757 
28758 	CHECK_EXCEPTION();
28759 	ZEND_VM_NEXT_OPCODE();
28760 }
28761 
ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28762 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28763 {
28764 	USE_OPLINE
28765 	zend_free_op free_op1;
28766 	zval **container;
28767 
28768 	SAVE_OPLINE();
28769 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28770 
28771 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28772 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28773 	}
28774 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_RW TSRMLS_CC);
28775 
28776 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28777 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28778 	}
28779 
28780 	CHECK_EXCEPTION();
28781 	ZEND_VM_NEXT_OPCODE();
28782 }
28783 
ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28784 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28785 {
28786 	USE_OPLINE
28787 
28788 	zval *container;
28789 
28790 	SAVE_OPLINE();
28791 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
28792 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_IS TSRMLS_CC);
28793 
28794 
28795 	CHECK_EXCEPTION();
28796 	ZEND_VM_NEXT_OPCODE();
28797 }
28798 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28799 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28800 {
28801 	USE_OPLINE
28802 	zend_free_op free_op1;
28803 
28804 	SAVE_OPLINE();
28805 
28806 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
28807 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
28808 
28809 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28810 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28811 		}
28812 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
28813 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28814 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28815 		}
28816 
28817 
28818 	} else {
28819 		zval *container;
28820 
28821 		if (IS_CONST == IS_UNUSED) {
28822 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
28823 		}
28824 		container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
28825 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
28826 
28827 
28828 	}
28829 	CHECK_EXCEPTION();
28830 	ZEND_VM_NEXT_OPCODE();
28831 }
28832 
ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28833 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28834 {
28835 	USE_OPLINE
28836 	zend_free_op free_op1;
28837 	zval **container;
28838 
28839 	SAVE_OPLINE();
28840 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
28841 
28842 	if (IS_CV == IS_CV) {
28843 		if (container != &EG(uninitialized_zval_ptr)) {
28844 			SEPARATE_ZVAL_IF_NOT_REF(container);
28845 		}
28846 	}
28847 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28848 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28849 	}
28850 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_UNSET TSRMLS_CC);
28851 
28852 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28853 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28854 	}
28855 
28856 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
28857 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
28858 	} else {
28859 		zend_free_op free_res;
28860 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
28861 
28862 		PZVAL_UNLOCK(*retval_ptr, &free_res);
28863 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
28864 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
28865 		}
28866 		PZVAL_LOCK(*retval_ptr);
28867 		FREE_OP_VAR_PTR(free_res);
28868 		CHECK_EXCEPTION();
28869 		ZEND_VM_NEXT_OPCODE();
28870 	}
28871 }
28872 
zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS)28873 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS)
28874 {
28875 	USE_OPLINE
28876 
28877 	zval *container;
28878 
28879 	zval *offset;
28880 
28881 	SAVE_OPLINE();
28882 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
28883 	offset  = opline->op2.zv;
28884 
28885 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
28886 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
28887 		zend_error(E_NOTICE, "Trying to get property of non-object");
28888 		PZVAL_LOCK(&EG(uninitialized_zval));
28889 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
28890 
28891 	} else {
28892 		zval *retval;
28893 
28894 		if (0) {
28895 			MAKE_REAL_ZVAL_PTR(offset);
28896 		}
28897 
28898 		/* here we are sure we are dealing with an object */
28899 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28900 
28901 		PZVAL_LOCK(retval);
28902 		AI_SET_PTR(&EX_T(opline->result.var), retval);
28903 
28904 		if (0) {
28905 			zval_ptr_dtor(&offset);
28906 		} else {
28907 
28908 		}
28909 	}
28910 
28911 	CHECK_EXCEPTION();
28912 	ZEND_VM_NEXT_OPCODE();
28913 }
28914 
ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28915 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28916 {
28917 	return zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28918 }
28919 
ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28920 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28921 {
28922 	USE_OPLINE
28923 	zend_free_op free_op1;
28924 	zval *property;
28925 	zval **container;
28926 
28927 	SAVE_OPLINE();
28928 	property = opline->op2.zv;
28929 
28930 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
28931 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
28932 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
28933 	}
28934 
28935 	if (0) {
28936 		MAKE_REAL_ZVAL_PTR(property);
28937 	}
28938 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
28939 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28940 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
28941 	}
28942 
28943 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
28944 	if (0) {
28945 		zval_ptr_dtor(&property);
28946 	} else {
28947 
28948 	}
28949 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28950 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28951 	}
28952 
28953 	/* We are going to assign the result by reference */
28954 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
28955 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
28956 
28957 		Z_DELREF_PP(retval_ptr);
28958 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
28959 		Z_ADDREF_PP(retval_ptr);
28960 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
28961 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
28962 	}
28963 
28964 	CHECK_EXCEPTION();
28965 	ZEND_VM_NEXT_OPCODE();
28966 }
28967 
ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28968 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28969 {
28970 	USE_OPLINE
28971 	zend_free_op free_op1;
28972 	zval *property;
28973 	zval **container;
28974 
28975 	SAVE_OPLINE();
28976 	property = opline->op2.zv;
28977 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
28978 
28979 	if (0) {
28980 		MAKE_REAL_ZVAL_PTR(property);
28981 	}
28982 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
28983 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
28984 	}
28985 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
28986 	if (0) {
28987 		zval_ptr_dtor(&property);
28988 	} else {
28989 
28990 	}
28991 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
28992 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
28993 	}
28994 
28995 	CHECK_EXCEPTION();
28996 	ZEND_VM_NEXT_OPCODE();
28997 }
28998 
ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28999 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29000 {
29001 	USE_OPLINE
29002 
29003 	zval *container;
29004 
29005 	zval *offset;
29006 
29007 	SAVE_OPLINE();
29008 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
29009 	offset  = opline->op2.zv;
29010 
29011 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
29012 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
29013 		PZVAL_LOCK(&EG(uninitialized_zval));
29014 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29015 
29016 	} else {
29017 		zval *retval;
29018 
29019 		if (0) {
29020 			MAKE_REAL_ZVAL_PTR(offset);
29021 		}
29022 
29023 		/* here we are sure we are dealing with an object */
29024 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29025 
29026 		PZVAL_LOCK(retval);
29027 		AI_SET_PTR(&EX_T(opline->result.var), retval);
29028 
29029 		if (0) {
29030 			zval_ptr_dtor(&offset);
29031 		} else {
29032 
29033 		}
29034 	}
29035 
29036 	CHECK_EXCEPTION();
29037 	ZEND_VM_NEXT_OPCODE();
29038 }
29039 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29040 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29041 {
29042 	USE_OPLINE
29043 
29044 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
29045 		/* Behave like FETCH_OBJ_W */
29046 		zend_free_op free_op1;
29047 		zval *property;
29048 		zval **container;
29049 
29050 		SAVE_OPLINE();
29051 		property = opline->op2.zv;
29052 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
29053 
29054 		if (0) {
29055 			MAKE_REAL_ZVAL_PTR(property);
29056 		}
29057 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
29058 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29059 		}
29060 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
29061 		if (0) {
29062 			zval_ptr_dtor(&property);
29063 		} else {
29064 
29065 		}
29066 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29067 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29068 		}
29069 
29070 		CHECK_EXCEPTION();
29071 		ZEND_VM_NEXT_OPCODE();
29072 	} else {
29073 		return zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29074 	}
29075 }
29076 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29077 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29078 {
29079 	USE_OPLINE
29080 	zend_free_op free_op1, free_res;
29081 	zval **container;
29082 	zval *property;
29083 
29084 	SAVE_OPLINE();
29085 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
29086 	property = opline->op2.zv;
29087 
29088 	if (IS_CV == IS_CV) {
29089 		if (container != &EG(uninitialized_zval_ptr)) {
29090 			SEPARATE_ZVAL_IF_NOT_REF(container);
29091 		}
29092 	}
29093 	if (0) {
29094 		MAKE_REAL_ZVAL_PTR(property);
29095 	}
29096 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
29097 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29098 	}
29099 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
29100 	if (0) {
29101 		zval_ptr_dtor(&property);
29102 	} else {
29103 
29104 	}
29105 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29106 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29107 	}
29108 
29109 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
29110 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
29111 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
29112 	}
29113 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
29114 	FREE_OP_VAR_PTR(free_res);
29115 	CHECK_EXCEPTION();
29116 	ZEND_VM_NEXT_OPCODE();
29117 }
29118 
ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29119 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29120 {
29121 	USE_OPLINE
29122 
29123 	zval **object_ptr;
29124 	zval *property_name;
29125 
29126 	SAVE_OPLINE();
29127 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
29128 	property_name = opline->op2.zv;
29129 
29130 	if (0) {
29131 		MAKE_REAL_ZVAL_PTR(property_name);
29132 	}
29133 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
29134 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
29135 	}
29136 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29137 	if (0) {
29138 		zval_ptr_dtor(&property_name);
29139 	} else {
29140 
29141 	}
29142 
29143 	/* assign_obj has two opcodes! */
29144 	CHECK_EXCEPTION();
29145 	ZEND_VM_INC_OPCODE();
29146 	ZEND_VM_NEXT_OPCODE();
29147 }
29148 
ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29149 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29150 {
29151 	USE_OPLINE
29152 
29153 	zval **object_ptr;
29154 
29155 	SAVE_OPLINE();
29156 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
29157 
29158 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
29159 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
29160 	}
29161 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
29162 
29163 		zval *property_name = opline->op2.zv;
29164 
29165 		if (0) {
29166 			MAKE_REAL_ZVAL_PTR(property_name);
29167 		}
29168 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29169 		if (0) {
29170 			zval_ptr_dtor(&property_name);
29171 		} else {
29172 
29173 		}
29174 	} else {
29175 		zend_free_op free_op_data1, free_op_data2;
29176 		zval *value;
29177 		zval *dim = opline->op2.zv;
29178 		zval **variable_ptr_ptr;
29179 
29180 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CONST, BP_VAR_W TSRMLS_CC);
29181 
29182 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
29183 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
29184 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
29185 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
29186 				if (RETURN_VALUE_USED(opline)) {
29187 					zval *retval;
29188 
29189 					ALLOC_ZVAL(retval);
29190 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
29191 					INIT_PZVAL(retval);
29192 					AI_SET_PTR(&EX_T(opline->result.var), retval);
29193 				}
29194 			} else if (RETURN_VALUE_USED(opline)) {
29195 				PZVAL_LOCK(&EG(uninitialized_zval));
29196 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29197 			}
29198 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
29199 			if (IS_TMP_FREE(free_op_data1)) {
29200 				zval_dtor(value);
29201 			}
29202 			if (RETURN_VALUE_USED(opline)) {
29203 				PZVAL_LOCK(&EG(uninitialized_zval));
29204 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29205 			}
29206 		} else {
29207 			if ((opline+1)->op1_type == IS_TMP_VAR) {
29208 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29209 			} else if ((opline+1)->op1_type == IS_CONST) {
29210 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29211 			} else {
29212 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29213 			}
29214 			if (RETURN_VALUE_USED(opline)) {
29215 				PZVAL_LOCK(value);
29216 				AI_SET_PTR(&EX_T(opline->result.var), value);
29217 			}
29218 		}
29219 		FREE_OP_VAR_PTR(free_op_data2);
29220 	 	FREE_OP_IF_VAR(free_op_data1);
29221 	}
29222 
29223 	/* assign_dim has two opcodes! */
29224 	CHECK_EXCEPTION();
29225 	ZEND_VM_INC_OPCODE();
29226 	ZEND_VM_NEXT_OPCODE();
29227 }
29228 
ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29229 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29230 {
29231 	USE_OPLINE
29232 
29233 	zval *value;
29234 	zval **variable_ptr_ptr;
29235 
29236 	SAVE_OPLINE();
29237 	value = opline->op2.zv;
29238 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
29239 
29240 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
29241 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CONST TSRMLS_CC)) {
29242 			if (RETURN_VALUE_USED(opline)) {
29243 				zval *retval;
29244 
29245 				ALLOC_ZVAL(retval);
29246 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
29247 				INIT_PZVAL(retval);
29248 				AI_SET_PTR(&EX_T(opline->result.var), retval);
29249 			}
29250 		} else if (RETURN_VALUE_USED(opline)) {
29251 			PZVAL_LOCK(&EG(uninitialized_zval));
29252 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29253 		}
29254 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
29255 		if (0) {
29256 			zval_dtor(value);
29257 		}
29258 		if (RETURN_VALUE_USED(opline)) {
29259 			PZVAL_LOCK(&EG(uninitialized_zval));
29260 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29261 		}
29262 	} else {
29263 		if (IS_CONST == IS_TMP_VAR) {
29264 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29265 		} else if (IS_CONST == IS_CONST) {
29266 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29267 		} else {
29268 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
29269 		}
29270 		if (RETURN_VALUE_USED(opline)) {
29271 			PZVAL_LOCK(value);
29272 			AI_SET_PTR(&EX_T(opline->result.var), value);
29273 		}
29274 	}
29275 
29276 	/* zend_assign_to_variable() always takes care of op2, never free it! */
29277 
29278 	CHECK_EXCEPTION();
29279 	ZEND_VM_NEXT_OPCODE();
29280 }
29281 
ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29282 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29283 {
29284 	USE_OPLINE
29285 	zval *function_name;
29286 	char *function_name_strval;
29287 	int function_name_strlen;
29288 
29289 
29290 	SAVE_OPLINE();
29291 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
29292 
29293 	function_name = opline->op2.zv;
29294 
29295 	if (IS_CONST != IS_CONST &&
29296 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
29297 		zend_error_noreturn(E_ERROR, "Method name must be a string");
29298 	}
29299 
29300 	function_name_strval = Z_STRVAL_P(function_name);
29301 	function_name_strlen = Z_STRLEN_P(function_name);
29302 
29303 	EX(object) = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
29304 
29305 	if (EXPECTED(EX(object) != NULL) &&
29306 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
29307 		EX(called_scope) = Z_OBJCE_P(EX(object));
29308 
29309 		if (IS_CONST != IS_CONST ||
29310 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
29311 		    zval *object = EX(object);
29312 
29313 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
29314 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
29315 			}
29316 
29317 			/* First, locate the function. */
29318 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
29319 			if (UNEXPECTED(EX(fbc) == NULL)) {
29320 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
29321 			}
29322 			if (IS_CONST == IS_CONST &&
29323 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
29324 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
29325 			    EXPECTED(EX(object) == object)) {
29326 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
29327 			}
29328 		}
29329 	} else {
29330 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
29331 	}
29332 
29333 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
29334 		EX(object) = NULL;
29335 	} else {
29336 		if (!PZVAL_IS_REF(EX(object))) {
29337 			Z_ADDREF_P(EX(object)); /* For $this pointer */
29338 		} else {
29339 			zval *this_ptr;
29340 			ALLOC_ZVAL(this_ptr);
29341 			INIT_PZVAL_COPY(this_ptr, EX(object));
29342 			zval_copy_ctor(this_ptr);
29343 			EX(object) = this_ptr;
29344 		}
29345 	}
29346 
29347 
29348 	CHECK_EXCEPTION();
29349 	ZEND_VM_NEXT_OPCODE();
29350 }
29351 
ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29352 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29353 {
29354 	USE_OPLINE
29355 
29356 
29357 	SAVE_OPLINE();
29358 	if (IS_CV==IS_VAR) {
29359 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
29360 	}
29361 	is_equal_function(&EX_T(opline->result.var).tmp_var,
29362 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29363 				 opline->op2.zv TSRMLS_CC);
29364 
29365 	CHECK_EXCEPTION();
29366 	ZEND_VM_NEXT_OPCODE();
29367 }
29368 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29369 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29370 {
29371 	USE_OPLINE
29372 
29373 	zval *expr_ptr;
29374 
29375 	SAVE_OPLINE();
29376 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
29377 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
29378 
29379 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
29380 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
29381 		}
29382 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
29383 		expr_ptr = *expr_ptr_ptr;
29384 		Z_ADDREF_P(expr_ptr);
29385 	} else {
29386 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
29387 		if (0) { /* temporary variable */
29388 			zval *new_expr;
29389 
29390 			ALLOC_ZVAL(new_expr);
29391 			INIT_PZVAL_COPY(new_expr, expr_ptr);
29392 			expr_ptr = new_expr;
29393 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
29394 			zval *new_expr;
29395 
29396 			ALLOC_ZVAL(new_expr);
29397 			INIT_PZVAL_COPY(new_expr, expr_ptr);
29398 			expr_ptr = new_expr;
29399 			zendi_zval_copy_ctor(*expr_ptr);
29400 		} else {
29401 			Z_ADDREF_P(expr_ptr);
29402 		}
29403 	}
29404 
29405 	if (IS_CONST != IS_UNUSED) {
29406 
29407 		zval *offset = opline->op2.zv;
29408 		ulong hval;
29409 
29410 		switch (Z_TYPE_P(offset)) {
29411 			case IS_DOUBLE:
29412 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
29413 				goto num_index;
29414 			case IS_LONG:
29415 			case IS_BOOL:
29416 				hval = Z_LVAL_P(offset);
29417 num_index:
29418 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
29419 				break;
29420 			case IS_STRING:
29421 				if (IS_CONST == IS_CONST) {
29422 					hval = Z_HASH_P(offset);
29423 				} else {
29424 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
29425 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
29426 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
29427 					} else {
29428 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
29429 					}
29430 				}
29431 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
29432 				break;
29433 			case IS_NULL:
29434 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
29435 				break;
29436 			default:
29437 				zend_error(E_WARNING, "Illegal offset type");
29438 				zval_ptr_dtor(&expr_ptr);
29439 				/* do nothing */
29440 				break;
29441 		}
29442 
29443 	} else {
29444 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
29445 	}
29446 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
29447 
29448 	} else {
29449 
29450 	}
29451 	CHECK_EXCEPTION();
29452 	ZEND_VM_NEXT_OPCODE();
29453 }
29454 
ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29455 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29456 {
29457 	USE_OPLINE
29458 
29459 	array_init(&EX_T(opline->result.var).tmp_var);
29460 	if (IS_CV == IS_UNUSED) {
29461 		ZEND_VM_NEXT_OPCODE();
29462 #if 0 || IS_CV != IS_UNUSED
29463 	} else {
29464 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29465 #endif
29466 	}
29467 }
29468 
ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29469 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29470 {
29471 	USE_OPLINE
29472 	zval tmp, *varname;
29473 	HashTable *target_symbol_table;
29474 
29475 
29476 	SAVE_OPLINE();
29477 	if (IS_CV == IS_CV &&
29478 	    IS_CONST == IS_UNUSED &&
29479 	    (opline->extended_value & ZEND_QUICK_SET)) {
29480 		if (EG(active_symbol_table)) {
29481 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
29482 
29483 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
29484 			EX_CV(opline->op1.var) = NULL;
29485 		} else if (EX_CV(opline->op1.var)) {
29486 			zval_ptr_dtor(EX_CV(opline->op1.var));
29487 			EX_CV(opline->op1.var) = NULL;
29488 		}
29489 		CHECK_EXCEPTION();
29490 		ZEND_VM_NEXT_OPCODE();
29491 	}
29492 
29493 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
29494 
29495 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
29496 		ZVAL_COPY_VALUE(&tmp, varname);
29497 		zval_copy_ctor(&tmp);
29498 		convert_to_string(&tmp);
29499 		varname = &tmp;
29500 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
29501 		Z_ADDREF_P(varname);
29502 	}
29503 
29504 	if (IS_CONST != IS_UNUSED) {
29505 		zend_class_entry *ce;
29506 
29507 		if (IS_CONST == IS_CONST) {
29508 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
29509 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
29510 			} else {
29511 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
29512 				if (UNEXPECTED(EG(exception) != NULL)) {
29513 					if (IS_CV != IS_CONST && varname == &tmp) {
29514 						zval_dtor(&tmp);
29515 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
29516 						zval_ptr_dtor(&varname);
29517 					}
29518 
29519 					HANDLE_EXCEPTION();
29520 				}
29521 				if (UNEXPECTED(ce == NULL)) {
29522 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
29523 				}
29524 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
29525 			}
29526 		} else {
29527 			ce = EX_T(opline->op2.var).class_entry;
29528 		}
29529 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
29530 	} else {
29531 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
29532 
29533 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
29534 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
29535 	}
29536 
29537 	if (IS_CV != IS_CONST && varname == &tmp) {
29538 		zval_dtor(&tmp);
29539 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
29540 		zval_ptr_dtor(&varname);
29541 	}
29542 
29543 	CHECK_EXCEPTION();
29544 	ZEND_VM_NEXT_OPCODE();
29545 }
29546 
ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29547 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29548 {
29549 	USE_OPLINE
29550 
29551 	zval **container;
29552 	zval *offset;
29553 	ulong hval;
29554 
29555 	SAVE_OPLINE();
29556 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
29557 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
29558 		SEPARATE_ZVAL_IF_NOT_REF(container);
29559 	}
29560 	offset = opline->op2.zv;
29561 
29562 	if (IS_CV != IS_VAR || container) {
29563 		switch (Z_TYPE_PP(container)) {
29564 			case IS_ARRAY: {
29565 				HashTable *ht = Z_ARRVAL_PP(container);
29566 
29567 				switch (Z_TYPE_P(offset)) {
29568 					case IS_DOUBLE:
29569 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
29570 						zend_hash_index_del(ht, hval);
29571 						break;
29572 					case IS_RESOURCE:
29573 					case IS_BOOL:
29574 					case IS_LONG:
29575 						hval = Z_LVAL_P(offset);
29576 						zend_hash_index_del(ht, hval);
29577 						break;
29578 					case IS_STRING:
29579 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
29580 							Z_ADDREF_P(offset);
29581 						}
29582 						if (IS_CONST == IS_CONST) {
29583 							hval = Z_HASH_P(offset);
29584 						} else {
29585 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
29586 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
29587 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
29588 							} else {
29589 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
29590 							}
29591 						}
29592 						if (ht == &EG(symbol_table)) {
29593 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
29594 						} else {
29595 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
29596 						}
29597 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
29598 							zval_ptr_dtor(&offset);
29599 						}
29600 						break;
29601 num_index_dim:
29602 						zend_hash_index_del(ht, hval);
29603 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
29604 							zval_ptr_dtor(&offset);
29605 						}
29606 						break;
29607 					case IS_NULL:
29608 						zend_hash_del(ht, "", sizeof(""));
29609 						break;
29610 					default:
29611 						zend_error(E_WARNING, "Illegal offset type in unset");
29612 						break;
29613 				}
29614 
29615 				break;
29616 			}
29617 			case IS_OBJECT:
29618 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
29619 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
29620 				}
29621 				if (0) {
29622 					MAKE_REAL_ZVAL_PTR(offset);
29623 				}
29624 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
29625 				if (0) {
29626 					zval_ptr_dtor(&offset);
29627 				} else {
29628 
29629 				}
29630 				break;
29631 			case IS_STRING:
29632 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
29633 				ZEND_VM_CONTINUE(); /* bailed out before */
29634 			default:
29635 
29636 				break;
29637 		}
29638 	} else {
29639 
29640 	}
29641 
29642 	CHECK_EXCEPTION();
29643 	ZEND_VM_NEXT_OPCODE();
29644 }
29645 
ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29646 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29647 {
29648 	USE_OPLINE
29649 
29650 	zval **container;
29651 	zval *offset;
29652 
29653 	SAVE_OPLINE();
29654 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
29655 	offset = opline->op2.zv;
29656 
29657 	if (IS_CV != IS_VAR || container) {
29658 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
29659 			SEPARATE_ZVAL_IF_NOT_REF(container);
29660 		}
29661 		if (Z_TYPE_PP(container) == IS_OBJECT) {
29662 			if (0) {
29663 				MAKE_REAL_ZVAL_PTR(offset);
29664 			}
29665 			if (Z_OBJ_HT_P(*container)->unset_property) {
29666 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29667 			} else {
29668 				zend_error(E_NOTICE, "Trying to unset property of non-object");
29669 			}
29670 			if (0) {
29671 				zval_ptr_dtor(&offset);
29672 			} else {
29673 
29674 			}
29675 		} else {
29676 
29677 		}
29678 	} else {
29679 
29680 	}
29681 
29682 	CHECK_EXCEPTION();
29683 	ZEND_VM_NEXT_OPCODE();
29684 }
29685 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29686 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29687 {
29688 	USE_OPLINE
29689 	zval **value;
29690 	zend_bool isset = 1;
29691 
29692 	SAVE_OPLINE();
29693 	if (IS_CV == IS_CV &&
29694 	    IS_CONST == IS_UNUSED &&
29695 	    (opline->extended_value & ZEND_QUICK_SET)) {
29696 		if (EX_CV(opline->op1.var)) {
29697 			value = EX_CV(opline->op1.var);
29698 		} else if (EG(active_symbol_table)) {
29699 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
29700 
29701 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
29702 				isset = 0;
29703 			}
29704 		} else {
29705 			isset = 0;
29706 		}
29707 	} else {
29708 		HashTable *target_symbol_table;
29709 
29710 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
29711 
29712 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
29713 			ZVAL_COPY_VALUE(&tmp, varname);
29714 			zval_copy_ctor(&tmp);
29715 			convert_to_string(&tmp);
29716 			varname = &tmp;
29717 		}
29718 
29719 		if (IS_CONST != IS_UNUSED) {
29720 			zend_class_entry *ce;
29721 
29722 			if (IS_CONST == IS_CONST) {
29723 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
29724 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
29725 				} else {
29726 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
29727 					if (UNEXPECTED(ce == NULL)) {
29728 						CHECK_EXCEPTION();
29729 						ZEND_VM_NEXT_OPCODE();
29730 					}
29731 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
29732 				}
29733 			} else {
29734 				ce = EX_T(opline->op2.var).class_entry;
29735 			}
29736 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
29737 			if (!value) {
29738 				isset = 0;
29739 			}
29740 		} else {
29741 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
29742 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
29743 				isset = 0;
29744 			}
29745 		}
29746 
29747 		if (IS_CV != IS_CONST && varname == &tmp) {
29748 			zval_dtor(&tmp);
29749 		}
29750 
29751 	}
29752 
29753 	if (opline->extended_value & ZEND_ISSET) {
29754 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
29755 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
29756 		} else {
29757 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
29758 		}
29759 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
29760 		if (!isset || !i_zend_is_true(*value)) {
29761 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
29762 		} else {
29763 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
29764 		}
29765 	}
29766 
29767 	CHECK_EXCEPTION();
29768 	ZEND_VM_NEXT_OPCODE();
29769 }
29770 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)29771 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
29772 {
29773 	USE_OPLINE
29774 
29775 	zval **container;
29776 	zval **value = NULL;
29777 	int result = 0;
29778 	ulong hval;
29779 	zval *offset;
29780 
29781 	SAVE_OPLINE();
29782 	container = _get_zval_ptr_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
29783 
29784 	offset = opline->op2.zv;
29785 
29786 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
29787 		HashTable *ht;
29788 		int isset = 0;
29789 
29790 		ht = Z_ARRVAL_PP(container);
29791 
29792 		switch (Z_TYPE_P(offset)) {
29793 			case IS_DOUBLE:
29794 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
29795 				goto num_index_prop;
29796 			case IS_RESOURCE:
29797 			case IS_BOOL:
29798 			case IS_LONG:
29799 				hval = Z_LVAL_P(offset);
29800 num_index_prop:
29801 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
29802 					isset = 1;
29803 				}
29804 				break;
29805 			case IS_STRING:
29806 				if (IS_CONST == IS_CONST) {
29807 					hval = Z_HASH_P(offset);
29808 				} else {
29809 					if (!prop_dim) {
29810 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
29811 					}
29812 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
29813 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
29814 					} else {
29815 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
29816 					}
29817 				}
29818 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
29819 					isset = 1;
29820 				}
29821 				break;
29822 			case IS_NULL:
29823 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
29824 					isset = 1;
29825 				}
29826 				break;
29827 			default:
29828 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
29829 				break;
29830 		}
29831 
29832 		if (opline->extended_value & ZEND_ISSET) {
29833 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
29834 				result = 0;
29835 			} else {
29836 				result = isset;
29837 			}
29838 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
29839 			if (!isset || !i_zend_is_true(*value)) {
29840 				result = 0;
29841 			} else {
29842 				result = 1;
29843 			}
29844 		}
29845 
29846 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
29847 		if (0) {
29848 			MAKE_REAL_ZVAL_PTR(offset);
29849 		}
29850 		if (prop_dim) {
29851 			if (Z_OBJ_HT_P(*container)->has_property) {
29852 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29853 			} else {
29854 				zend_error(E_NOTICE, "Trying to check property of non-object");
29855 				result = 0;
29856 			}
29857 		} else {
29858 			if (Z_OBJ_HT_P(*container)->has_dimension) {
29859 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
29860 			} else {
29861 				zend_error(E_NOTICE, "Trying to check element of non-array");
29862 				result = 0;
29863 			}
29864 		}
29865 		if (0) {
29866 			zval_ptr_dtor(&offset);
29867 		} else {
29868 
29869 		}
29870 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
29871 		zval tmp;
29872 
29873 		if (Z_TYPE_P(offset) != IS_LONG) {
29874 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
29875 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
29876 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
29877 				ZVAL_COPY_VALUE(&tmp, offset);
29878 				zval_copy_ctor(&tmp);
29879 				convert_to_long(&tmp);
29880 				offset = &tmp;
29881 			} else {
29882 				/* can not be converted to proper offset, return "not set" */
29883 				result = 0;
29884 			}
29885 		}
29886 		if (Z_TYPE_P(offset) == IS_LONG) {
29887 			if (opline->extended_value & ZEND_ISSET) {
29888 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
29889 					result = 1;
29890 				}
29891 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
29892 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
29893 					result = 1;
29894 				}
29895 			}
29896 		}
29897 
29898 	} else {
29899 
29900 	}
29901 
29902 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
29903 	if (opline->extended_value & ZEND_ISSET) {
29904 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
29905 	} else {
29906 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
29907 	}
29908 
29909 	CHECK_EXCEPTION();
29910 	ZEND_VM_NEXT_OPCODE();
29911 }
29912 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29913 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29914 {
29915 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29916 }
29917 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29918 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29919 {
29920 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29921 }
29922 
ZEND_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29923 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29924 {
29925 	USE_OPLINE
29926 	zend_free_op free_op2;
29927 
29928 	SAVE_OPLINE();
29929 	fast_add_function(&EX_T(opline->result.var).tmp_var,
29930 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29931 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
29932 
29933 	zval_dtor(free_op2.var);
29934 	CHECK_EXCEPTION();
29935 	ZEND_VM_NEXT_OPCODE();
29936 }
29937 
ZEND_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29938 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29939 {
29940 	USE_OPLINE
29941 	zend_free_op free_op2;
29942 
29943 	SAVE_OPLINE();
29944 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
29945 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29946 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
29947 
29948 	zval_dtor(free_op2.var);
29949 	CHECK_EXCEPTION();
29950 	ZEND_VM_NEXT_OPCODE();
29951 }
29952 
ZEND_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29953 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29954 {
29955 	USE_OPLINE
29956 	zend_free_op free_op2;
29957 
29958 	SAVE_OPLINE();
29959 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
29960 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29961 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
29962 
29963 	zval_dtor(free_op2.var);
29964 	CHECK_EXCEPTION();
29965 	ZEND_VM_NEXT_OPCODE();
29966 }
29967 
ZEND_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29968 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29969 {
29970 	USE_OPLINE
29971 	zend_free_op free_op2;
29972 
29973 	SAVE_OPLINE();
29974 	fast_div_function(&EX_T(opline->result.var).tmp_var,
29975 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29976 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
29977 
29978 	zval_dtor(free_op2.var);
29979 	CHECK_EXCEPTION();
29980 	ZEND_VM_NEXT_OPCODE();
29981 }
29982 
ZEND_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29983 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29984 {
29985 	USE_OPLINE
29986 	zend_free_op free_op2;
29987 
29988 	SAVE_OPLINE();
29989 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
29990 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
29991 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
29992 
29993 	zval_dtor(free_op2.var);
29994 	CHECK_EXCEPTION();
29995 	ZEND_VM_NEXT_OPCODE();
29996 }
29997 
ZEND_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29998 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29999 {
30000 	USE_OPLINE
30001 	zend_free_op free_op2;
30002 
30003 	SAVE_OPLINE();
30004 	shift_left_function(&EX_T(opline->result.var).tmp_var,
30005 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30006 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30007 
30008 	zval_dtor(free_op2.var);
30009 	CHECK_EXCEPTION();
30010 	ZEND_VM_NEXT_OPCODE();
30011 }
30012 
ZEND_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30013 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30014 {
30015 	USE_OPLINE
30016 	zend_free_op free_op2;
30017 
30018 	SAVE_OPLINE();
30019 	shift_right_function(&EX_T(opline->result.var).tmp_var,
30020 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30021 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30022 
30023 	zval_dtor(free_op2.var);
30024 	CHECK_EXCEPTION();
30025 	ZEND_VM_NEXT_OPCODE();
30026 }
30027 
ZEND_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30028 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30029 {
30030 	USE_OPLINE
30031 	zend_free_op free_op2;
30032 
30033 	SAVE_OPLINE();
30034 	concat_function(&EX_T(opline->result.var).tmp_var,
30035 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30036 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30037 
30038 	zval_dtor(free_op2.var);
30039 	CHECK_EXCEPTION();
30040 	ZEND_VM_NEXT_OPCODE();
30041 }
30042 
ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30043 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30044 {
30045 	USE_OPLINE
30046 	zend_free_op free_op2;
30047 
30048 	SAVE_OPLINE();
30049 	is_identical_function(&EX_T(opline->result.var).tmp_var,
30050 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30051 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30052 
30053 	zval_dtor(free_op2.var);
30054 	CHECK_EXCEPTION();
30055 	ZEND_VM_NEXT_OPCODE();
30056 }
30057 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30058 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30059 {
30060 	USE_OPLINE
30061 	zend_free_op free_op2;
30062 	zval *result = &EX_T(opline->result.var).tmp_var;
30063 
30064 	SAVE_OPLINE();
30065 	is_identical_function(result,
30066 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30067 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30068 	Z_LVAL_P(result) = !Z_LVAL_P(result);
30069 
30070 	zval_dtor(free_op2.var);
30071 	CHECK_EXCEPTION();
30072 	ZEND_VM_NEXT_OPCODE();
30073 }
30074 
ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30075 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30076 {
30077 	USE_OPLINE
30078 	zend_free_op free_op2;
30079 	zval *result = &EX_T(opline->result.var).tmp_var;
30080 
30081 	SAVE_OPLINE();
30082 	ZVAL_BOOL(result, fast_equal_function(result,
30083 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30084 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
30085 
30086 	zval_dtor(free_op2.var);
30087 	CHECK_EXCEPTION();
30088 	ZEND_VM_NEXT_OPCODE();
30089 }
30090 
ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30091 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30092 {
30093 	USE_OPLINE
30094 	zend_free_op free_op2;
30095 	zval *result = &EX_T(opline->result.var).tmp_var;
30096 
30097 	SAVE_OPLINE();
30098 	ZVAL_BOOL(result, fast_not_equal_function(result,
30099 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30100 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
30101 
30102 	zval_dtor(free_op2.var);
30103 	CHECK_EXCEPTION();
30104 	ZEND_VM_NEXT_OPCODE();
30105 }
30106 
ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30107 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30108 {
30109 	USE_OPLINE
30110 	zend_free_op free_op2;
30111 	zval *result = &EX_T(opline->result.var).tmp_var;
30112 
30113 	SAVE_OPLINE();
30114 	ZVAL_BOOL(result, fast_is_smaller_function(result,
30115 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30116 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
30117 
30118 	zval_dtor(free_op2.var);
30119 	CHECK_EXCEPTION();
30120 	ZEND_VM_NEXT_OPCODE();
30121 }
30122 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30123 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30124 {
30125 	USE_OPLINE
30126 	zend_free_op free_op2;
30127 	zval *result = &EX_T(opline->result.var).tmp_var;
30128 
30129 	SAVE_OPLINE();
30130 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
30131 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30132 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
30133 
30134 	zval_dtor(free_op2.var);
30135 	CHECK_EXCEPTION();
30136 	ZEND_VM_NEXT_OPCODE();
30137 }
30138 
ZEND_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30139 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30140 {
30141 	USE_OPLINE
30142 	zend_free_op free_op2;
30143 
30144 	SAVE_OPLINE();
30145 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
30146 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30147 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30148 
30149 	zval_dtor(free_op2.var);
30150 	CHECK_EXCEPTION();
30151 	ZEND_VM_NEXT_OPCODE();
30152 }
30153 
ZEND_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30154 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30155 {
30156 	USE_OPLINE
30157 	zend_free_op free_op2;
30158 
30159 	SAVE_OPLINE();
30160 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
30161 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30162 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30163 
30164 	zval_dtor(free_op2.var);
30165 	CHECK_EXCEPTION();
30166 	ZEND_VM_NEXT_OPCODE();
30167 }
30168 
ZEND_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30169 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30170 {
30171 	USE_OPLINE
30172 	zend_free_op free_op2;
30173 
30174 	SAVE_OPLINE();
30175 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
30176 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30177 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30178 
30179 	zval_dtor(free_op2.var);
30180 	CHECK_EXCEPTION();
30181 	ZEND_VM_NEXT_OPCODE();
30182 }
30183 
ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30184 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30185 {
30186 	USE_OPLINE
30187 	zend_free_op free_op2;
30188 
30189 	SAVE_OPLINE();
30190 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
30191 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
30192 		_get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
30193 
30194 	zval_dtor(free_op2.var);
30195 	CHECK_EXCEPTION();
30196 	ZEND_VM_NEXT_OPCODE();
30197 }
30198 
zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)30199 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
30200 {
30201 	USE_OPLINE
30202 	zend_free_op free_op2, free_op_data1;
30203 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30204 	zval *object;
30205 	zval *property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30206 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
30207 	int have_get_ptr = 0;
30208 
30209 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
30210 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
30211 	}
30212 
30213 	make_real_object(object_ptr TSRMLS_CC);
30214 	object = *object_ptr;
30215 
30216 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
30217 		zend_error(E_WARNING, "Attempt to assign property of non-object");
30218 		zval_dtor(free_op2.var);
30219 		FREE_OP(free_op_data1);
30220 
30221 		if (RETURN_VALUE_USED(opline)) {
30222 			PZVAL_LOCK(&EG(uninitialized_zval));
30223 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
30224 			EX_T(opline->result.var).var.ptr_ptr = NULL;
30225 		}
30226 	} else {
30227 		/* here we are sure we are dealing with an object */
30228 		if (1) {
30229 			MAKE_REAL_ZVAL_PTR(property);
30230 		}
30231 
30232 		/* here property is a string */
30233 		if (opline->extended_value == ZEND_ASSIGN_OBJ
30234 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
30235 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30236 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
30237 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
30238 
30239 				have_get_ptr = 1;
30240 				binary_op(*zptr, *zptr, value TSRMLS_CC);
30241 				if (RETURN_VALUE_USED(opline)) {
30242 					PZVAL_LOCK(*zptr);
30243 					EX_T(opline->result.var).var.ptr = *zptr;
30244 					EX_T(opline->result.var).var.ptr_ptr = NULL;
30245 				}
30246 			}
30247 		}
30248 
30249 		if (!have_get_ptr) {
30250 			zval *z = NULL;
30251 
30252 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
30253 				if (Z_OBJ_HT_P(object)->read_property) {
30254 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30255 				}
30256 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
30257 				if (Z_OBJ_HT_P(object)->read_dimension) {
30258 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
30259 				}
30260 			}
30261 			if (z) {
30262 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
30263 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
30264 
30265 					if (Z_REFCOUNT_P(z) == 0) {
30266 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
30267 						zval_dtor(z);
30268 						FREE_ZVAL(z);
30269 					}
30270 					z = value;
30271 				}
30272 				Z_ADDREF_P(z);
30273 				SEPARATE_ZVAL_IF_NOT_REF(&z);
30274 				binary_op(z, z, value TSRMLS_CC);
30275 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
30276 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30277 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
30278 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
30279 				}
30280 				if (RETURN_VALUE_USED(opline)) {
30281 					PZVAL_LOCK(z);
30282 					EX_T(opline->result.var).var.ptr = z;
30283 					EX_T(opline->result.var).var.ptr_ptr = NULL;
30284 				}
30285 				zval_ptr_dtor(&z);
30286 			} else {
30287 				zend_error(E_WARNING, "Attempt to assign property of non-object");
30288 				if (RETURN_VALUE_USED(opline)) {
30289 					PZVAL_LOCK(&EG(uninitialized_zval));
30290 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
30291 					EX_T(opline->result.var).var.ptr_ptr = NULL;
30292 				}
30293 			}
30294 		}
30295 
30296 		if (1) {
30297 			zval_ptr_dtor(&property);
30298 		} else {
30299 			zval_dtor(free_op2.var);
30300 		}
30301 		FREE_OP(free_op_data1);
30302 	}
30303 
30304 	/* assign_obj has two opcodes! */
30305 	CHECK_EXCEPTION();
30306 	ZEND_VM_INC_OPCODE();
30307 	ZEND_VM_NEXT_OPCODE();
30308 }
30309 
zend_binary_assign_op_helper_SPEC_CV_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)30310 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
30311 {
30312 	USE_OPLINE
30313 	zend_free_op free_op2, free_op_data2, free_op_data1;
30314 	zval **var_ptr;
30315 	zval *value;
30316 
30317 	SAVE_OPLINE();
30318 	switch (opline->extended_value) {
30319 		case ZEND_ASSIGN_OBJ:
30320 			return zend_binary_assign_op_obj_helper_SPEC_CV_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30321 			break;
30322 		case ZEND_ASSIGN_DIM: {
30323 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30324 
30325 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30326 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
30327 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
30328 					if (IS_CV == IS_VAR && !0) {
30329 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
30330 					}
30331 					return zend_binary_assign_op_obj_helper_SPEC_CV_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30332 				} else {
30333 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30334 
30335 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
30336 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
30337 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
30338 				}
30339 			}
30340 			break;
30341 		default:
30342 			value = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30343 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30344 			/* do nothing */
30345 			break;
30346 	}
30347 
30348 	if (UNEXPECTED(var_ptr == NULL)) {
30349 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
30350 	}
30351 
30352 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
30353 		if (RETURN_VALUE_USED(opline)) {
30354 			PZVAL_LOCK(&EG(uninitialized_zval));
30355 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
30356 		}
30357 		zval_dtor(free_op2.var);
30358 
30359 		CHECK_EXCEPTION();
30360 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
30361 			ZEND_VM_INC_OPCODE();
30362 		}
30363 		ZEND_VM_NEXT_OPCODE();
30364 	}
30365 
30366 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
30367 
30368 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
30369 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
30370 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
30371 		/* proxy object */
30372 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
30373 		Z_ADDREF_P(objval);
30374 		binary_op(objval, objval, value TSRMLS_CC);
30375 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
30376 		zval_ptr_dtor(&objval);
30377 	} else {
30378 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
30379 	}
30380 
30381 	if (RETURN_VALUE_USED(opline)) {
30382 		PZVAL_LOCK(*var_ptr);
30383 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
30384 	}
30385 	zval_dtor(free_op2.var);
30386 
30387 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
30388 		FREE_OP(free_op_data1);
30389 		FREE_OP_VAR_PTR(free_op_data2);
30390 
30391 		CHECK_EXCEPTION();
30392 		ZEND_VM_INC_OPCODE();
30393 	} else {
30394 
30395 		CHECK_EXCEPTION();
30396 	}
30397 	ZEND_VM_NEXT_OPCODE();
30398 }
30399 
ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30400 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30401 {
30402 	return zend_binary_assign_op_helper_SPEC_CV_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30403 }
30404 
ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30405 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30406 {
30407 	return zend_binary_assign_op_helper_SPEC_CV_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30408 }
30409 
ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30410 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30411 {
30412 	return zend_binary_assign_op_helper_SPEC_CV_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30413 }
30414 
ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30415 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30416 {
30417 	return zend_binary_assign_op_helper_SPEC_CV_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30418 }
30419 
ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30420 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30421 {
30422 	return zend_binary_assign_op_helper_SPEC_CV_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30423 }
30424 
ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30425 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30426 {
30427 	return zend_binary_assign_op_helper_SPEC_CV_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30428 }
30429 
ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30430 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30431 {
30432 	return zend_binary_assign_op_helper_SPEC_CV_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30433 }
30434 
ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30435 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30436 {
30437 	return zend_binary_assign_op_helper_SPEC_CV_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30438 }
30439 
ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30440 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30441 {
30442 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30443 }
30444 
ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30445 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30446 {
30447 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30448 }
30449 
ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30450 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30451 {
30452 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30453 }
30454 
zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)30455 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
30456 {
30457 	USE_OPLINE
30458 	zend_free_op free_op2;
30459 	zval **object_ptr;
30460 	zval *object;
30461 	zval *property;
30462 	zval **retval;
30463 	int have_get_ptr = 0;
30464 
30465 	SAVE_OPLINE();
30466 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30467 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30468 	retval = &EX_T(opline->result.var).var.ptr;
30469 
30470 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
30471 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30472 	}
30473 
30474 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
30475 	object = *object_ptr;
30476 
30477 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
30478 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
30479 		zval_dtor(free_op2.var);
30480 		if (RETURN_VALUE_USED(opline)) {
30481 			PZVAL_LOCK(&EG(uninitialized_zval));
30482 			*retval = &EG(uninitialized_zval);
30483 		}
30484 
30485 		CHECK_EXCEPTION();
30486 		ZEND_VM_NEXT_OPCODE();
30487 	}
30488 
30489 	/* here we are sure we are dealing with an object */
30490 
30491 	if (1) {
30492 		MAKE_REAL_ZVAL_PTR(property);
30493 	}
30494 
30495 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
30496 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30497 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
30498 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
30499 
30500 			have_get_ptr = 1;
30501 			incdec_op(*zptr);
30502 			if (RETURN_VALUE_USED(opline)) {
30503 				*retval = *zptr;
30504 				PZVAL_LOCK(*retval);
30505 			}
30506 		}
30507 	}
30508 
30509 	if (!have_get_ptr) {
30510 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
30511 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30512 
30513 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
30514 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
30515 
30516 				if (Z_REFCOUNT_P(z) == 0) {
30517 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
30518 					zval_dtor(z);
30519 					FREE_ZVAL(z);
30520 				}
30521 				z = value;
30522 			}
30523 			Z_ADDREF_P(z);
30524 			SEPARATE_ZVAL_IF_NOT_REF(&z);
30525 			incdec_op(z);
30526 			*retval = z;
30527 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30528 			SELECTIVE_PZVAL_LOCK(*retval, opline);
30529 			zval_ptr_dtor(&z);
30530 		} else {
30531 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
30532 			if (RETURN_VALUE_USED(opline)) {
30533 				PZVAL_LOCK(&EG(uninitialized_zval));
30534 				*retval = &EG(uninitialized_zval);
30535 			}
30536 		}
30537 	}
30538 
30539 	if (1) {
30540 		zval_ptr_dtor(&property);
30541 	} else {
30542 		zval_dtor(free_op2.var);
30543 	}
30544 
30545 	CHECK_EXCEPTION();
30546 	ZEND_VM_NEXT_OPCODE();
30547 }
30548 
ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30549 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30550 {
30551 	return zend_pre_incdec_property_helper_SPEC_CV_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30552 }
30553 
ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30554 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30555 {
30556 	return zend_pre_incdec_property_helper_SPEC_CV_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30557 }
30558 
zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)30559 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
30560 {
30561 	USE_OPLINE
30562 	zend_free_op free_op2;
30563 	zval **object_ptr;
30564 	zval *object;
30565 	zval *property;
30566 	zval *retval;
30567 	int have_get_ptr = 0;
30568 
30569 	SAVE_OPLINE();
30570 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30571 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30572 	retval = &EX_T(opline->result.var).tmp_var;
30573 
30574 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
30575 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30576 	}
30577 
30578 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
30579 	object = *object_ptr;
30580 
30581 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
30582 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
30583 		zval_dtor(free_op2.var);
30584 		ZVAL_NULL(retval);
30585 
30586 		CHECK_EXCEPTION();
30587 		ZEND_VM_NEXT_OPCODE();
30588 	}
30589 
30590 	/* here we are sure we are dealing with an object */
30591 
30592 	if (1) {
30593 		MAKE_REAL_ZVAL_PTR(property);
30594 	}
30595 
30596 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
30597 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30598 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
30599 			have_get_ptr = 1;
30600 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
30601 
30602 			ZVAL_COPY_VALUE(retval, *zptr);
30603 			zendi_zval_copy_ctor(*retval);
30604 
30605 			incdec_op(*zptr);
30606 
30607 		}
30608 	}
30609 
30610 	if (!have_get_ptr) {
30611 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
30612 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30613 			zval *z_copy;
30614 
30615 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
30616 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
30617 
30618 				if (Z_REFCOUNT_P(z) == 0) {
30619 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
30620 					zval_dtor(z);
30621 					FREE_ZVAL(z);
30622 				}
30623 				z = value;
30624 			}
30625 			ZVAL_COPY_VALUE(retval, z);
30626 			zendi_zval_copy_ctor(*retval);
30627 			ALLOC_ZVAL(z_copy);
30628 			INIT_PZVAL_COPY(z_copy, z);
30629 			zendi_zval_copy_ctor(*z_copy);
30630 			incdec_op(z_copy);
30631 			Z_ADDREF_P(z);
30632 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30633 			zval_ptr_dtor(&z_copy);
30634 			zval_ptr_dtor(&z);
30635 		} else {
30636 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
30637 			ZVAL_NULL(retval);
30638 		}
30639 	}
30640 
30641 	if (1) {
30642 		zval_ptr_dtor(&property);
30643 	} else {
30644 		zval_dtor(free_op2.var);
30645 	}
30646 
30647 	CHECK_EXCEPTION();
30648 	ZEND_VM_NEXT_OPCODE();
30649 }
30650 
ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30651 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30652 {
30653 	return zend_post_incdec_property_helper_SPEC_CV_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30654 }
30655 
ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30656 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30657 {
30658 	return zend_post_incdec_property_helper_SPEC_CV_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30659 }
30660 
ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30661 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30662 {
30663 	USE_OPLINE
30664 	zend_free_op free_op2;
30665 	zval *container;
30666 
30667 	SAVE_OPLINE();
30668 
30669 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
30670 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
30671 	}
30672 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
30673 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
30674 	zval_dtor(free_op2.var);
30675 
30676 	CHECK_EXCEPTION();
30677 	ZEND_VM_NEXT_OPCODE();
30678 }
30679 
ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30680 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30681 {
30682 	USE_OPLINE
30683 	zend_free_op free_op1, free_op2;
30684 	zval **container;
30685 
30686 	SAVE_OPLINE();
30687 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
30688 
30689 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30690 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
30691 	}
30692 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
30693 	zval_dtor(free_op2.var);
30694 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30695 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30696 	}
30697 
30698 	/* We are going to assign the result by reference */
30699 	if (UNEXPECTED(opline->extended_value != 0)) {
30700 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
30701 
30702 		if (retval_ptr) {
30703 			Z_DELREF_PP(retval_ptr);
30704 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
30705 			Z_ADDREF_PP(retval_ptr);
30706 		}
30707 	}
30708 
30709 	CHECK_EXCEPTION();
30710 	ZEND_VM_NEXT_OPCODE();
30711 }
30712 
ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30713 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30714 {
30715 	USE_OPLINE
30716 	zend_free_op free_op1, free_op2;
30717 	zval **container;
30718 
30719 	SAVE_OPLINE();
30720 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30721 
30722 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30723 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
30724 	}
30725 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
30726 	zval_dtor(free_op2.var);
30727 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30728 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30729 	}
30730 
30731 	CHECK_EXCEPTION();
30732 	ZEND_VM_NEXT_OPCODE();
30733 }
30734 
ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30735 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30736 {
30737 	USE_OPLINE
30738 	zend_free_op free_op2;
30739 	zval *container;
30740 
30741 	SAVE_OPLINE();
30742 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
30743 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_IS TSRMLS_CC);
30744 	zval_dtor(free_op2.var);
30745 
30746 	CHECK_EXCEPTION();
30747 	ZEND_VM_NEXT_OPCODE();
30748 }
30749 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30750 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30751 {
30752 	USE_OPLINE
30753 	zend_free_op free_op1, free_op2;
30754 
30755 	SAVE_OPLINE();
30756 
30757 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
30758 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
30759 
30760 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30761 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
30762 		}
30763 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
30764 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30765 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30766 		}
30767 		zval_dtor(free_op2.var);
30768 
30769 	} else {
30770 		zval *container;
30771 
30772 		if (IS_TMP_VAR == IS_UNUSED) {
30773 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
30774 		}
30775 		container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
30776 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
30777 		zval_dtor(free_op2.var);
30778 
30779 	}
30780 	CHECK_EXCEPTION();
30781 	ZEND_VM_NEXT_OPCODE();
30782 }
30783 
ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30784 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30785 {
30786 	USE_OPLINE
30787 	zend_free_op free_op1, free_op2;
30788 	zval **container;
30789 
30790 	SAVE_OPLINE();
30791 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
30792 
30793 	if (IS_CV == IS_CV) {
30794 		if (container != &EG(uninitialized_zval_ptr)) {
30795 			SEPARATE_ZVAL_IF_NOT_REF(container);
30796 		}
30797 	}
30798 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30799 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
30800 	}
30801 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_UNSET TSRMLS_CC);
30802 	zval_dtor(free_op2.var);
30803 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30804 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30805 	}
30806 
30807 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
30808 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
30809 	} else {
30810 		zend_free_op free_res;
30811 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
30812 
30813 		PZVAL_UNLOCK(*retval_ptr, &free_res);
30814 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
30815 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
30816 		}
30817 		PZVAL_LOCK(*retval_ptr);
30818 		FREE_OP_VAR_PTR(free_res);
30819 		CHECK_EXCEPTION();
30820 		ZEND_VM_NEXT_OPCODE();
30821 	}
30822 }
30823 
zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS)30824 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS)
30825 {
30826 	USE_OPLINE
30827 
30828 	zval *container;
30829 	zend_free_op free_op2;
30830 	zval *offset;
30831 
30832 	SAVE_OPLINE();
30833 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
30834 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30835 
30836 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
30837 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
30838 		zend_error(E_NOTICE, "Trying to get property of non-object");
30839 		PZVAL_LOCK(&EG(uninitialized_zval));
30840 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
30841 		zval_dtor(free_op2.var);
30842 	} else {
30843 		zval *retval;
30844 
30845 		if (1) {
30846 			MAKE_REAL_ZVAL_PTR(offset);
30847 		}
30848 
30849 		/* here we are sure we are dealing with an object */
30850 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30851 
30852 		PZVAL_LOCK(retval);
30853 		AI_SET_PTR(&EX_T(opline->result.var), retval);
30854 
30855 		if (1) {
30856 			zval_ptr_dtor(&offset);
30857 		} else {
30858 			zval_dtor(free_op2.var);
30859 		}
30860 	}
30861 
30862 	CHECK_EXCEPTION();
30863 	ZEND_VM_NEXT_OPCODE();
30864 }
30865 
ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30866 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30867 {
30868 	return zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30869 }
30870 
ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30871 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30872 {
30873 	USE_OPLINE
30874 	zend_free_op free_op1, free_op2;
30875 	zval *property;
30876 	zval **container;
30877 
30878 	SAVE_OPLINE();
30879 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30880 
30881 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
30882 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
30883 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
30884 	}
30885 
30886 	if (1) {
30887 		MAKE_REAL_ZVAL_PTR(property);
30888 	}
30889 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
30890 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30891 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
30892 	}
30893 
30894 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
30895 	if (1) {
30896 		zval_ptr_dtor(&property);
30897 	} else {
30898 		zval_dtor(free_op2.var);
30899 	}
30900 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30901 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30902 	}
30903 
30904 	/* We are going to assign the result by reference */
30905 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
30906 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
30907 
30908 		Z_DELREF_PP(retval_ptr);
30909 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
30910 		Z_ADDREF_PP(retval_ptr);
30911 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
30912 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
30913 	}
30914 
30915 	CHECK_EXCEPTION();
30916 	ZEND_VM_NEXT_OPCODE();
30917 }
30918 
ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30919 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30920 {
30921 	USE_OPLINE
30922 	zend_free_op free_op1, free_op2;
30923 	zval *property;
30924 	zval **container;
30925 
30926 	SAVE_OPLINE();
30927 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30928 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
30929 
30930 	if (1) {
30931 		MAKE_REAL_ZVAL_PTR(property);
30932 	}
30933 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
30934 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
30935 	}
30936 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
30937 	if (1) {
30938 		zval_ptr_dtor(&property);
30939 	} else {
30940 		zval_dtor(free_op2.var);
30941 	}
30942 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
30943 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
30944 	}
30945 
30946 	CHECK_EXCEPTION();
30947 	ZEND_VM_NEXT_OPCODE();
30948 }
30949 
ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30950 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30951 {
30952 	USE_OPLINE
30953 
30954 	zval *container;
30955 	zend_free_op free_op2;
30956 	zval *offset;
30957 
30958 	SAVE_OPLINE();
30959 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
30960 	offset  = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
30961 
30962 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
30963 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
30964 		PZVAL_LOCK(&EG(uninitialized_zval));
30965 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
30966 		zval_dtor(free_op2.var);
30967 	} else {
30968 		zval *retval;
30969 
30970 		if (1) {
30971 			MAKE_REAL_ZVAL_PTR(offset);
30972 		}
30973 
30974 		/* here we are sure we are dealing with an object */
30975 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
30976 
30977 		PZVAL_LOCK(retval);
30978 		AI_SET_PTR(&EX_T(opline->result.var), retval);
30979 
30980 		if (1) {
30981 			zval_ptr_dtor(&offset);
30982 		} else {
30983 			zval_dtor(free_op2.var);
30984 		}
30985 	}
30986 
30987 	CHECK_EXCEPTION();
30988 	ZEND_VM_NEXT_OPCODE();
30989 }
30990 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30991 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30992 {
30993 	USE_OPLINE
30994 
30995 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
30996 		/* Behave like FETCH_OBJ_W */
30997 		zend_free_op free_op1, free_op2;
30998 		zval *property;
30999 		zval **container;
31000 
31001 		SAVE_OPLINE();
31002 		property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31003 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
31004 
31005 		if (1) {
31006 			MAKE_REAL_ZVAL_PTR(property);
31007 		}
31008 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
31009 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
31010 		}
31011 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
31012 		if (1) {
31013 			zval_ptr_dtor(&property);
31014 		} else {
31015 			zval_dtor(free_op2.var);
31016 		}
31017 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
31018 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
31019 		}
31020 
31021 		CHECK_EXCEPTION();
31022 		ZEND_VM_NEXT_OPCODE();
31023 	} else {
31024 		return zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31025 	}
31026 }
31027 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31028 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31029 {
31030 	USE_OPLINE
31031 	zend_free_op free_op1, free_op2, free_res;
31032 	zval **container;
31033 	zval *property;
31034 
31035 	SAVE_OPLINE();
31036 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
31037 	property = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31038 
31039 	if (IS_CV == IS_CV) {
31040 		if (container != &EG(uninitialized_zval_ptr)) {
31041 			SEPARATE_ZVAL_IF_NOT_REF(container);
31042 		}
31043 	}
31044 	if (1) {
31045 		MAKE_REAL_ZVAL_PTR(property);
31046 	}
31047 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
31048 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
31049 	}
31050 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
31051 	if (1) {
31052 		zval_ptr_dtor(&property);
31053 	} else {
31054 		zval_dtor(free_op2.var);
31055 	}
31056 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
31057 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
31058 	}
31059 
31060 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
31061 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
31062 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
31063 	}
31064 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
31065 	FREE_OP_VAR_PTR(free_res);
31066 	CHECK_EXCEPTION();
31067 	ZEND_VM_NEXT_OPCODE();
31068 }
31069 
ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31070 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31071 {
31072 	USE_OPLINE
31073 	zend_free_op free_op2;
31074 	zval **object_ptr;
31075 	zval *property_name;
31076 
31077 	SAVE_OPLINE();
31078 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
31079 	property_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31080 
31081 	if (1) {
31082 		MAKE_REAL_ZVAL_PTR(property_name);
31083 	}
31084 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
31085 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
31086 	}
31087 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31088 	if (1) {
31089 		zval_ptr_dtor(&property_name);
31090 	} else {
31091 		zval_dtor(free_op2.var);
31092 	}
31093 
31094 	/* assign_obj has two opcodes! */
31095 	CHECK_EXCEPTION();
31096 	ZEND_VM_INC_OPCODE();
31097 	ZEND_VM_NEXT_OPCODE();
31098 }
31099 
ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31100 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31101 {
31102 	USE_OPLINE
31103 
31104 	zval **object_ptr;
31105 
31106 	SAVE_OPLINE();
31107 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
31108 
31109 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
31110 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
31111 	}
31112 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
31113 		zend_free_op free_op2;
31114 		zval *property_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31115 
31116 		if (1) {
31117 			MAKE_REAL_ZVAL_PTR(property_name);
31118 		}
31119 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31120 		if (1) {
31121 			zval_ptr_dtor(&property_name);
31122 		} else {
31123 			zval_dtor(free_op2.var);
31124 		}
31125 	} else {
31126 		zend_free_op free_op2, free_op_data1, free_op_data2;
31127 		zval *value;
31128 		zval *dim = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31129 		zval **variable_ptr_ptr;
31130 
31131 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
31132 		zval_dtor(free_op2.var);
31133 
31134 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
31135 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
31136 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
31137 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
31138 				if (RETURN_VALUE_USED(opline)) {
31139 					zval *retval;
31140 
31141 					ALLOC_ZVAL(retval);
31142 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
31143 					INIT_PZVAL(retval);
31144 					AI_SET_PTR(&EX_T(opline->result.var), retval);
31145 				}
31146 			} else if (RETURN_VALUE_USED(opline)) {
31147 				PZVAL_LOCK(&EG(uninitialized_zval));
31148 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
31149 			}
31150 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
31151 			if (IS_TMP_FREE(free_op_data1)) {
31152 				zval_dtor(value);
31153 			}
31154 			if (RETURN_VALUE_USED(opline)) {
31155 				PZVAL_LOCK(&EG(uninitialized_zval));
31156 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
31157 			}
31158 		} else {
31159 			if ((opline+1)->op1_type == IS_TMP_VAR) {
31160 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31161 			} else if ((opline+1)->op1_type == IS_CONST) {
31162 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31163 			} else {
31164 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31165 			}
31166 			if (RETURN_VALUE_USED(opline)) {
31167 				PZVAL_LOCK(value);
31168 				AI_SET_PTR(&EX_T(opline->result.var), value);
31169 			}
31170 		}
31171 		FREE_OP_VAR_PTR(free_op_data2);
31172 	 	FREE_OP_IF_VAR(free_op_data1);
31173 	}
31174 
31175 	/* assign_dim has two opcodes! */
31176 	CHECK_EXCEPTION();
31177 	ZEND_VM_INC_OPCODE();
31178 	ZEND_VM_NEXT_OPCODE();
31179 }
31180 
ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31181 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31182 {
31183 	USE_OPLINE
31184 	zend_free_op free_op2;
31185 	zval *value;
31186 	zval **variable_ptr_ptr;
31187 
31188 	SAVE_OPLINE();
31189 	value = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31190 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
31191 
31192 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
31193 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_TMP_VAR TSRMLS_CC)) {
31194 			if (RETURN_VALUE_USED(opline)) {
31195 				zval *retval;
31196 
31197 				ALLOC_ZVAL(retval);
31198 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
31199 				INIT_PZVAL(retval);
31200 				AI_SET_PTR(&EX_T(opline->result.var), retval);
31201 			}
31202 		} else if (RETURN_VALUE_USED(opline)) {
31203 			PZVAL_LOCK(&EG(uninitialized_zval));
31204 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
31205 		}
31206 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
31207 		if (1) {
31208 			zval_dtor(value);
31209 		}
31210 		if (RETURN_VALUE_USED(opline)) {
31211 			PZVAL_LOCK(&EG(uninitialized_zval));
31212 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
31213 		}
31214 	} else {
31215 		if (IS_TMP_VAR == IS_TMP_VAR) {
31216 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31217 		} else if (IS_TMP_VAR == IS_CONST) {
31218 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31219 		} else {
31220 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
31221 		}
31222 		if (RETURN_VALUE_USED(opline)) {
31223 			PZVAL_LOCK(value);
31224 			AI_SET_PTR(&EX_T(opline->result.var), value);
31225 		}
31226 	}
31227 
31228 	/* zend_assign_to_variable() always takes care of op2, never free it! */
31229 
31230 	CHECK_EXCEPTION();
31231 	ZEND_VM_NEXT_OPCODE();
31232 }
31233 
ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31234 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31235 {
31236 	USE_OPLINE
31237 	zval *function_name;
31238 	char *function_name_strval;
31239 	int function_name_strlen;
31240 	zend_free_op free_op2;
31241 
31242 	SAVE_OPLINE();
31243 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
31244 
31245 	function_name = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31246 
31247 	if (IS_TMP_VAR != IS_CONST &&
31248 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
31249 		zend_error_noreturn(E_ERROR, "Method name must be a string");
31250 	}
31251 
31252 	function_name_strval = Z_STRVAL_P(function_name);
31253 	function_name_strlen = Z_STRLEN_P(function_name);
31254 
31255 	EX(object) = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
31256 
31257 	if (EXPECTED(EX(object) != NULL) &&
31258 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
31259 		EX(called_scope) = Z_OBJCE_P(EX(object));
31260 
31261 		if (IS_TMP_VAR != IS_CONST ||
31262 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
31263 		    zval *object = EX(object);
31264 
31265 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
31266 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
31267 			}
31268 
31269 			/* First, locate the function. */
31270 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
31271 			if (UNEXPECTED(EX(fbc) == NULL)) {
31272 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
31273 			}
31274 			if (IS_TMP_VAR == IS_CONST &&
31275 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
31276 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
31277 			    EXPECTED(EX(object) == object)) {
31278 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
31279 			}
31280 		}
31281 	} else {
31282 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
31283 	}
31284 
31285 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
31286 		EX(object) = NULL;
31287 	} else {
31288 		if (!PZVAL_IS_REF(EX(object))) {
31289 			Z_ADDREF_P(EX(object)); /* For $this pointer */
31290 		} else {
31291 			zval *this_ptr;
31292 			ALLOC_ZVAL(this_ptr);
31293 			INIT_PZVAL_COPY(this_ptr, EX(object));
31294 			zval_copy_ctor(this_ptr);
31295 			EX(object) = this_ptr;
31296 		}
31297 	}
31298 
31299 	zval_dtor(free_op2.var);
31300 
31301 	CHECK_EXCEPTION();
31302 	ZEND_VM_NEXT_OPCODE();
31303 }
31304 
ZEND_CASE_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31305 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31306 {
31307 	USE_OPLINE
31308 	zend_free_op free_op2;
31309 
31310 	SAVE_OPLINE();
31311 	if (IS_CV==IS_VAR) {
31312 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
31313 	}
31314 	is_equal_function(&EX_T(opline->result.var).tmp_var,
31315 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31316 				 _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31317 
31318 	zval_dtor(free_op2.var);
31319 	CHECK_EXCEPTION();
31320 	ZEND_VM_NEXT_OPCODE();
31321 }
31322 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31323 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31324 {
31325 	USE_OPLINE
31326 
31327 	zval *expr_ptr;
31328 
31329 	SAVE_OPLINE();
31330 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
31331 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
31332 
31333 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
31334 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
31335 		}
31336 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
31337 		expr_ptr = *expr_ptr_ptr;
31338 		Z_ADDREF_P(expr_ptr);
31339 	} else {
31340 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
31341 		if (0) { /* temporary variable */
31342 			zval *new_expr;
31343 
31344 			ALLOC_ZVAL(new_expr);
31345 			INIT_PZVAL_COPY(new_expr, expr_ptr);
31346 			expr_ptr = new_expr;
31347 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
31348 			zval *new_expr;
31349 
31350 			ALLOC_ZVAL(new_expr);
31351 			INIT_PZVAL_COPY(new_expr, expr_ptr);
31352 			expr_ptr = new_expr;
31353 			zendi_zval_copy_ctor(*expr_ptr);
31354 		} else {
31355 			Z_ADDREF_P(expr_ptr);
31356 		}
31357 	}
31358 
31359 	if (IS_TMP_VAR != IS_UNUSED) {
31360 		zend_free_op free_op2;
31361 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31362 		ulong hval;
31363 
31364 		switch (Z_TYPE_P(offset)) {
31365 			case IS_DOUBLE:
31366 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
31367 				goto num_index;
31368 			case IS_LONG:
31369 			case IS_BOOL:
31370 				hval = Z_LVAL_P(offset);
31371 num_index:
31372 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
31373 				break;
31374 			case IS_STRING:
31375 				if (IS_TMP_VAR == IS_CONST) {
31376 					hval = Z_HASH_P(offset);
31377 				} else {
31378 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
31379 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
31380 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
31381 					} else {
31382 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
31383 					}
31384 				}
31385 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
31386 				break;
31387 			case IS_NULL:
31388 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
31389 				break;
31390 			default:
31391 				zend_error(E_WARNING, "Illegal offset type");
31392 				zval_ptr_dtor(&expr_ptr);
31393 				/* do nothing */
31394 				break;
31395 		}
31396 		zval_dtor(free_op2.var);
31397 	} else {
31398 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
31399 	}
31400 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
31401 
31402 	} else {
31403 
31404 	}
31405 	CHECK_EXCEPTION();
31406 	ZEND_VM_NEXT_OPCODE();
31407 }
31408 
ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31409 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31410 {
31411 	USE_OPLINE
31412 
31413 	array_init(&EX_T(opline->result.var).tmp_var);
31414 	if (IS_CV == IS_UNUSED) {
31415 		ZEND_VM_NEXT_OPCODE();
31416 #if 0 || IS_CV != IS_UNUSED
31417 	} else {
31418 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31419 #endif
31420 	}
31421 }
31422 
ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31423 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31424 {
31425 	USE_OPLINE
31426 	zend_free_op free_op2;
31427 	zval **container;
31428 	zval *offset;
31429 	ulong hval;
31430 
31431 	SAVE_OPLINE();
31432 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
31433 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
31434 		SEPARATE_ZVAL_IF_NOT_REF(container);
31435 	}
31436 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31437 
31438 	if (IS_CV != IS_VAR || container) {
31439 		switch (Z_TYPE_PP(container)) {
31440 			case IS_ARRAY: {
31441 				HashTable *ht = Z_ARRVAL_PP(container);
31442 
31443 				switch (Z_TYPE_P(offset)) {
31444 					case IS_DOUBLE:
31445 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
31446 						zend_hash_index_del(ht, hval);
31447 						break;
31448 					case IS_RESOURCE:
31449 					case IS_BOOL:
31450 					case IS_LONG:
31451 						hval = Z_LVAL_P(offset);
31452 						zend_hash_index_del(ht, hval);
31453 						break;
31454 					case IS_STRING:
31455 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
31456 							Z_ADDREF_P(offset);
31457 						}
31458 						if (IS_TMP_VAR == IS_CONST) {
31459 							hval = Z_HASH_P(offset);
31460 						} else {
31461 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
31462 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
31463 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
31464 							} else {
31465 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
31466 							}
31467 						}
31468 						if (ht == &EG(symbol_table)) {
31469 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
31470 						} else {
31471 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
31472 						}
31473 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
31474 							zval_ptr_dtor(&offset);
31475 						}
31476 						break;
31477 num_index_dim:
31478 						zend_hash_index_del(ht, hval);
31479 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
31480 							zval_ptr_dtor(&offset);
31481 						}
31482 						break;
31483 					case IS_NULL:
31484 						zend_hash_del(ht, "", sizeof(""));
31485 						break;
31486 					default:
31487 						zend_error(E_WARNING, "Illegal offset type in unset");
31488 						break;
31489 				}
31490 				zval_dtor(free_op2.var);
31491 				break;
31492 			}
31493 			case IS_OBJECT:
31494 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
31495 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
31496 				}
31497 				if (1) {
31498 					MAKE_REAL_ZVAL_PTR(offset);
31499 				}
31500 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
31501 				if (1) {
31502 					zval_ptr_dtor(&offset);
31503 				} else {
31504 					zval_dtor(free_op2.var);
31505 				}
31506 				break;
31507 			case IS_STRING:
31508 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
31509 				ZEND_VM_CONTINUE(); /* bailed out before */
31510 			default:
31511 				zval_dtor(free_op2.var);
31512 				break;
31513 		}
31514 	} else {
31515 		zval_dtor(free_op2.var);
31516 	}
31517 
31518 	CHECK_EXCEPTION();
31519 	ZEND_VM_NEXT_OPCODE();
31520 }
31521 
ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31522 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31523 {
31524 	USE_OPLINE
31525 	zend_free_op free_op2;
31526 	zval **container;
31527 	zval *offset;
31528 
31529 	SAVE_OPLINE();
31530 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
31531 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31532 
31533 	if (IS_CV != IS_VAR || container) {
31534 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
31535 			SEPARATE_ZVAL_IF_NOT_REF(container);
31536 		}
31537 		if (Z_TYPE_PP(container) == IS_OBJECT) {
31538 			if (1) {
31539 				MAKE_REAL_ZVAL_PTR(offset);
31540 			}
31541 			if (Z_OBJ_HT_P(*container)->unset_property) {
31542 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31543 			} else {
31544 				zend_error(E_NOTICE, "Trying to unset property of non-object");
31545 			}
31546 			if (1) {
31547 				zval_ptr_dtor(&offset);
31548 			} else {
31549 				zval_dtor(free_op2.var);
31550 			}
31551 		} else {
31552 			zval_dtor(free_op2.var);
31553 		}
31554 	} else {
31555 		zval_dtor(free_op2.var);
31556 	}
31557 
31558 	CHECK_EXCEPTION();
31559 	ZEND_VM_NEXT_OPCODE();
31560 }
31561 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)31562 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
31563 {
31564 	USE_OPLINE
31565 	zend_free_op free_op2;
31566 	zval **container;
31567 	zval **value = NULL;
31568 	int result = 0;
31569 	ulong hval;
31570 	zval *offset;
31571 
31572 	SAVE_OPLINE();
31573 	container = _get_zval_ptr_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
31574 
31575 	offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31576 
31577 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
31578 		HashTable *ht;
31579 		int isset = 0;
31580 
31581 		ht = Z_ARRVAL_PP(container);
31582 
31583 		switch (Z_TYPE_P(offset)) {
31584 			case IS_DOUBLE:
31585 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
31586 				goto num_index_prop;
31587 			case IS_RESOURCE:
31588 			case IS_BOOL:
31589 			case IS_LONG:
31590 				hval = Z_LVAL_P(offset);
31591 num_index_prop:
31592 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
31593 					isset = 1;
31594 				}
31595 				break;
31596 			case IS_STRING:
31597 				if (IS_TMP_VAR == IS_CONST) {
31598 					hval = Z_HASH_P(offset);
31599 				} else {
31600 					if (!prop_dim) {
31601 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
31602 					}
31603 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
31604 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
31605 					} else {
31606 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
31607 					}
31608 				}
31609 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
31610 					isset = 1;
31611 				}
31612 				break;
31613 			case IS_NULL:
31614 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
31615 					isset = 1;
31616 				}
31617 				break;
31618 			default:
31619 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
31620 				break;
31621 		}
31622 
31623 		if (opline->extended_value & ZEND_ISSET) {
31624 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
31625 				result = 0;
31626 			} else {
31627 				result = isset;
31628 			}
31629 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
31630 			if (!isset || !i_zend_is_true(*value)) {
31631 				result = 0;
31632 			} else {
31633 				result = 1;
31634 			}
31635 		}
31636 		zval_dtor(free_op2.var);
31637 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
31638 		if (1) {
31639 			MAKE_REAL_ZVAL_PTR(offset);
31640 		}
31641 		if (prop_dim) {
31642 			if (Z_OBJ_HT_P(*container)->has_property) {
31643 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31644 			} else {
31645 				zend_error(E_NOTICE, "Trying to check property of non-object");
31646 				result = 0;
31647 			}
31648 		} else {
31649 			if (Z_OBJ_HT_P(*container)->has_dimension) {
31650 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
31651 			} else {
31652 				zend_error(E_NOTICE, "Trying to check element of non-array");
31653 				result = 0;
31654 			}
31655 		}
31656 		if (1) {
31657 			zval_ptr_dtor(&offset);
31658 		} else {
31659 			zval_dtor(free_op2.var);
31660 		}
31661 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
31662 		zval tmp;
31663 
31664 		if (Z_TYPE_P(offset) != IS_LONG) {
31665 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
31666 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
31667 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
31668 				ZVAL_COPY_VALUE(&tmp, offset);
31669 				zval_copy_ctor(&tmp);
31670 				convert_to_long(&tmp);
31671 				offset = &tmp;
31672 			} else {
31673 				/* can not be converted to proper offset, return "not set" */
31674 				result = 0;
31675 			}
31676 		}
31677 		if (Z_TYPE_P(offset) == IS_LONG) {
31678 			if (opline->extended_value & ZEND_ISSET) {
31679 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
31680 					result = 1;
31681 				}
31682 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
31683 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
31684 					result = 1;
31685 				}
31686 			}
31687 		}
31688 		zval_dtor(free_op2.var);
31689 	} else {
31690 		zval_dtor(free_op2.var);
31691 	}
31692 
31693 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
31694 	if (opline->extended_value & ZEND_ISSET) {
31695 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
31696 	} else {
31697 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
31698 	}
31699 
31700 	CHECK_EXCEPTION();
31701 	ZEND_VM_NEXT_OPCODE();
31702 }
31703 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31704 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31705 {
31706 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31707 }
31708 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31709 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31710 {
31711 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31712 }
31713 
ZEND_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31714 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31715 {
31716 	USE_OPLINE
31717 	zend_free_op free_op2;
31718 
31719 	SAVE_OPLINE();
31720 	fast_add_function(&EX_T(opline->result.var).tmp_var,
31721 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31722 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31723 
31724 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31725 	CHECK_EXCEPTION();
31726 	ZEND_VM_NEXT_OPCODE();
31727 }
31728 
ZEND_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31729 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31730 {
31731 	USE_OPLINE
31732 	zend_free_op free_op2;
31733 
31734 	SAVE_OPLINE();
31735 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
31736 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31737 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31738 
31739 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31740 	CHECK_EXCEPTION();
31741 	ZEND_VM_NEXT_OPCODE();
31742 }
31743 
ZEND_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31744 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31745 {
31746 	USE_OPLINE
31747 	zend_free_op free_op2;
31748 
31749 	SAVE_OPLINE();
31750 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
31751 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31752 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31753 
31754 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31755 	CHECK_EXCEPTION();
31756 	ZEND_VM_NEXT_OPCODE();
31757 }
31758 
ZEND_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31759 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31760 {
31761 	USE_OPLINE
31762 	zend_free_op free_op2;
31763 
31764 	SAVE_OPLINE();
31765 	fast_div_function(&EX_T(opline->result.var).tmp_var,
31766 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31767 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31768 
31769 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31770 	CHECK_EXCEPTION();
31771 	ZEND_VM_NEXT_OPCODE();
31772 }
31773 
ZEND_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31774 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31775 {
31776 	USE_OPLINE
31777 	zend_free_op free_op2;
31778 
31779 	SAVE_OPLINE();
31780 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
31781 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31782 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31783 
31784 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31785 	CHECK_EXCEPTION();
31786 	ZEND_VM_NEXT_OPCODE();
31787 }
31788 
ZEND_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31789 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31790 {
31791 	USE_OPLINE
31792 	zend_free_op free_op2;
31793 
31794 	SAVE_OPLINE();
31795 	shift_left_function(&EX_T(opline->result.var).tmp_var,
31796 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31797 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31798 
31799 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31800 	CHECK_EXCEPTION();
31801 	ZEND_VM_NEXT_OPCODE();
31802 }
31803 
ZEND_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31804 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31805 {
31806 	USE_OPLINE
31807 	zend_free_op free_op2;
31808 
31809 	SAVE_OPLINE();
31810 	shift_right_function(&EX_T(opline->result.var).tmp_var,
31811 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31812 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31813 
31814 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31815 	CHECK_EXCEPTION();
31816 	ZEND_VM_NEXT_OPCODE();
31817 }
31818 
ZEND_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31819 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31820 {
31821 	USE_OPLINE
31822 	zend_free_op free_op2;
31823 
31824 	SAVE_OPLINE();
31825 	concat_function(&EX_T(opline->result.var).tmp_var,
31826 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31827 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31828 
31829 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31830 	CHECK_EXCEPTION();
31831 	ZEND_VM_NEXT_OPCODE();
31832 }
31833 
ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31834 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31835 {
31836 	USE_OPLINE
31837 	zend_free_op free_op2;
31838 
31839 	SAVE_OPLINE();
31840 	is_identical_function(&EX_T(opline->result.var).tmp_var,
31841 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31842 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31843 
31844 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31845 	CHECK_EXCEPTION();
31846 	ZEND_VM_NEXT_OPCODE();
31847 }
31848 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31849 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31850 {
31851 	USE_OPLINE
31852 	zend_free_op free_op2;
31853 	zval *result = &EX_T(opline->result.var).tmp_var;
31854 
31855 	SAVE_OPLINE();
31856 	is_identical_function(result,
31857 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31858 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31859 	Z_LVAL_P(result) = !Z_LVAL_P(result);
31860 
31861 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31862 	CHECK_EXCEPTION();
31863 	ZEND_VM_NEXT_OPCODE();
31864 }
31865 
ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31866 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31867 {
31868 	USE_OPLINE
31869 	zend_free_op free_op2;
31870 	zval *result = &EX_T(opline->result.var).tmp_var;
31871 
31872 	SAVE_OPLINE();
31873 	ZVAL_BOOL(result, fast_equal_function(result,
31874 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31875 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
31876 
31877 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31878 	CHECK_EXCEPTION();
31879 	ZEND_VM_NEXT_OPCODE();
31880 }
31881 
ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31882 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31883 {
31884 	USE_OPLINE
31885 	zend_free_op free_op2;
31886 	zval *result = &EX_T(opline->result.var).tmp_var;
31887 
31888 	SAVE_OPLINE();
31889 	ZVAL_BOOL(result, fast_not_equal_function(result,
31890 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31891 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
31892 
31893 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31894 	CHECK_EXCEPTION();
31895 	ZEND_VM_NEXT_OPCODE();
31896 }
31897 
ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31898 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31899 {
31900 	USE_OPLINE
31901 	zend_free_op free_op2;
31902 	zval *result = &EX_T(opline->result.var).tmp_var;
31903 
31904 	SAVE_OPLINE();
31905 	ZVAL_BOOL(result, fast_is_smaller_function(result,
31906 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31907 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
31908 
31909 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31910 	CHECK_EXCEPTION();
31911 	ZEND_VM_NEXT_OPCODE();
31912 }
31913 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31914 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31915 {
31916 	USE_OPLINE
31917 	zend_free_op free_op2;
31918 	zval *result = &EX_T(opline->result.var).tmp_var;
31919 
31920 	SAVE_OPLINE();
31921 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
31922 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31923 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC));
31924 
31925 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31926 	CHECK_EXCEPTION();
31927 	ZEND_VM_NEXT_OPCODE();
31928 }
31929 
ZEND_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31930 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31931 {
31932 	USE_OPLINE
31933 	zend_free_op free_op2;
31934 
31935 	SAVE_OPLINE();
31936 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
31937 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31938 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31939 
31940 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31941 	CHECK_EXCEPTION();
31942 	ZEND_VM_NEXT_OPCODE();
31943 }
31944 
ZEND_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31945 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31946 {
31947 	USE_OPLINE
31948 	zend_free_op free_op2;
31949 
31950 	SAVE_OPLINE();
31951 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
31952 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31953 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31954 
31955 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31956 	CHECK_EXCEPTION();
31957 	ZEND_VM_NEXT_OPCODE();
31958 }
31959 
ZEND_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31960 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31961 {
31962 	USE_OPLINE
31963 	zend_free_op free_op2;
31964 
31965 	SAVE_OPLINE();
31966 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
31967 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31968 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31969 
31970 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31971 	CHECK_EXCEPTION();
31972 	ZEND_VM_NEXT_OPCODE();
31973 }
31974 
ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31975 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31976 {
31977 	USE_OPLINE
31978 	zend_free_op free_op2;
31979 
31980 	SAVE_OPLINE();
31981 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
31982 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
31983 		_get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
31984 
31985 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
31986 	CHECK_EXCEPTION();
31987 	ZEND_VM_NEXT_OPCODE();
31988 }
31989 
zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)31990 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
31991 {
31992 	USE_OPLINE
31993 	zend_free_op free_op2, free_op_data1;
31994 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
31995 	zval *object;
31996 	zval *property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
31997 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
31998 	int have_get_ptr = 0;
31999 
32000 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32001 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32002 	}
32003 
32004 	make_real_object(object_ptr TSRMLS_CC);
32005 	object = *object_ptr;
32006 
32007 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
32008 		zend_error(E_WARNING, "Attempt to assign property of non-object");
32009 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32010 		FREE_OP(free_op_data1);
32011 
32012 		if (RETURN_VALUE_USED(opline)) {
32013 			PZVAL_LOCK(&EG(uninitialized_zval));
32014 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
32015 			EX_T(opline->result.var).var.ptr_ptr = NULL;
32016 		}
32017 	} else {
32018 		/* here we are sure we are dealing with an object */
32019 		if (0) {
32020 			MAKE_REAL_ZVAL_PTR(property);
32021 		}
32022 
32023 		/* here property is a string */
32024 		if (opline->extended_value == ZEND_ASSIGN_OBJ
32025 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
32026 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32027 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
32028 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
32029 
32030 				have_get_ptr = 1;
32031 				binary_op(*zptr, *zptr, value TSRMLS_CC);
32032 				if (RETURN_VALUE_USED(opline)) {
32033 					PZVAL_LOCK(*zptr);
32034 					EX_T(opline->result.var).var.ptr = *zptr;
32035 					EX_T(opline->result.var).var.ptr_ptr = NULL;
32036 				}
32037 			}
32038 		}
32039 
32040 		if (!have_get_ptr) {
32041 			zval *z = NULL;
32042 
32043 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
32044 				if (Z_OBJ_HT_P(object)->read_property) {
32045 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32046 				}
32047 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
32048 				if (Z_OBJ_HT_P(object)->read_dimension) {
32049 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
32050 				}
32051 			}
32052 			if (z) {
32053 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
32054 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
32055 
32056 					if (Z_REFCOUNT_P(z) == 0) {
32057 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
32058 						zval_dtor(z);
32059 						FREE_ZVAL(z);
32060 					}
32061 					z = value;
32062 				}
32063 				Z_ADDREF_P(z);
32064 				SEPARATE_ZVAL_IF_NOT_REF(&z);
32065 				binary_op(z, z, value TSRMLS_CC);
32066 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
32067 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32068 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
32069 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
32070 				}
32071 				if (RETURN_VALUE_USED(opline)) {
32072 					PZVAL_LOCK(z);
32073 					EX_T(opline->result.var).var.ptr = z;
32074 					EX_T(opline->result.var).var.ptr_ptr = NULL;
32075 				}
32076 				zval_ptr_dtor(&z);
32077 			} else {
32078 				zend_error(E_WARNING, "Attempt to assign property of non-object");
32079 				if (RETURN_VALUE_USED(opline)) {
32080 					PZVAL_LOCK(&EG(uninitialized_zval));
32081 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
32082 					EX_T(opline->result.var).var.ptr_ptr = NULL;
32083 				}
32084 			}
32085 		}
32086 
32087 		if (0) {
32088 			zval_ptr_dtor(&property);
32089 		} else {
32090 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32091 		}
32092 		FREE_OP(free_op_data1);
32093 	}
32094 
32095 	/* assign_obj has two opcodes! */
32096 	CHECK_EXCEPTION();
32097 	ZEND_VM_INC_OPCODE();
32098 	ZEND_VM_NEXT_OPCODE();
32099 }
32100 
zend_binary_assign_op_helper_SPEC_CV_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)32101 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
32102 {
32103 	USE_OPLINE
32104 	zend_free_op free_op2, free_op_data2, free_op_data1;
32105 	zval **var_ptr;
32106 	zval *value;
32107 
32108 	SAVE_OPLINE();
32109 	switch (opline->extended_value) {
32110 		case ZEND_ASSIGN_OBJ:
32111 			return zend_binary_assign_op_obj_helper_SPEC_CV_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32112 			break;
32113 		case ZEND_ASSIGN_DIM: {
32114 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32115 
32116 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32117 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32118 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
32119 					if (IS_CV == IS_VAR && !0) {
32120 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
32121 					}
32122 					return zend_binary_assign_op_obj_helper_SPEC_CV_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32123 				} else {
32124 					zval *dim = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32125 
32126 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
32127 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
32128 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
32129 				}
32130 			}
32131 			break;
32132 		default:
32133 			value = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32134 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32135 			/* do nothing */
32136 			break;
32137 	}
32138 
32139 	if (UNEXPECTED(var_ptr == NULL)) {
32140 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
32141 	}
32142 
32143 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
32144 		if (RETURN_VALUE_USED(opline)) {
32145 			PZVAL_LOCK(&EG(uninitialized_zval));
32146 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32147 		}
32148 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32149 
32150 		CHECK_EXCEPTION();
32151 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
32152 			ZEND_VM_INC_OPCODE();
32153 		}
32154 		ZEND_VM_NEXT_OPCODE();
32155 	}
32156 
32157 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
32158 
32159 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
32160 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
32161 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
32162 		/* proxy object */
32163 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
32164 		Z_ADDREF_P(objval);
32165 		binary_op(objval, objval, value TSRMLS_CC);
32166 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
32167 		zval_ptr_dtor(&objval);
32168 	} else {
32169 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
32170 	}
32171 
32172 	if (RETURN_VALUE_USED(opline)) {
32173 		PZVAL_LOCK(*var_ptr);
32174 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
32175 	}
32176 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32177 
32178 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
32179 		FREE_OP(free_op_data1);
32180 		FREE_OP_VAR_PTR(free_op_data2);
32181 
32182 		CHECK_EXCEPTION();
32183 		ZEND_VM_INC_OPCODE();
32184 	} else {
32185 
32186 		CHECK_EXCEPTION();
32187 	}
32188 	ZEND_VM_NEXT_OPCODE();
32189 }
32190 
ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32191 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32192 {
32193 	return zend_binary_assign_op_helper_SPEC_CV_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32194 }
32195 
ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32196 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32197 {
32198 	return zend_binary_assign_op_helper_SPEC_CV_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32199 }
32200 
ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32201 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32202 {
32203 	return zend_binary_assign_op_helper_SPEC_CV_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32204 }
32205 
ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32206 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32207 {
32208 	return zend_binary_assign_op_helper_SPEC_CV_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32209 }
32210 
ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32211 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32212 {
32213 	return zend_binary_assign_op_helper_SPEC_CV_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32214 }
32215 
ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32216 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32217 {
32218 	return zend_binary_assign_op_helper_SPEC_CV_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32219 }
32220 
ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32221 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32222 {
32223 	return zend_binary_assign_op_helper_SPEC_CV_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32224 }
32225 
ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32226 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32227 {
32228 	return zend_binary_assign_op_helper_SPEC_CV_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32229 }
32230 
ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32231 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32232 {
32233 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32234 }
32235 
ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32236 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32237 {
32238 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32239 }
32240 
ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32241 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32242 {
32243 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32244 }
32245 
zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)32246 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
32247 {
32248 	USE_OPLINE
32249 	zend_free_op free_op2;
32250 	zval **object_ptr;
32251 	zval *object;
32252 	zval *property;
32253 	zval **retval;
32254 	int have_get_ptr = 0;
32255 
32256 	SAVE_OPLINE();
32257 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32258 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32259 	retval = &EX_T(opline->result.var).var.ptr;
32260 
32261 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32262 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
32263 	}
32264 
32265 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
32266 	object = *object_ptr;
32267 
32268 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
32269 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32270 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32271 		if (RETURN_VALUE_USED(opline)) {
32272 			PZVAL_LOCK(&EG(uninitialized_zval));
32273 			*retval = &EG(uninitialized_zval);
32274 		}
32275 
32276 		CHECK_EXCEPTION();
32277 		ZEND_VM_NEXT_OPCODE();
32278 	}
32279 
32280 	/* here we are sure we are dealing with an object */
32281 
32282 	if (0) {
32283 		MAKE_REAL_ZVAL_PTR(property);
32284 	}
32285 
32286 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
32287 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32288 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
32289 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
32290 
32291 			have_get_ptr = 1;
32292 			incdec_op(*zptr);
32293 			if (RETURN_VALUE_USED(opline)) {
32294 				*retval = *zptr;
32295 				PZVAL_LOCK(*retval);
32296 			}
32297 		}
32298 	}
32299 
32300 	if (!have_get_ptr) {
32301 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
32302 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32303 
32304 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
32305 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
32306 
32307 				if (Z_REFCOUNT_P(z) == 0) {
32308 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
32309 					zval_dtor(z);
32310 					FREE_ZVAL(z);
32311 				}
32312 				z = value;
32313 			}
32314 			Z_ADDREF_P(z);
32315 			SEPARATE_ZVAL_IF_NOT_REF(&z);
32316 			incdec_op(z);
32317 			*retval = z;
32318 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32319 			SELECTIVE_PZVAL_LOCK(*retval, opline);
32320 			zval_ptr_dtor(&z);
32321 		} else {
32322 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32323 			if (RETURN_VALUE_USED(opline)) {
32324 				PZVAL_LOCK(&EG(uninitialized_zval));
32325 				*retval = &EG(uninitialized_zval);
32326 			}
32327 		}
32328 	}
32329 
32330 	if (0) {
32331 		zval_ptr_dtor(&property);
32332 	} else {
32333 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32334 	}
32335 
32336 	CHECK_EXCEPTION();
32337 	ZEND_VM_NEXT_OPCODE();
32338 }
32339 
ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32340 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32341 {
32342 	return zend_pre_incdec_property_helper_SPEC_CV_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32343 }
32344 
ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32345 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32346 {
32347 	return zend_pre_incdec_property_helper_SPEC_CV_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32348 }
32349 
zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)32350 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
32351 {
32352 	USE_OPLINE
32353 	zend_free_op free_op2;
32354 	zval **object_ptr;
32355 	zval *object;
32356 	zval *property;
32357 	zval *retval;
32358 	int have_get_ptr = 0;
32359 
32360 	SAVE_OPLINE();
32361 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32362 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32363 	retval = &EX_T(opline->result.var).tmp_var;
32364 
32365 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32366 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
32367 	}
32368 
32369 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
32370 	object = *object_ptr;
32371 
32372 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
32373 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32374 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32375 		ZVAL_NULL(retval);
32376 
32377 		CHECK_EXCEPTION();
32378 		ZEND_VM_NEXT_OPCODE();
32379 	}
32380 
32381 	/* here we are sure we are dealing with an object */
32382 
32383 	if (0) {
32384 		MAKE_REAL_ZVAL_PTR(property);
32385 	}
32386 
32387 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
32388 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32389 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
32390 			have_get_ptr = 1;
32391 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
32392 
32393 			ZVAL_COPY_VALUE(retval, *zptr);
32394 			zendi_zval_copy_ctor(*retval);
32395 
32396 			incdec_op(*zptr);
32397 
32398 		}
32399 	}
32400 
32401 	if (!have_get_ptr) {
32402 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
32403 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32404 			zval *z_copy;
32405 
32406 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
32407 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
32408 
32409 				if (Z_REFCOUNT_P(z) == 0) {
32410 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
32411 					zval_dtor(z);
32412 					FREE_ZVAL(z);
32413 				}
32414 				z = value;
32415 			}
32416 			ZVAL_COPY_VALUE(retval, z);
32417 			zendi_zval_copy_ctor(*retval);
32418 			ALLOC_ZVAL(z_copy);
32419 			INIT_PZVAL_COPY(z_copy, z);
32420 			zendi_zval_copy_ctor(*z_copy);
32421 			incdec_op(z_copy);
32422 			Z_ADDREF_P(z);
32423 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32424 			zval_ptr_dtor(&z_copy);
32425 			zval_ptr_dtor(&z);
32426 		} else {
32427 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32428 			ZVAL_NULL(retval);
32429 		}
32430 	}
32431 
32432 	if (0) {
32433 		zval_ptr_dtor(&property);
32434 	} else {
32435 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32436 	}
32437 
32438 	CHECK_EXCEPTION();
32439 	ZEND_VM_NEXT_OPCODE();
32440 }
32441 
ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32442 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32443 {
32444 	return zend_post_incdec_property_helper_SPEC_CV_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32445 }
32446 
ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32447 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32448 {
32449 	return zend_post_incdec_property_helper_SPEC_CV_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32450 }
32451 
zend_fetch_var_address_helper_SPEC_CV_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)32452 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
32453 {
32454 	USE_OPLINE
32455 	zend_free_op free_op1;
32456 	zval *varname;
32457 	zval **retval;
32458 	zval tmp_varname;
32459 	HashTable *target_symbol_table;
32460 	ulong hash_value;
32461 
32462 	SAVE_OPLINE();
32463 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
32464 
32465  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
32466 		ZVAL_COPY_VALUE(&tmp_varname, varname);
32467 		zval_copy_ctor(&tmp_varname);
32468 		Z_SET_REFCOUNT(tmp_varname, 1);
32469 		Z_UNSET_ISREF(tmp_varname);
32470 		convert_to_string(&tmp_varname);
32471 		varname = &tmp_varname;
32472 	}
32473 
32474 	if (IS_VAR != IS_UNUSED) {
32475 		zend_class_entry *ce;
32476 
32477 		if (IS_VAR == IS_CONST) {
32478 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
32479 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
32480 			} else {
32481 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
32482 				if (UNEXPECTED(ce == NULL)) {
32483 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
32484 						zval_dtor(&tmp_varname);
32485 					}
32486 
32487 					CHECK_EXCEPTION();
32488 					ZEND_VM_NEXT_OPCODE();
32489 				}
32490 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
32491 			}
32492 		} else {
32493 			ce = EX_T(opline->op2.var).class_entry;
32494 		}
32495 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
32496 
32497 	} else {
32498 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
32499 /*
32500 		if (!target_symbol_table) {
32501 			CHECK_EXCEPTION();
32502 			ZEND_VM_NEXT_OPCODE();
32503 		}
32504 */
32505 		if (IS_CV == IS_CONST) {
32506 			hash_value = Z_HASH_P(varname);
32507 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
32508 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
32509 		} else {
32510 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
32511 		}
32512 
32513 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
32514 			switch (type) {
32515 				case BP_VAR_R:
32516 				case BP_VAR_UNSET:
32517 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
32518 					/* break missing intentionally */
32519 				case BP_VAR_IS:
32520 					retval = &EG(uninitialized_zval_ptr);
32521 					break;
32522 				case BP_VAR_RW:
32523 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
32524 					/* break missing intentionally */
32525 				case BP_VAR_W:
32526 					Z_ADDREF_P(&EG(uninitialized_zval));
32527 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
32528 					break;
32529 				EMPTY_SWITCH_DEFAULT_CASE()
32530 			}
32531 		}
32532 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
32533 			case ZEND_FETCH_GLOBAL:
32534 				if (IS_CV != IS_TMP_VAR) {
32535 
32536 				}
32537 				break;
32538 			case ZEND_FETCH_LOCAL:
32539 
32540 				break;
32541 			case ZEND_FETCH_STATIC:
32542 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
32543 				break;
32544 			case ZEND_FETCH_GLOBAL_LOCK:
32545 				if (IS_CV == IS_VAR && !free_op1.var) {
32546 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
32547 				}
32548 				break;
32549 		}
32550 	}
32551 
32552 
32553 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
32554 		zval_dtor(&tmp_varname);
32555 	}
32556 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
32557 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
32558 	}
32559 	PZVAL_LOCK(*retval);
32560 	switch (type) {
32561 		case BP_VAR_R:
32562 		case BP_VAR_IS:
32563 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
32564 			break;
32565 		case BP_VAR_UNSET: {
32566 			zend_free_op free_res;
32567 
32568 			PZVAL_UNLOCK(*retval, &free_res);
32569 			if (retval != &EG(uninitialized_zval_ptr)) {
32570 				SEPARATE_ZVAL_IF_NOT_REF(retval);
32571 			}
32572 			PZVAL_LOCK(*retval);
32573 			FREE_OP_VAR_PTR(free_res);
32574 		}
32575 		/* break missing intentionally */
32576 		default:
32577 			EX_T(opline->result.var).var.ptr_ptr = retval;
32578 			break;
32579 	}
32580 	CHECK_EXCEPTION();
32581 	ZEND_VM_NEXT_OPCODE();
32582 }
32583 
ZEND_FETCH_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32584 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32585 {
32586 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32587 }
32588 
ZEND_FETCH_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32589 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32590 {
32591 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32592 }
32593 
ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32594 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32595 {
32596 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32597 }
32598 
ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32599 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32600 {
32601 	USE_OPLINE
32602 
32603 	return zend_fetch_var_address_helper_SPEC_CV_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32604 }
32605 
ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32606 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32607 {
32608 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32609 }
32610 
ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32611 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32612 {
32613 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32614 }
32615 
ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32616 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32617 {
32618 	USE_OPLINE
32619 	zend_free_op free_op2;
32620 	zval *container;
32621 
32622 	SAVE_OPLINE();
32623 
32624 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
32625 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
32626 	}
32627 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
32628 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
32629 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32630 
32631 	CHECK_EXCEPTION();
32632 	ZEND_VM_NEXT_OPCODE();
32633 }
32634 
ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32635 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32636 {
32637 	USE_OPLINE
32638 	zend_free_op free_op1, free_op2;
32639 	zval **container;
32640 
32641 	SAVE_OPLINE();
32642 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
32643 
32644 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32645 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32646 	}
32647 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
32648 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32649 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32650 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32651 	}
32652 
32653 	/* We are going to assign the result by reference */
32654 	if (UNEXPECTED(opline->extended_value != 0)) {
32655 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32656 
32657 		if (retval_ptr) {
32658 			Z_DELREF_PP(retval_ptr);
32659 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
32660 			Z_ADDREF_PP(retval_ptr);
32661 		}
32662 	}
32663 
32664 	CHECK_EXCEPTION();
32665 	ZEND_VM_NEXT_OPCODE();
32666 }
32667 
ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32668 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32669 {
32670 	USE_OPLINE
32671 	zend_free_op free_op1, free_op2;
32672 	zval **container;
32673 
32674 	SAVE_OPLINE();
32675 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32676 
32677 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32678 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32679 	}
32680 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_RW TSRMLS_CC);
32681 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32682 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32683 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32684 	}
32685 
32686 	CHECK_EXCEPTION();
32687 	ZEND_VM_NEXT_OPCODE();
32688 }
32689 
ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32690 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32691 {
32692 	USE_OPLINE
32693 	zend_free_op free_op2;
32694 	zval *container;
32695 
32696 	SAVE_OPLINE();
32697 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
32698 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_IS TSRMLS_CC);
32699 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32700 
32701 	CHECK_EXCEPTION();
32702 	ZEND_VM_NEXT_OPCODE();
32703 }
32704 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32705 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32706 {
32707 	USE_OPLINE
32708 	zend_free_op free_op1, free_op2;
32709 
32710 	SAVE_OPLINE();
32711 
32712 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
32713 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
32714 
32715 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32716 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32717 		}
32718 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
32719 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32720 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32721 		}
32722 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32723 
32724 	} else {
32725 		zval *container;
32726 
32727 		if (IS_VAR == IS_UNUSED) {
32728 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
32729 		}
32730 		container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
32731 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
32732 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32733 
32734 	}
32735 	CHECK_EXCEPTION();
32736 	ZEND_VM_NEXT_OPCODE();
32737 }
32738 
ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32739 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32740 {
32741 	USE_OPLINE
32742 	zend_free_op free_op1, free_op2;
32743 	zval **container;
32744 
32745 	SAVE_OPLINE();
32746 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
32747 
32748 	if (IS_CV == IS_CV) {
32749 		if (container != &EG(uninitialized_zval_ptr)) {
32750 			SEPARATE_ZVAL_IF_NOT_REF(container);
32751 		}
32752 	}
32753 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32754 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32755 	}
32756 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_UNSET TSRMLS_CC);
32757 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32758 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32759 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32760 	}
32761 
32762 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
32763 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
32764 	} else {
32765 		zend_free_op free_res;
32766 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32767 
32768 		PZVAL_UNLOCK(*retval_ptr, &free_res);
32769 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
32770 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
32771 		}
32772 		PZVAL_LOCK(*retval_ptr);
32773 		FREE_OP_VAR_PTR(free_res);
32774 		CHECK_EXCEPTION();
32775 		ZEND_VM_NEXT_OPCODE();
32776 	}
32777 }
32778 
zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS)32779 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS)
32780 {
32781 	USE_OPLINE
32782 
32783 	zval *container;
32784 	zend_free_op free_op2;
32785 	zval *offset;
32786 
32787 	SAVE_OPLINE();
32788 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
32789 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32790 
32791 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
32792 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
32793 		zend_error(E_NOTICE, "Trying to get property of non-object");
32794 		PZVAL_LOCK(&EG(uninitialized_zval));
32795 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32796 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32797 	} else {
32798 		zval *retval;
32799 
32800 		if (0) {
32801 			MAKE_REAL_ZVAL_PTR(offset);
32802 		}
32803 
32804 		/* here we are sure we are dealing with an object */
32805 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32806 
32807 		PZVAL_LOCK(retval);
32808 		AI_SET_PTR(&EX_T(opline->result.var), retval);
32809 
32810 		if (0) {
32811 			zval_ptr_dtor(&offset);
32812 		} else {
32813 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32814 		}
32815 	}
32816 
32817 	CHECK_EXCEPTION();
32818 	ZEND_VM_NEXT_OPCODE();
32819 }
32820 
ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32821 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32822 {
32823 	return zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32824 }
32825 
ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32826 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32827 {
32828 	USE_OPLINE
32829 	zend_free_op free_op1, free_op2;
32830 	zval *property;
32831 	zval **container;
32832 
32833 	SAVE_OPLINE();
32834 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32835 
32836 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
32837 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
32838 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
32839 	}
32840 
32841 	if (0) {
32842 		MAKE_REAL_ZVAL_PTR(property);
32843 	}
32844 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
32845 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32846 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32847 	}
32848 
32849 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
32850 	if (0) {
32851 		zval_ptr_dtor(&property);
32852 	} else {
32853 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32854 	}
32855 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32856 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32857 	}
32858 
32859 	/* We are going to assign the result by reference */
32860 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
32861 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32862 
32863 		Z_DELREF_PP(retval_ptr);
32864 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
32865 		Z_ADDREF_PP(retval_ptr);
32866 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
32867 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
32868 	}
32869 
32870 	CHECK_EXCEPTION();
32871 	ZEND_VM_NEXT_OPCODE();
32872 }
32873 
ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32874 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32875 {
32876 	USE_OPLINE
32877 	zend_free_op free_op1, free_op2;
32878 	zval *property;
32879 	zval **container;
32880 
32881 	SAVE_OPLINE();
32882 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32883 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
32884 
32885 	if (0) {
32886 		MAKE_REAL_ZVAL_PTR(property);
32887 	}
32888 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32889 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32890 	}
32891 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
32892 	if (0) {
32893 		zval_ptr_dtor(&property);
32894 	} else {
32895 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32896 	}
32897 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32898 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32899 	}
32900 
32901 	CHECK_EXCEPTION();
32902 	ZEND_VM_NEXT_OPCODE();
32903 }
32904 
ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32905 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32906 {
32907 	USE_OPLINE
32908 
32909 	zval *container;
32910 	zend_free_op free_op2;
32911 	zval *offset;
32912 
32913 	SAVE_OPLINE();
32914 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
32915 	offset  = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32916 
32917 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
32918 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
32919 		PZVAL_LOCK(&EG(uninitialized_zval));
32920 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32921 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32922 	} else {
32923 		zval *retval;
32924 
32925 		if (0) {
32926 			MAKE_REAL_ZVAL_PTR(offset);
32927 		}
32928 
32929 		/* here we are sure we are dealing with an object */
32930 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32931 
32932 		PZVAL_LOCK(retval);
32933 		AI_SET_PTR(&EX_T(opline->result.var), retval);
32934 
32935 		if (0) {
32936 			zval_ptr_dtor(&offset);
32937 		} else {
32938 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32939 		}
32940 	}
32941 
32942 	CHECK_EXCEPTION();
32943 	ZEND_VM_NEXT_OPCODE();
32944 }
32945 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32946 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32947 {
32948 	USE_OPLINE
32949 
32950 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
32951 		/* Behave like FETCH_OBJ_W */
32952 		zend_free_op free_op1, free_op2;
32953 		zval *property;
32954 		zval **container;
32955 
32956 		SAVE_OPLINE();
32957 		property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32958 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
32959 
32960 		if (0) {
32961 			MAKE_REAL_ZVAL_PTR(property);
32962 		}
32963 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32964 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32965 		}
32966 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
32967 		if (0) {
32968 			zval_ptr_dtor(&property);
32969 		} else {
32970 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
32971 		}
32972 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32973 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32974 		}
32975 
32976 		CHECK_EXCEPTION();
32977 		ZEND_VM_NEXT_OPCODE();
32978 	} else {
32979 		return zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32980 	}
32981 }
32982 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32983 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32984 {
32985 	USE_OPLINE
32986 	zend_free_op free_op1, free_op2, free_res;
32987 	zval **container;
32988 	zval *property;
32989 
32990 	SAVE_OPLINE();
32991 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
32992 	property = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
32993 
32994 	if (IS_CV == IS_CV) {
32995 		if (container != &EG(uninitialized_zval_ptr)) {
32996 			SEPARATE_ZVAL_IF_NOT_REF(container);
32997 		}
32998 	}
32999 	if (0) {
33000 		MAKE_REAL_ZVAL_PTR(property);
33001 	}
33002 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
33003 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
33004 	}
33005 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
33006 	if (0) {
33007 		zval_ptr_dtor(&property);
33008 	} else {
33009 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33010 	}
33011 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
33012 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
33013 	}
33014 
33015 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
33016 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
33017 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
33018 	}
33019 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
33020 	FREE_OP_VAR_PTR(free_res);
33021 	CHECK_EXCEPTION();
33022 	ZEND_VM_NEXT_OPCODE();
33023 }
33024 
ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33025 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33026 {
33027 	USE_OPLINE
33028 	zend_free_op free_op2;
33029 	zval **object_ptr;
33030 	zval *property_name;
33031 
33032 	SAVE_OPLINE();
33033 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
33034 	property_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33035 
33036 	if (0) {
33037 		MAKE_REAL_ZVAL_PTR(property_name);
33038 	}
33039 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
33040 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
33041 	}
33042 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33043 	if (0) {
33044 		zval_ptr_dtor(&property_name);
33045 	} else {
33046 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33047 	}
33048 
33049 	/* assign_obj has two opcodes! */
33050 	CHECK_EXCEPTION();
33051 	ZEND_VM_INC_OPCODE();
33052 	ZEND_VM_NEXT_OPCODE();
33053 }
33054 
ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33055 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33056 {
33057 	USE_OPLINE
33058 
33059 	zval **object_ptr;
33060 
33061 	SAVE_OPLINE();
33062 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
33063 
33064 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
33065 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
33066 	}
33067 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
33068 		zend_free_op free_op2;
33069 		zval *property_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33070 
33071 		if (0) {
33072 			MAKE_REAL_ZVAL_PTR(property_name);
33073 		}
33074 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33075 		if (0) {
33076 			zval_ptr_dtor(&property_name);
33077 		} else {
33078 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33079 		}
33080 	} else {
33081 		zend_free_op free_op2, free_op_data1, free_op_data2;
33082 		zval *value;
33083 		zval *dim = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33084 		zval **variable_ptr_ptr;
33085 
33086 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_VAR, BP_VAR_W TSRMLS_CC);
33087 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33088 
33089 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
33090 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
33091 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
33092 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
33093 				if (RETURN_VALUE_USED(opline)) {
33094 					zval *retval;
33095 
33096 					ALLOC_ZVAL(retval);
33097 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
33098 					INIT_PZVAL(retval);
33099 					AI_SET_PTR(&EX_T(opline->result.var), retval);
33100 				}
33101 			} else if (RETURN_VALUE_USED(opline)) {
33102 				PZVAL_LOCK(&EG(uninitialized_zval));
33103 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
33104 			}
33105 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
33106 			if (IS_TMP_FREE(free_op_data1)) {
33107 				zval_dtor(value);
33108 			}
33109 			if (RETURN_VALUE_USED(opline)) {
33110 				PZVAL_LOCK(&EG(uninitialized_zval));
33111 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
33112 			}
33113 		} else {
33114 			if ((opline+1)->op1_type == IS_TMP_VAR) {
33115 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33116 			} else if ((opline+1)->op1_type == IS_CONST) {
33117 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33118 			} else {
33119 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33120 			}
33121 			if (RETURN_VALUE_USED(opline)) {
33122 				PZVAL_LOCK(value);
33123 				AI_SET_PTR(&EX_T(opline->result.var), value);
33124 			}
33125 		}
33126 		FREE_OP_VAR_PTR(free_op_data2);
33127 	 	FREE_OP_IF_VAR(free_op_data1);
33128 	}
33129 
33130 	/* assign_dim has two opcodes! */
33131 	CHECK_EXCEPTION();
33132 	ZEND_VM_INC_OPCODE();
33133 	ZEND_VM_NEXT_OPCODE();
33134 }
33135 
ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33136 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33137 {
33138 	USE_OPLINE
33139 	zend_free_op free_op2;
33140 	zval *value;
33141 	zval **variable_ptr_ptr;
33142 
33143 	SAVE_OPLINE();
33144 	value = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33145 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
33146 
33147 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
33148 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_VAR TSRMLS_CC)) {
33149 			if (RETURN_VALUE_USED(opline)) {
33150 				zval *retval;
33151 
33152 				ALLOC_ZVAL(retval);
33153 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
33154 				INIT_PZVAL(retval);
33155 				AI_SET_PTR(&EX_T(opline->result.var), retval);
33156 			}
33157 		} else if (RETURN_VALUE_USED(opline)) {
33158 			PZVAL_LOCK(&EG(uninitialized_zval));
33159 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
33160 		}
33161 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
33162 		if (0) {
33163 			zval_dtor(value);
33164 		}
33165 		if (RETURN_VALUE_USED(opline)) {
33166 			PZVAL_LOCK(&EG(uninitialized_zval));
33167 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
33168 		}
33169 	} else {
33170 		if (IS_VAR == IS_TMP_VAR) {
33171 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33172 		} else if (IS_VAR == IS_CONST) {
33173 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33174 		} else {
33175 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
33176 		}
33177 		if (RETURN_VALUE_USED(opline)) {
33178 			PZVAL_LOCK(value);
33179 			AI_SET_PTR(&EX_T(opline->result.var), value);
33180 		}
33181 	}
33182 
33183 	/* zend_assign_to_variable() always takes care of op2, never free it! */
33184  	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33185 
33186 	CHECK_EXCEPTION();
33187 	ZEND_VM_NEXT_OPCODE();
33188 }
33189 
ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33190 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33191 {
33192 	USE_OPLINE
33193 	zend_free_op free_op2;
33194 	zval **variable_ptr_ptr;
33195 	zval **value_ptr_ptr;
33196 
33197 	SAVE_OPLINE();
33198 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33199 
33200 	if (IS_VAR == IS_VAR &&
33201 	    value_ptr_ptr &&
33202 	    !Z_ISREF_PP(value_ptr_ptr) &&
33203 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
33204 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
33205 		if (free_op2.var == NULL) {
33206 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
33207 		}
33208 		zend_error(E_STRICT, "Only variables should be assigned by reference");
33209 		if (UNEXPECTED(EG(exception) != NULL)) {
33210 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33211 			HANDLE_EXCEPTION();
33212 		}
33213 		return ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33214 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
33215 		PZVAL_LOCK(*value_ptr_ptr);
33216 	}
33217 	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
33218 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
33219 	}
33220 
33221 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
33222 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
33223 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
33224 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
33225 	}
33226 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
33227 
33228 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
33229 		Z_DELREF_PP(variable_ptr_ptr);
33230 	}
33231 
33232 	if (RETURN_VALUE_USED(opline)) {
33233 		PZVAL_LOCK(*variable_ptr_ptr);
33234 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
33235 	}
33236 
33237 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33238 
33239 	CHECK_EXCEPTION();
33240 	ZEND_VM_NEXT_OPCODE();
33241 }
33242 
ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33243 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33244 {
33245 	USE_OPLINE
33246 	zval *function_name;
33247 	char *function_name_strval;
33248 	int function_name_strlen;
33249 	zend_free_op free_op2;
33250 
33251 	SAVE_OPLINE();
33252 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
33253 
33254 	function_name = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33255 
33256 	if (IS_VAR != IS_CONST &&
33257 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
33258 		zend_error_noreturn(E_ERROR, "Method name must be a string");
33259 	}
33260 
33261 	function_name_strval = Z_STRVAL_P(function_name);
33262 	function_name_strlen = Z_STRLEN_P(function_name);
33263 
33264 	EX(object) = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
33265 
33266 	if (EXPECTED(EX(object) != NULL) &&
33267 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
33268 		EX(called_scope) = Z_OBJCE_P(EX(object));
33269 
33270 		if (IS_VAR != IS_CONST ||
33271 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
33272 		    zval *object = EX(object);
33273 
33274 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
33275 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
33276 			}
33277 
33278 			/* First, locate the function. */
33279 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
33280 			if (UNEXPECTED(EX(fbc) == NULL)) {
33281 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
33282 			}
33283 			if (IS_VAR == IS_CONST &&
33284 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
33285 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
33286 			    EXPECTED(EX(object) == object)) {
33287 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
33288 			}
33289 		}
33290 	} else {
33291 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
33292 	}
33293 
33294 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
33295 		EX(object) = NULL;
33296 	} else {
33297 		if (!PZVAL_IS_REF(EX(object))) {
33298 			Z_ADDREF_P(EX(object)); /* For $this pointer */
33299 		} else {
33300 			zval *this_ptr;
33301 			ALLOC_ZVAL(this_ptr);
33302 			INIT_PZVAL_COPY(this_ptr, EX(object));
33303 			zval_copy_ctor(this_ptr);
33304 			EX(object) = this_ptr;
33305 		}
33306 	}
33307 
33308 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33309 
33310 	CHECK_EXCEPTION();
33311 	ZEND_VM_NEXT_OPCODE();
33312 }
33313 
ZEND_CASE_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33314 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33315 {
33316 	USE_OPLINE
33317 	zend_free_op free_op2;
33318 
33319 	SAVE_OPLINE();
33320 	if (IS_CV==IS_VAR) {
33321 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
33322 	}
33323 	is_equal_function(&EX_T(opline->result.var).tmp_var,
33324 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
33325 				 _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC) TSRMLS_CC);
33326 
33327 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33328 	CHECK_EXCEPTION();
33329 	ZEND_VM_NEXT_OPCODE();
33330 }
33331 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33332 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33333 {
33334 	USE_OPLINE
33335 
33336 	zval *expr_ptr;
33337 
33338 	SAVE_OPLINE();
33339 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
33340 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
33341 
33342 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
33343 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
33344 		}
33345 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
33346 		expr_ptr = *expr_ptr_ptr;
33347 		Z_ADDREF_P(expr_ptr);
33348 	} else {
33349 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
33350 		if (0) { /* temporary variable */
33351 			zval *new_expr;
33352 
33353 			ALLOC_ZVAL(new_expr);
33354 			INIT_PZVAL_COPY(new_expr, expr_ptr);
33355 			expr_ptr = new_expr;
33356 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
33357 			zval *new_expr;
33358 
33359 			ALLOC_ZVAL(new_expr);
33360 			INIT_PZVAL_COPY(new_expr, expr_ptr);
33361 			expr_ptr = new_expr;
33362 			zendi_zval_copy_ctor(*expr_ptr);
33363 		} else {
33364 			Z_ADDREF_P(expr_ptr);
33365 		}
33366 	}
33367 
33368 	if (IS_VAR != IS_UNUSED) {
33369 		zend_free_op free_op2;
33370 		zval *offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33371 		ulong hval;
33372 
33373 		switch (Z_TYPE_P(offset)) {
33374 			case IS_DOUBLE:
33375 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
33376 				goto num_index;
33377 			case IS_LONG:
33378 			case IS_BOOL:
33379 				hval = Z_LVAL_P(offset);
33380 num_index:
33381 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
33382 				break;
33383 			case IS_STRING:
33384 				if (IS_VAR == IS_CONST) {
33385 					hval = Z_HASH_P(offset);
33386 				} else {
33387 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
33388 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
33389 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
33390 					} else {
33391 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33392 					}
33393 				}
33394 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
33395 				break;
33396 			case IS_NULL:
33397 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
33398 				break;
33399 			default:
33400 				zend_error(E_WARNING, "Illegal offset type");
33401 				zval_ptr_dtor(&expr_ptr);
33402 				/* do nothing */
33403 				break;
33404 		}
33405 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33406 	} else {
33407 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
33408 	}
33409 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
33410 
33411 	} else {
33412 
33413 	}
33414 	CHECK_EXCEPTION();
33415 	ZEND_VM_NEXT_OPCODE();
33416 }
33417 
ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33418 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33419 {
33420 	USE_OPLINE
33421 
33422 	array_init(&EX_T(opline->result.var).tmp_var);
33423 	if (IS_CV == IS_UNUSED) {
33424 		ZEND_VM_NEXT_OPCODE();
33425 #if 0 || IS_CV != IS_UNUSED
33426 	} else {
33427 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33428 #endif
33429 	}
33430 }
33431 
ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33432 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33433 {
33434 	USE_OPLINE
33435 	zval tmp, *varname;
33436 	HashTable *target_symbol_table;
33437 
33438 
33439 	SAVE_OPLINE();
33440 	if (IS_CV == IS_CV &&
33441 	    IS_VAR == IS_UNUSED &&
33442 	    (opline->extended_value & ZEND_QUICK_SET)) {
33443 		if (EG(active_symbol_table)) {
33444 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
33445 
33446 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
33447 			EX_CV(opline->op1.var) = NULL;
33448 		} else if (EX_CV(opline->op1.var)) {
33449 			zval_ptr_dtor(EX_CV(opline->op1.var));
33450 			EX_CV(opline->op1.var) = NULL;
33451 		}
33452 		CHECK_EXCEPTION();
33453 		ZEND_VM_NEXT_OPCODE();
33454 	}
33455 
33456 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
33457 
33458 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
33459 		ZVAL_COPY_VALUE(&tmp, varname);
33460 		zval_copy_ctor(&tmp);
33461 		convert_to_string(&tmp);
33462 		varname = &tmp;
33463 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33464 		Z_ADDREF_P(varname);
33465 	}
33466 
33467 	if (IS_VAR != IS_UNUSED) {
33468 		zend_class_entry *ce;
33469 
33470 		if (IS_VAR == IS_CONST) {
33471 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
33472 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
33473 			} else {
33474 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
33475 				if (UNEXPECTED(EG(exception) != NULL)) {
33476 					if (IS_CV != IS_CONST && varname == &tmp) {
33477 						zval_dtor(&tmp);
33478 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33479 						zval_ptr_dtor(&varname);
33480 					}
33481 
33482 					HANDLE_EXCEPTION();
33483 				}
33484 				if (UNEXPECTED(ce == NULL)) {
33485 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
33486 				}
33487 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
33488 			}
33489 		} else {
33490 			ce = EX_T(opline->op2.var).class_entry;
33491 		}
33492 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
33493 	} else {
33494 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
33495 
33496 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
33497 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
33498 	}
33499 
33500 	if (IS_CV != IS_CONST && varname == &tmp) {
33501 		zval_dtor(&tmp);
33502 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33503 		zval_ptr_dtor(&varname);
33504 	}
33505 
33506 	CHECK_EXCEPTION();
33507 	ZEND_VM_NEXT_OPCODE();
33508 }
33509 
ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33510 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33511 {
33512 	USE_OPLINE
33513 	zend_free_op free_op2;
33514 	zval **container;
33515 	zval *offset;
33516 	ulong hval;
33517 
33518 	SAVE_OPLINE();
33519 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
33520 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
33521 		SEPARATE_ZVAL_IF_NOT_REF(container);
33522 	}
33523 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33524 
33525 	if (IS_CV != IS_VAR || container) {
33526 		switch (Z_TYPE_PP(container)) {
33527 			case IS_ARRAY: {
33528 				HashTable *ht = Z_ARRVAL_PP(container);
33529 
33530 				switch (Z_TYPE_P(offset)) {
33531 					case IS_DOUBLE:
33532 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
33533 						zend_hash_index_del(ht, hval);
33534 						break;
33535 					case IS_RESOURCE:
33536 					case IS_BOOL:
33537 					case IS_LONG:
33538 						hval = Z_LVAL_P(offset);
33539 						zend_hash_index_del(ht, hval);
33540 						break;
33541 					case IS_STRING:
33542 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
33543 							Z_ADDREF_P(offset);
33544 						}
33545 						if (IS_VAR == IS_CONST) {
33546 							hval = Z_HASH_P(offset);
33547 						} else {
33548 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
33549 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
33550 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
33551 							} else {
33552 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33553 							}
33554 						}
33555 						if (ht == &EG(symbol_table)) {
33556 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
33557 						} else {
33558 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
33559 						}
33560 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
33561 							zval_ptr_dtor(&offset);
33562 						}
33563 						break;
33564 num_index_dim:
33565 						zend_hash_index_del(ht, hval);
33566 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
33567 							zval_ptr_dtor(&offset);
33568 						}
33569 						break;
33570 					case IS_NULL:
33571 						zend_hash_del(ht, "", sizeof(""));
33572 						break;
33573 					default:
33574 						zend_error(E_WARNING, "Illegal offset type in unset");
33575 						break;
33576 				}
33577 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33578 				break;
33579 			}
33580 			case IS_OBJECT:
33581 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
33582 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
33583 				}
33584 				if (0) {
33585 					MAKE_REAL_ZVAL_PTR(offset);
33586 				}
33587 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
33588 				if (0) {
33589 					zval_ptr_dtor(&offset);
33590 				} else {
33591 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33592 				}
33593 				break;
33594 			case IS_STRING:
33595 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
33596 				ZEND_VM_CONTINUE(); /* bailed out before */
33597 			default:
33598 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33599 				break;
33600 		}
33601 	} else {
33602 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33603 	}
33604 
33605 	CHECK_EXCEPTION();
33606 	ZEND_VM_NEXT_OPCODE();
33607 }
33608 
ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33609 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33610 {
33611 	USE_OPLINE
33612 	zend_free_op free_op2;
33613 	zval **container;
33614 	zval *offset;
33615 
33616 	SAVE_OPLINE();
33617 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
33618 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33619 
33620 	if (IS_CV != IS_VAR || container) {
33621 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
33622 			SEPARATE_ZVAL_IF_NOT_REF(container);
33623 		}
33624 		if (Z_TYPE_PP(container) == IS_OBJECT) {
33625 			if (0) {
33626 				MAKE_REAL_ZVAL_PTR(offset);
33627 			}
33628 			if (Z_OBJ_HT_P(*container)->unset_property) {
33629 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33630 			} else {
33631 				zend_error(E_NOTICE, "Trying to unset property of non-object");
33632 			}
33633 			if (0) {
33634 				zval_ptr_dtor(&offset);
33635 			} else {
33636 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33637 			}
33638 		} else {
33639 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33640 		}
33641 	} else {
33642 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33643 	}
33644 
33645 	CHECK_EXCEPTION();
33646 	ZEND_VM_NEXT_OPCODE();
33647 }
33648 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33649 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33650 {
33651 	USE_OPLINE
33652 	zval **value;
33653 	zend_bool isset = 1;
33654 
33655 	SAVE_OPLINE();
33656 	if (IS_CV == IS_CV &&
33657 	    IS_VAR == IS_UNUSED &&
33658 	    (opline->extended_value & ZEND_QUICK_SET)) {
33659 		if (EX_CV(opline->op1.var)) {
33660 			value = EX_CV(opline->op1.var);
33661 		} else if (EG(active_symbol_table)) {
33662 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
33663 
33664 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
33665 				isset = 0;
33666 			}
33667 		} else {
33668 			isset = 0;
33669 		}
33670 	} else {
33671 		HashTable *target_symbol_table;
33672 
33673 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
33674 
33675 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
33676 			ZVAL_COPY_VALUE(&tmp, varname);
33677 			zval_copy_ctor(&tmp);
33678 			convert_to_string(&tmp);
33679 			varname = &tmp;
33680 		}
33681 
33682 		if (IS_VAR != IS_UNUSED) {
33683 			zend_class_entry *ce;
33684 
33685 			if (IS_VAR == IS_CONST) {
33686 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
33687 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
33688 				} else {
33689 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
33690 					if (UNEXPECTED(ce == NULL)) {
33691 						CHECK_EXCEPTION();
33692 						ZEND_VM_NEXT_OPCODE();
33693 					}
33694 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
33695 				}
33696 			} else {
33697 				ce = EX_T(opline->op2.var).class_entry;
33698 			}
33699 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
33700 			if (!value) {
33701 				isset = 0;
33702 			}
33703 		} else {
33704 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
33705 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
33706 				isset = 0;
33707 			}
33708 		}
33709 
33710 		if (IS_CV != IS_CONST && varname == &tmp) {
33711 			zval_dtor(&tmp);
33712 		}
33713 
33714 	}
33715 
33716 	if (opline->extended_value & ZEND_ISSET) {
33717 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
33718 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
33719 		} else {
33720 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
33721 		}
33722 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33723 		if (!isset || !i_zend_is_true(*value)) {
33724 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
33725 		} else {
33726 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
33727 		}
33728 	}
33729 
33730 	CHECK_EXCEPTION();
33731 	ZEND_VM_NEXT_OPCODE();
33732 }
33733 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)33734 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
33735 {
33736 	USE_OPLINE
33737 	zend_free_op free_op2;
33738 	zval **container;
33739 	zval **value = NULL;
33740 	int result = 0;
33741 	ulong hval;
33742 	zval *offset;
33743 
33744 	SAVE_OPLINE();
33745 	container = _get_zval_ptr_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
33746 
33747 	offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
33748 
33749 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
33750 		HashTable *ht;
33751 		int isset = 0;
33752 
33753 		ht = Z_ARRVAL_PP(container);
33754 
33755 		switch (Z_TYPE_P(offset)) {
33756 			case IS_DOUBLE:
33757 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
33758 				goto num_index_prop;
33759 			case IS_RESOURCE:
33760 			case IS_BOOL:
33761 			case IS_LONG:
33762 				hval = Z_LVAL_P(offset);
33763 num_index_prop:
33764 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
33765 					isset = 1;
33766 				}
33767 				break;
33768 			case IS_STRING:
33769 				if (IS_VAR == IS_CONST) {
33770 					hval = Z_HASH_P(offset);
33771 				} else {
33772 					if (!prop_dim) {
33773 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
33774 					}
33775 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
33776 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
33777 					} else {
33778 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33779 					}
33780 				}
33781 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
33782 					isset = 1;
33783 				}
33784 				break;
33785 			case IS_NULL:
33786 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
33787 					isset = 1;
33788 				}
33789 				break;
33790 			default:
33791 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
33792 				break;
33793 		}
33794 
33795 		if (opline->extended_value & ZEND_ISSET) {
33796 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
33797 				result = 0;
33798 			} else {
33799 				result = isset;
33800 			}
33801 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33802 			if (!isset || !i_zend_is_true(*value)) {
33803 				result = 0;
33804 			} else {
33805 				result = 1;
33806 			}
33807 		}
33808 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33809 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
33810 		if (0) {
33811 			MAKE_REAL_ZVAL_PTR(offset);
33812 		}
33813 		if (prop_dim) {
33814 			if (Z_OBJ_HT_P(*container)->has_property) {
33815 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33816 			} else {
33817 				zend_error(E_NOTICE, "Trying to check property of non-object");
33818 				result = 0;
33819 			}
33820 		} else {
33821 			if (Z_OBJ_HT_P(*container)->has_dimension) {
33822 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
33823 			} else {
33824 				zend_error(E_NOTICE, "Trying to check element of non-array");
33825 				result = 0;
33826 			}
33827 		}
33828 		if (0) {
33829 			zval_ptr_dtor(&offset);
33830 		} else {
33831 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33832 		}
33833 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
33834 		zval tmp;
33835 
33836 		if (Z_TYPE_P(offset) != IS_LONG) {
33837 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
33838 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
33839 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
33840 				ZVAL_COPY_VALUE(&tmp, offset);
33841 				zval_copy_ctor(&tmp);
33842 				convert_to_long(&tmp);
33843 				offset = &tmp;
33844 			} else {
33845 				/* can not be converted to proper offset, return "not set" */
33846 				result = 0;
33847 			}
33848 		}
33849 		if (Z_TYPE_P(offset) == IS_LONG) {
33850 			if (opline->extended_value & ZEND_ISSET) {
33851 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
33852 					result = 1;
33853 				}
33854 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33855 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
33856 					result = 1;
33857 				}
33858 			}
33859 		}
33860 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33861 	} else {
33862 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
33863 	}
33864 
33865 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
33866 	if (opline->extended_value & ZEND_ISSET) {
33867 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
33868 	} else {
33869 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
33870 	}
33871 
33872 	CHECK_EXCEPTION();
33873 	ZEND_VM_NEXT_OPCODE();
33874 }
33875 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33876 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33877 {
33878 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33879 }
33880 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33881 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33882 {
33883 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33884 }
33885 
zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)33886 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
33887 {
33888 	USE_OPLINE
33889 	zend_free_op free_op_data1;
33890 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
33891 	zval *object;
33892 	zval *property = NULL;
33893 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
33894 	int have_get_ptr = 0;
33895 
33896 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
33897 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
33898 	}
33899 
33900 	make_real_object(object_ptr TSRMLS_CC);
33901 	object = *object_ptr;
33902 
33903 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
33904 		zend_error(E_WARNING, "Attempt to assign property of non-object");
33905 
33906 		FREE_OP(free_op_data1);
33907 
33908 		if (RETURN_VALUE_USED(opline)) {
33909 			PZVAL_LOCK(&EG(uninitialized_zval));
33910 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
33911 			EX_T(opline->result.var).var.ptr_ptr = NULL;
33912 		}
33913 	} else {
33914 		/* here we are sure we are dealing with an object */
33915 		if (0) {
33916 			MAKE_REAL_ZVAL_PTR(property);
33917 		}
33918 
33919 		/* here property is a string */
33920 		if (opline->extended_value == ZEND_ASSIGN_OBJ
33921 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
33922 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33923 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
33924 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
33925 
33926 				have_get_ptr = 1;
33927 				binary_op(*zptr, *zptr, value TSRMLS_CC);
33928 				if (RETURN_VALUE_USED(opline)) {
33929 					PZVAL_LOCK(*zptr);
33930 					EX_T(opline->result.var).var.ptr = *zptr;
33931 					EX_T(opline->result.var).var.ptr_ptr = NULL;
33932 				}
33933 			}
33934 		}
33935 
33936 		if (!have_get_ptr) {
33937 			zval *z = NULL;
33938 
33939 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
33940 				if (Z_OBJ_HT_P(object)->read_property) {
33941 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33942 				}
33943 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
33944 				if (Z_OBJ_HT_P(object)->read_dimension) {
33945 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
33946 				}
33947 			}
33948 			if (z) {
33949 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
33950 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
33951 
33952 					if (Z_REFCOUNT_P(z) == 0) {
33953 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
33954 						zval_dtor(z);
33955 						FREE_ZVAL(z);
33956 					}
33957 					z = value;
33958 				}
33959 				Z_ADDREF_P(z);
33960 				SEPARATE_ZVAL_IF_NOT_REF(&z);
33961 				binary_op(z, z, value TSRMLS_CC);
33962 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
33963 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33964 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
33965 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
33966 				}
33967 				if (RETURN_VALUE_USED(opline)) {
33968 					PZVAL_LOCK(z);
33969 					EX_T(opline->result.var).var.ptr = z;
33970 					EX_T(opline->result.var).var.ptr_ptr = NULL;
33971 				}
33972 				zval_ptr_dtor(&z);
33973 			} else {
33974 				zend_error(E_WARNING, "Attempt to assign property of non-object");
33975 				if (RETURN_VALUE_USED(opline)) {
33976 					PZVAL_LOCK(&EG(uninitialized_zval));
33977 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
33978 					EX_T(opline->result.var).var.ptr_ptr = NULL;
33979 				}
33980 			}
33981 		}
33982 
33983 		if (0) {
33984 			zval_ptr_dtor(&property);
33985 		} else {
33986 
33987 		}
33988 		FREE_OP(free_op_data1);
33989 	}
33990 
33991 	/* assign_obj has two opcodes! */
33992 	CHECK_EXCEPTION();
33993 	ZEND_VM_INC_OPCODE();
33994 	ZEND_VM_NEXT_OPCODE();
33995 }
33996 
zend_binary_assign_op_helper_SPEC_CV_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)33997 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
33998 {
33999 	USE_OPLINE
34000 	zend_free_op free_op_data2, free_op_data1;
34001 	zval **var_ptr;
34002 	zval *value;
34003 
34004 	SAVE_OPLINE();
34005 	switch (opline->extended_value) {
34006 		case ZEND_ASSIGN_OBJ:
34007 			return zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34008 			break;
34009 		case ZEND_ASSIGN_DIM: {
34010 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
34011 
34012 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34013 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34014 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
34015 					if (IS_CV == IS_VAR && !0) {
34016 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
34017 					}
34018 					return zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34019 				} else {
34020 					zval *dim = NULL;
34021 
34022 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
34023 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
34024 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
34025 				}
34026 			}
34027 			break;
34028 		default:
34029 			value = NULL;
34030 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
34031 			/* do nothing */
34032 			break;
34033 	}
34034 
34035 	if (UNEXPECTED(var_ptr == NULL)) {
34036 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
34037 	}
34038 
34039 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
34040 		if (RETURN_VALUE_USED(opline)) {
34041 			PZVAL_LOCK(&EG(uninitialized_zval));
34042 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34043 		}
34044 
34045 
34046 		CHECK_EXCEPTION();
34047 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
34048 			ZEND_VM_INC_OPCODE();
34049 		}
34050 		ZEND_VM_NEXT_OPCODE();
34051 	}
34052 
34053 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
34054 
34055 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
34056 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
34057 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
34058 		/* proxy object */
34059 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
34060 		Z_ADDREF_P(objval);
34061 		binary_op(objval, objval, value TSRMLS_CC);
34062 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
34063 		zval_ptr_dtor(&objval);
34064 	} else {
34065 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
34066 	}
34067 
34068 	if (RETURN_VALUE_USED(opline)) {
34069 		PZVAL_LOCK(*var_ptr);
34070 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
34071 	}
34072 
34073 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
34074 		FREE_OP(free_op_data1);
34075 		FREE_OP_VAR_PTR(free_op_data2);
34076 
34077 		CHECK_EXCEPTION();
34078 		ZEND_VM_INC_OPCODE();
34079 	} else {
34080 
34081 		CHECK_EXCEPTION();
34082 	}
34083 	ZEND_VM_NEXT_OPCODE();
34084 }
34085 
ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34086 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34087 {
34088 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34089 }
34090 
ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34091 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34092 {
34093 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34094 }
34095 
ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34096 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34097 {
34098 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34099 }
34100 
ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34101 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34102 {
34103 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34104 }
34105 
ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34106 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34107 {
34108 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34109 }
34110 
ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34111 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34112 {
34113 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34114 }
34115 
ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34116 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34117 {
34118 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34119 }
34120 
ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34121 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34122 {
34123 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34124 }
34125 
ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34126 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34127 {
34128 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34129 }
34130 
ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34131 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34132 {
34133 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34134 }
34135 
ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34136 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34137 {
34138 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34139 }
34140 
zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)34141 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
34142 {
34143 	USE_OPLINE
34144 	zend_free_op free_op1;
34145 	zval *varname;
34146 	zval **retval;
34147 	zval tmp_varname;
34148 	HashTable *target_symbol_table;
34149 	ulong hash_value;
34150 
34151 	SAVE_OPLINE();
34152 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
34153 
34154  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
34155 		ZVAL_COPY_VALUE(&tmp_varname, varname);
34156 		zval_copy_ctor(&tmp_varname);
34157 		Z_SET_REFCOUNT(tmp_varname, 1);
34158 		Z_UNSET_ISREF(tmp_varname);
34159 		convert_to_string(&tmp_varname);
34160 		varname = &tmp_varname;
34161 	}
34162 
34163 	if (IS_UNUSED != IS_UNUSED) {
34164 		zend_class_entry *ce;
34165 
34166 		if (IS_UNUSED == IS_CONST) {
34167 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
34168 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
34169 			} else {
34170 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
34171 				if (UNEXPECTED(ce == NULL)) {
34172 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
34173 						zval_dtor(&tmp_varname);
34174 					}
34175 
34176 					CHECK_EXCEPTION();
34177 					ZEND_VM_NEXT_OPCODE();
34178 				}
34179 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
34180 			}
34181 		} else {
34182 			ce = EX_T(opline->op2.var).class_entry;
34183 		}
34184 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
34185 
34186 	} else {
34187 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
34188 /*
34189 		if (!target_symbol_table) {
34190 			CHECK_EXCEPTION();
34191 			ZEND_VM_NEXT_OPCODE();
34192 		}
34193 */
34194 		if (IS_CV == IS_CONST) {
34195 			hash_value = Z_HASH_P(varname);
34196 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
34197 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
34198 		} else {
34199 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
34200 		}
34201 
34202 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
34203 			switch (type) {
34204 				case BP_VAR_R:
34205 				case BP_VAR_UNSET:
34206 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
34207 					/* break missing intentionally */
34208 				case BP_VAR_IS:
34209 					retval = &EG(uninitialized_zval_ptr);
34210 					break;
34211 				case BP_VAR_RW:
34212 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
34213 					/* break missing intentionally */
34214 				case BP_VAR_W:
34215 					Z_ADDREF_P(&EG(uninitialized_zval));
34216 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
34217 					break;
34218 				EMPTY_SWITCH_DEFAULT_CASE()
34219 			}
34220 		}
34221 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
34222 			case ZEND_FETCH_GLOBAL:
34223 				if (IS_CV != IS_TMP_VAR) {
34224 
34225 				}
34226 				break;
34227 			case ZEND_FETCH_LOCAL:
34228 
34229 				break;
34230 			case ZEND_FETCH_STATIC:
34231 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
34232 				break;
34233 			case ZEND_FETCH_GLOBAL_LOCK:
34234 				if (IS_CV == IS_VAR && !free_op1.var) {
34235 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
34236 				}
34237 				break;
34238 		}
34239 	}
34240 
34241 
34242 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
34243 		zval_dtor(&tmp_varname);
34244 	}
34245 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
34246 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
34247 	}
34248 	PZVAL_LOCK(*retval);
34249 	switch (type) {
34250 		case BP_VAR_R:
34251 		case BP_VAR_IS:
34252 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
34253 			break;
34254 		case BP_VAR_UNSET: {
34255 			zend_free_op free_res;
34256 
34257 			PZVAL_UNLOCK(*retval, &free_res);
34258 			if (retval != &EG(uninitialized_zval_ptr)) {
34259 				SEPARATE_ZVAL_IF_NOT_REF(retval);
34260 			}
34261 			PZVAL_LOCK(*retval);
34262 			FREE_OP_VAR_PTR(free_res);
34263 		}
34264 		/* break missing intentionally */
34265 		default:
34266 			EX_T(opline->result.var).var.ptr_ptr = retval;
34267 			break;
34268 	}
34269 	CHECK_EXCEPTION();
34270 	ZEND_VM_NEXT_OPCODE();
34271 }
34272 
ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34273 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34274 {
34275 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34276 }
34277 
ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34278 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34279 {
34280 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34281 }
34282 
ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34283 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34284 {
34285 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34286 }
34287 
ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34288 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34289 {
34290 	USE_OPLINE
34291 
34292 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34293 }
34294 
ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34295 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34296 {
34297 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34298 }
34299 
ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34300 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34301 {
34302 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34303 }
34304 
ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34305 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34306 {
34307 	USE_OPLINE
34308 	zend_free_op free_op1;
34309 	zval **container;
34310 
34311 	SAVE_OPLINE();
34312 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
34313 
34314 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34315 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34316 	}
34317 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
34318 
34319 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34320 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34321 	}
34322 
34323 	/* We are going to assign the result by reference */
34324 	if (UNEXPECTED(opline->extended_value != 0)) {
34325 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
34326 
34327 		if (retval_ptr) {
34328 			Z_DELREF_PP(retval_ptr);
34329 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
34330 			Z_ADDREF_PP(retval_ptr);
34331 		}
34332 	}
34333 
34334 	CHECK_EXCEPTION();
34335 	ZEND_VM_NEXT_OPCODE();
34336 }
34337 
ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34338 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34339 {
34340 	USE_OPLINE
34341 	zend_free_op free_op1;
34342 	zval **container;
34343 
34344 	SAVE_OPLINE();
34345 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
34346 
34347 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34348 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34349 	}
34350 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
34351 
34352 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34353 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34354 	}
34355 
34356 	CHECK_EXCEPTION();
34357 	ZEND_VM_NEXT_OPCODE();
34358 }
34359 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34360 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34361 {
34362 	USE_OPLINE
34363 	zend_free_op free_op1;
34364 
34365 	SAVE_OPLINE();
34366 
34367 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
34368 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
34369 
34370 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34371 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34372 		}
34373 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
34374 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34375 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34376 		}
34377 
34378 
34379 	} else {
34380 		zval *container;
34381 
34382 		if (IS_UNUSED == IS_UNUSED) {
34383 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
34384 		}
34385 		container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
34386 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_R TSRMLS_CC);
34387 
34388 
34389 	}
34390 	CHECK_EXCEPTION();
34391 	ZEND_VM_NEXT_OPCODE();
34392 }
34393 
ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34394 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34395 {
34396 	USE_OPLINE
34397 
34398 	zval **object_ptr;
34399 
34400 	SAVE_OPLINE();
34401 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
34402 
34403 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
34404 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34405 	}
34406 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
34407 
34408 		zval *property_name = NULL;
34409 
34410 		if (0) {
34411 			MAKE_REAL_ZVAL_PTR(property_name);
34412 		}
34413 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34414 		if (0) {
34415 			zval_ptr_dtor(&property_name);
34416 		} else {
34417 
34418 		}
34419 	} else {
34420 		zend_free_op free_op_data1, free_op_data2;
34421 		zval *value;
34422 		zval *dim = NULL;
34423 		zval **variable_ptr_ptr;
34424 
34425 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_UNUSED, BP_VAR_W TSRMLS_CC);
34426 
34427 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
34428 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
34429 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
34430 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
34431 				if (RETURN_VALUE_USED(opline)) {
34432 					zval *retval;
34433 
34434 					ALLOC_ZVAL(retval);
34435 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
34436 					INIT_PZVAL(retval);
34437 					AI_SET_PTR(&EX_T(opline->result.var), retval);
34438 				}
34439 			} else if (RETURN_VALUE_USED(opline)) {
34440 				PZVAL_LOCK(&EG(uninitialized_zval));
34441 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34442 			}
34443 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
34444 			if (IS_TMP_FREE(free_op_data1)) {
34445 				zval_dtor(value);
34446 			}
34447 			if (RETURN_VALUE_USED(opline)) {
34448 				PZVAL_LOCK(&EG(uninitialized_zval));
34449 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34450 			}
34451 		} else {
34452 			if ((opline+1)->op1_type == IS_TMP_VAR) {
34453 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34454 			} else if ((opline+1)->op1_type == IS_CONST) {
34455 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34456 			} else {
34457 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34458 			}
34459 			if (RETURN_VALUE_USED(opline)) {
34460 				PZVAL_LOCK(value);
34461 				AI_SET_PTR(&EX_T(opline->result.var), value);
34462 			}
34463 		}
34464 		FREE_OP_VAR_PTR(free_op_data2);
34465 	 	FREE_OP_IF_VAR(free_op_data1);
34466 	}
34467 
34468 	/* assign_dim has two opcodes! */
34469 	CHECK_EXCEPTION();
34470 	ZEND_VM_INC_OPCODE();
34471 	ZEND_VM_NEXT_OPCODE();
34472 }
34473 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34474 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34475 {
34476 	USE_OPLINE
34477 
34478 	zval *expr_ptr;
34479 
34480 	SAVE_OPLINE();
34481 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
34482 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
34483 
34484 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
34485 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
34486 		}
34487 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
34488 		expr_ptr = *expr_ptr_ptr;
34489 		Z_ADDREF_P(expr_ptr);
34490 	} else {
34491 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
34492 		if (0) { /* temporary variable */
34493 			zval *new_expr;
34494 
34495 			ALLOC_ZVAL(new_expr);
34496 			INIT_PZVAL_COPY(new_expr, expr_ptr);
34497 			expr_ptr = new_expr;
34498 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
34499 			zval *new_expr;
34500 
34501 			ALLOC_ZVAL(new_expr);
34502 			INIT_PZVAL_COPY(new_expr, expr_ptr);
34503 			expr_ptr = new_expr;
34504 			zendi_zval_copy_ctor(*expr_ptr);
34505 		} else {
34506 			Z_ADDREF_P(expr_ptr);
34507 		}
34508 	}
34509 
34510 	if (IS_UNUSED != IS_UNUSED) {
34511 
34512 		zval *offset = NULL;
34513 		ulong hval;
34514 
34515 		switch (Z_TYPE_P(offset)) {
34516 			case IS_DOUBLE:
34517 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
34518 				goto num_index;
34519 			case IS_LONG:
34520 			case IS_BOOL:
34521 				hval = Z_LVAL_P(offset);
34522 num_index:
34523 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
34524 				break;
34525 			case IS_STRING:
34526 				if (IS_UNUSED == IS_CONST) {
34527 					hval = Z_HASH_P(offset);
34528 				} else {
34529 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
34530 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
34531 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
34532 					} else {
34533 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
34534 					}
34535 				}
34536 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
34537 				break;
34538 			case IS_NULL:
34539 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
34540 				break;
34541 			default:
34542 				zend_error(E_WARNING, "Illegal offset type");
34543 				zval_ptr_dtor(&expr_ptr);
34544 				/* do nothing */
34545 				break;
34546 		}
34547 
34548 	} else {
34549 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
34550 	}
34551 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
34552 
34553 	} else {
34554 
34555 	}
34556 	CHECK_EXCEPTION();
34557 	ZEND_VM_NEXT_OPCODE();
34558 }
34559 
ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34560 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34561 {
34562 	USE_OPLINE
34563 
34564 	array_init(&EX_T(opline->result.var).tmp_var);
34565 	if (IS_CV == IS_UNUSED) {
34566 		ZEND_VM_NEXT_OPCODE();
34567 #if 0 || IS_CV != IS_UNUSED
34568 	} else {
34569 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34570 #endif
34571 	}
34572 }
34573 
ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34574 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34575 {
34576 	USE_OPLINE
34577 	zval tmp, *varname;
34578 	HashTable *target_symbol_table;
34579 
34580 
34581 	SAVE_OPLINE();
34582 	if (IS_CV == IS_CV &&
34583 	    IS_UNUSED == IS_UNUSED &&
34584 	    (opline->extended_value & ZEND_QUICK_SET)) {
34585 		if (EG(active_symbol_table)) {
34586 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
34587 
34588 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
34589 			EX_CV(opline->op1.var) = NULL;
34590 		} else if (EX_CV(opline->op1.var)) {
34591 			zval_ptr_dtor(EX_CV(opline->op1.var));
34592 			EX_CV(opline->op1.var) = NULL;
34593 		}
34594 		CHECK_EXCEPTION();
34595 		ZEND_VM_NEXT_OPCODE();
34596 	}
34597 
34598 	varname = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
34599 
34600 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
34601 		ZVAL_COPY_VALUE(&tmp, varname);
34602 		zval_copy_ctor(&tmp);
34603 		convert_to_string(&tmp);
34604 		varname = &tmp;
34605 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
34606 		Z_ADDREF_P(varname);
34607 	}
34608 
34609 	if (IS_UNUSED != IS_UNUSED) {
34610 		zend_class_entry *ce;
34611 
34612 		if (IS_UNUSED == IS_CONST) {
34613 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
34614 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
34615 			} else {
34616 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
34617 				if (UNEXPECTED(EG(exception) != NULL)) {
34618 					if (IS_CV != IS_CONST && varname == &tmp) {
34619 						zval_dtor(&tmp);
34620 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
34621 						zval_ptr_dtor(&varname);
34622 					}
34623 
34624 					HANDLE_EXCEPTION();
34625 				}
34626 				if (UNEXPECTED(ce == NULL)) {
34627 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
34628 				}
34629 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
34630 			}
34631 		} else {
34632 			ce = EX_T(opline->op2.var).class_entry;
34633 		}
34634 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
34635 	} else {
34636 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
34637 
34638 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
34639 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
34640 	}
34641 
34642 	if (IS_CV != IS_CONST && varname == &tmp) {
34643 		zval_dtor(&tmp);
34644 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
34645 		zval_ptr_dtor(&varname);
34646 	}
34647 
34648 	CHECK_EXCEPTION();
34649 	ZEND_VM_NEXT_OPCODE();
34650 }
34651 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34652 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34653 {
34654 	USE_OPLINE
34655 	zval **value;
34656 	zend_bool isset = 1;
34657 
34658 	SAVE_OPLINE();
34659 	if (IS_CV == IS_CV &&
34660 	    IS_UNUSED == IS_UNUSED &&
34661 	    (opline->extended_value & ZEND_QUICK_SET)) {
34662 		if (EX_CV(opline->op1.var)) {
34663 			value = EX_CV(opline->op1.var);
34664 		} else if (EG(active_symbol_table)) {
34665 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
34666 
34667 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
34668 				isset = 0;
34669 			}
34670 		} else {
34671 			isset = 0;
34672 		}
34673 	} else {
34674 		HashTable *target_symbol_table;
34675 
34676 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
34677 
34678 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
34679 			ZVAL_COPY_VALUE(&tmp, varname);
34680 			zval_copy_ctor(&tmp);
34681 			convert_to_string(&tmp);
34682 			varname = &tmp;
34683 		}
34684 
34685 		if (IS_UNUSED != IS_UNUSED) {
34686 			zend_class_entry *ce;
34687 
34688 			if (IS_UNUSED == IS_CONST) {
34689 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
34690 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
34691 				} else {
34692 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
34693 					if (UNEXPECTED(ce == NULL)) {
34694 						CHECK_EXCEPTION();
34695 						ZEND_VM_NEXT_OPCODE();
34696 					}
34697 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
34698 				}
34699 			} else {
34700 				ce = EX_T(opline->op2.var).class_entry;
34701 			}
34702 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
34703 			if (!value) {
34704 				isset = 0;
34705 			}
34706 		} else {
34707 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
34708 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
34709 				isset = 0;
34710 			}
34711 		}
34712 
34713 		if (IS_CV != IS_CONST && varname == &tmp) {
34714 			zval_dtor(&tmp);
34715 		}
34716 
34717 	}
34718 
34719 	if (opline->extended_value & ZEND_ISSET) {
34720 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
34721 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
34722 		} else {
34723 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
34724 		}
34725 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
34726 		if (!isset || !i_zend_is_true(*value)) {
34727 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
34728 		} else {
34729 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
34730 		}
34731 	}
34732 
34733 	CHECK_EXCEPTION();
34734 	ZEND_VM_NEXT_OPCODE();
34735 }
34736 
ZEND_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34737 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34738 {
34739 	USE_OPLINE
34740 
34741 
34742 	SAVE_OPLINE();
34743 	fast_add_function(&EX_T(opline->result.var).tmp_var,
34744 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34745 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34746 
34747 
34748 	CHECK_EXCEPTION();
34749 	ZEND_VM_NEXT_OPCODE();
34750 }
34751 
ZEND_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34752 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34753 {
34754 	USE_OPLINE
34755 
34756 
34757 	SAVE_OPLINE();
34758 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
34759 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34760 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34761 
34762 
34763 	CHECK_EXCEPTION();
34764 	ZEND_VM_NEXT_OPCODE();
34765 }
34766 
ZEND_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34767 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34768 {
34769 	USE_OPLINE
34770 
34771 
34772 	SAVE_OPLINE();
34773 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
34774 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34775 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34776 
34777 
34778 	CHECK_EXCEPTION();
34779 	ZEND_VM_NEXT_OPCODE();
34780 }
34781 
ZEND_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34782 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34783 {
34784 	USE_OPLINE
34785 
34786 
34787 	SAVE_OPLINE();
34788 	fast_div_function(&EX_T(opline->result.var).tmp_var,
34789 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34790 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34791 
34792 
34793 	CHECK_EXCEPTION();
34794 	ZEND_VM_NEXT_OPCODE();
34795 }
34796 
ZEND_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34797 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34798 {
34799 	USE_OPLINE
34800 
34801 
34802 	SAVE_OPLINE();
34803 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
34804 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34805 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34806 
34807 
34808 	CHECK_EXCEPTION();
34809 	ZEND_VM_NEXT_OPCODE();
34810 }
34811 
ZEND_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34812 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34813 {
34814 	USE_OPLINE
34815 
34816 
34817 	SAVE_OPLINE();
34818 	shift_left_function(&EX_T(opline->result.var).tmp_var,
34819 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34820 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34821 
34822 
34823 	CHECK_EXCEPTION();
34824 	ZEND_VM_NEXT_OPCODE();
34825 }
34826 
ZEND_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34827 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34828 {
34829 	USE_OPLINE
34830 
34831 
34832 	SAVE_OPLINE();
34833 	shift_right_function(&EX_T(opline->result.var).tmp_var,
34834 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34835 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34836 
34837 
34838 	CHECK_EXCEPTION();
34839 	ZEND_VM_NEXT_OPCODE();
34840 }
34841 
ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34842 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34843 {
34844 	USE_OPLINE
34845 
34846 
34847 	SAVE_OPLINE();
34848 	concat_function(&EX_T(opline->result.var).tmp_var,
34849 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34850 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34851 
34852 
34853 	CHECK_EXCEPTION();
34854 	ZEND_VM_NEXT_OPCODE();
34855 }
34856 
ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34857 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34858 {
34859 	USE_OPLINE
34860 
34861 
34862 	SAVE_OPLINE();
34863 	is_identical_function(&EX_T(opline->result.var).tmp_var,
34864 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34865 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34866 
34867 
34868 	CHECK_EXCEPTION();
34869 	ZEND_VM_NEXT_OPCODE();
34870 }
34871 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34872 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34873 {
34874 	USE_OPLINE
34875 
34876 	zval *result = &EX_T(opline->result.var).tmp_var;
34877 
34878 	SAVE_OPLINE();
34879 	is_identical_function(result,
34880 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34881 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34882 	Z_LVAL_P(result) = !Z_LVAL_P(result);
34883 
34884 
34885 	CHECK_EXCEPTION();
34886 	ZEND_VM_NEXT_OPCODE();
34887 }
34888 
ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34889 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34890 {
34891 	USE_OPLINE
34892 
34893 	zval *result = &EX_T(opline->result.var).tmp_var;
34894 
34895 	SAVE_OPLINE();
34896 	ZVAL_BOOL(result, fast_equal_function(result,
34897 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34898 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
34899 
34900 
34901 	CHECK_EXCEPTION();
34902 	ZEND_VM_NEXT_OPCODE();
34903 }
34904 
ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34905 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34906 {
34907 	USE_OPLINE
34908 
34909 	zval *result = &EX_T(opline->result.var).tmp_var;
34910 
34911 	SAVE_OPLINE();
34912 	ZVAL_BOOL(result, fast_not_equal_function(result,
34913 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34914 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
34915 
34916 
34917 	CHECK_EXCEPTION();
34918 	ZEND_VM_NEXT_OPCODE();
34919 }
34920 
ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34921 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34922 {
34923 	USE_OPLINE
34924 
34925 	zval *result = &EX_T(opline->result.var).tmp_var;
34926 
34927 	SAVE_OPLINE();
34928 	ZVAL_BOOL(result, fast_is_smaller_function(result,
34929 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34930 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
34931 
34932 
34933 	CHECK_EXCEPTION();
34934 	ZEND_VM_NEXT_OPCODE();
34935 }
34936 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34937 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34938 {
34939 	USE_OPLINE
34940 
34941 	zval *result = &EX_T(opline->result.var).tmp_var;
34942 
34943 	SAVE_OPLINE();
34944 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
34945 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34946 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC));
34947 
34948 
34949 	CHECK_EXCEPTION();
34950 	ZEND_VM_NEXT_OPCODE();
34951 }
34952 
ZEND_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34953 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34954 {
34955 	USE_OPLINE
34956 
34957 
34958 	SAVE_OPLINE();
34959 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
34960 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34961 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34962 
34963 
34964 	CHECK_EXCEPTION();
34965 	ZEND_VM_NEXT_OPCODE();
34966 }
34967 
ZEND_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34968 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34969 {
34970 	USE_OPLINE
34971 
34972 
34973 	SAVE_OPLINE();
34974 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
34975 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34976 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34977 
34978 
34979 	CHECK_EXCEPTION();
34980 	ZEND_VM_NEXT_OPCODE();
34981 }
34982 
ZEND_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34983 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34984 {
34985 	USE_OPLINE
34986 
34987 
34988 	SAVE_OPLINE();
34989 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
34990 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
34991 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
34992 
34993 
34994 	CHECK_EXCEPTION();
34995 	ZEND_VM_NEXT_OPCODE();
34996 }
34997 
ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34998 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34999 {
35000 	USE_OPLINE
35001 
35002 
35003 	SAVE_OPLINE();
35004 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
35005 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
35006 		_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
35007 
35008 
35009 	CHECK_EXCEPTION();
35010 	ZEND_VM_NEXT_OPCODE();
35011 }
35012 
zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)35013 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
35014 {
35015 	USE_OPLINE
35016 	zend_free_op free_op_data1;
35017 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35018 	zval *object;
35019 	zval *property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35020 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
35021 	int have_get_ptr = 0;
35022 
35023 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35024 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35025 	}
35026 
35027 	make_real_object(object_ptr TSRMLS_CC);
35028 	object = *object_ptr;
35029 
35030 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
35031 		zend_error(E_WARNING, "Attempt to assign property of non-object");
35032 
35033 		FREE_OP(free_op_data1);
35034 
35035 		if (RETURN_VALUE_USED(opline)) {
35036 			PZVAL_LOCK(&EG(uninitialized_zval));
35037 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
35038 			EX_T(opline->result.var).var.ptr_ptr = NULL;
35039 		}
35040 	} else {
35041 		/* here we are sure we are dealing with an object */
35042 		if (0) {
35043 			MAKE_REAL_ZVAL_PTR(property);
35044 		}
35045 
35046 		/* here property is a string */
35047 		if (opline->extended_value == ZEND_ASSIGN_OBJ
35048 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
35049 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35050 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
35051 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
35052 
35053 				have_get_ptr = 1;
35054 				binary_op(*zptr, *zptr, value TSRMLS_CC);
35055 				if (RETURN_VALUE_USED(opline)) {
35056 					PZVAL_LOCK(*zptr);
35057 					EX_T(opline->result.var).var.ptr = *zptr;
35058 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35059 				}
35060 			}
35061 		}
35062 
35063 		if (!have_get_ptr) {
35064 			zval *z = NULL;
35065 
35066 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
35067 				if (Z_OBJ_HT_P(object)->read_property) {
35068 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35069 				}
35070 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
35071 				if (Z_OBJ_HT_P(object)->read_dimension) {
35072 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
35073 				}
35074 			}
35075 			if (z) {
35076 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
35077 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
35078 
35079 					if (Z_REFCOUNT_P(z) == 0) {
35080 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
35081 						zval_dtor(z);
35082 						FREE_ZVAL(z);
35083 					}
35084 					z = value;
35085 				}
35086 				Z_ADDREF_P(z);
35087 				SEPARATE_ZVAL_IF_NOT_REF(&z);
35088 				binary_op(z, z, value TSRMLS_CC);
35089 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
35090 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35091 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
35092 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
35093 				}
35094 				if (RETURN_VALUE_USED(opline)) {
35095 					PZVAL_LOCK(z);
35096 					EX_T(opline->result.var).var.ptr = z;
35097 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35098 				}
35099 				zval_ptr_dtor(&z);
35100 			} else {
35101 				zend_error(E_WARNING, "Attempt to assign property of non-object");
35102 				if (RETURN_VALUE_USED(opline)) {
35103 					PZVAL_LOCK(&EG(uninitialized_zval));
35104 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
35105 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35106 				}
35107 			}
35108 		}
35109 
35110 		if (0) {
35111 			zval_ptr_dtor(&property);
35112 		} else {
35113 
35114 		}
35115 		FREE_OP(free_op_data1);
35116 	}
35117 
35118 	/* assign_obj has two opcodes! */
35119 	CHECK_EXCEPTION();
35120 	ZEND_VM_INC_OPCODE();
35121 	ZEND_VM_NEXT_OPCODE();
35122 }
35123 
zend_binary_assign_op_helper_SPEC_CV_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)35124 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
35125 {
35126 	USE_OPLINE
35127 	zend_free_op free_op_data2, free_op_data1;
35128 	zval **var_ptr;
35129 	zval *value;
35130 
35131 	SAVE_OPLINE();
35132 	switch (opline->extended_value) {
35133 		case ZEND_ASSIGN_OBJ:
35134 			return zend_binary_assign_op_obj_helper_SPEC_CV_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35135 			break;
35136 		case ZEND_ASSIGN_DIM: {
35137 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35138 
35139 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35140 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35141 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
35142 					if (IS_CV == IS_VAR && !0) {
35143 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
35144 					}
35145 					return zend_binary_assign_op_obj_helper_SPEC_CV_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35146 				} else {
35147 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35148 
35149 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
35150 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
35151 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
35152 				}
35153 			}
35154 			break;
35155 		default:
35156 			value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35157 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35158 			/* do nothing */
35159 			break;
35160 	}
35161 
35162 	if (UNEXPECTED(var_ptr == NULL)) {
35163 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
35164 	}
35165 
35166 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
35167 		if (RETURN_VALUE_USED(opline)) {
35168 			PZVAL_LOCK(&EG(uninitialized_zval));
35169 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
35170 		}
35171 
35172 
35173 		CHECK_EXCEPTION();
35174 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
35175 			ZEND_VM_INC_OPCODE();
35176 		}
35177 		ZEND_VM_NEXT_OPCODE();
35178 	}
35179 
35180 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
35181 
35182 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
35183 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
35184 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
35185 		/* proxy object */
35186 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
35187 		Z_ADDREF_P(objval);
35188 		binary_op(objval, objval, value TSRMLS_CC);
35189 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
35190 		zval_ptr_dtor(&objval);
35191 	} else {
35192 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
35193 	}
35194 
35195 	if (RETURN_VALUE_USED(opline)) {
35196 		PZVAL_LOCK(*var_ptr);
35197 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
35198 	}
35199 
35200 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
35201 		FREE_OP(free_op_data1);
35202 		FREE_OP_VAR_PTR(free_op_data2);
35203 
35204 		CHECK_EXCEPTION();
35205 		ZEND_VM_INC_OPCODE();
35206 	} else {
35207 
35208 		CHECK_EXCEPTION();
35209 	}
35210 	ZEND_VM_NEXT_OPCODE();
35211 }
35212 
ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35213 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35214 {
35215 	return zend_binary_assign_op_helper_SPEC_CV_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35216 }
35217 
ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35218 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35219 {
35220 	return zend_binary_assign_op_helper_SPEC_CV_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35221 }
35222 
ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35223 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35224 {
35225 	return zend_binary_assign_op_helper_SPEC_CV_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35226 }
35227 
ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35228 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35229 {
35230 	return zend_binary_assign_op_helper_SPEC_CV_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35231 }
35232 
ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35233 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35234 {
35235 	return zend_binary_assign_op_helper_SPEC_CV_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35236 }
35237 
ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35238 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35239 {
35240 	return zend_binary_assign_op_helper_SPEC_CV_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35241 }
35242 
ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35243 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35244 {
35245 	return zend_binary_assign_op_helper_SPEC_CV_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35246 }
35247 
ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35248 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35249 {
35250 	return zend_binary_assign_op_helper_SPEC_CV_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35251 }
35252 
ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35253 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35254 {
35255 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35256 }
35257 
ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35258 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35259 {
35260 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35261 }
35262 
ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35263 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35264 {
35265 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35266 }
35267 
zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)35268 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
35269 {
35270 	USE_OPLINE
35271 
35272 	zval **object_ptr;
35273 	zval *object;
35274 	zval *property;
35275 	zval **retval;
35276 	int have_get_ptr = 0;
35277 
35278 	SAVE_OPLINE();
35279 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35280 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35281 	retval = &EX_T(opline->result.var).var.ptr;
35282 
35283 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35284 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
35285 	}
35286 
35287 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
35288 	object = *object_ptr;
35289 
35290 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
35291 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
35292 
35293 		if (RETURN_VALUE_USED(opline)) {
35294 			PZVAL_LOCK(&EG(uninitialized_zval));
35295 			*retval = &EG(uninitialized_zval);
35296 		}
35297 
35298 		CHECK_EXCEPTION();
35299 		ZEND_VM_NEXT_OPCODE();
35300 	}
35301 
35302 	/* here we are sure we are dealing with an object */
35303 
35304 	if (0) {
35305 		MAKE_REAL_ZVAL_PTR(property);
35306 	}
35307 
35308 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
35309 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35310 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
35311 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
35312 
35313 			have_get_ptr = 1;
35314 			incdec_op(*zptr);
35315 			if (RETURN_VALUE_USED(opline)) {
35316 				*retval = *zptr;
35317 				PZVAL_LOCK(*retval);
35318 			}
35319 		}
35320 	}
35321 
35322 	if (!have_get_ptr) {
35323 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
35324 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35325 
35326 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
35327 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
35328 
35329 				if (Z_REFCOUNT_P(z) == 0) {
35330 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
35331 					zval_dtor(z);
35332 					FREE_ZVAL(z);
35333 				}
35334 				z = value;
35335 			}
35336 			Z_ADDREF_P(z);
35337 			SEPARATE_ZVAL_IF_NOT_REF(&z);
35338 			incdec_op(z);
35339 			*retval = z;
35340 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35341 			SELECTIVE_PZVAL_LOCK(*retval, opline);
35342 			zval_ptr_dtor(&z);
35343 		} else {
35344 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
35345 			if (RETURN_VALUE_USED(opline)) {
35346 				PZVAL_LOCK(&EG(uninitialized_zval));
35347 				*retval = &EG(uninitialized_zval);
35348 			}
35349 		}
35350 	}
35351 
35352 	if (0) {
35353 		zval_ptr_dtor(&property);
35354 	} else {
35355 
35356 	}
35357 
35358 	CHECK_EXCEPTION();
35359 	ZEND_VM_NEXT_OPCODE();
35360 }
35361 
ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35362 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35363 {
35364 	return zend_pre_incdec_property_helper_SPEC_CV_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35365 }
35366 
ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35367 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35368 {
35369 	return zend_pre_incdec_property_helper_SPEC_CV_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35370 }
35371 
zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)35372 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
35373 {
35374 	USE_OPLINE
35375 
35376 	zval **object_ptr;
35377 	zval *object;
35378 	zval *property;
35379 	zval *retval;
35380 	int have_get_ptr = 0;
35381 
35382 	SAVE_OPLINE();
35383 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35384 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35385 	retval = &EX_T(opline->result.var).tmp_var;
35386 
35387 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35388 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
35389 	}
35390 
35391 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
35392 	object = *object_ptr;
35393 
35394 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
35395 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
35396 
35397 		ZVAL_NULL(retval);
35398 
35399 		CHECK_EXCEPTION();
35400 		ZEND_VM_NEXT_OPCODE();
35401 	}
35402 
35403 	/* here we are sure we are dealing with an object */
35404 
35405 	if (0) {
35406 		MAKE_REAL_ZVAL_PTR(property);
35407 	}
35408 
35409 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
35410 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35411 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
35412 			have_get_ptr = 1;
35413 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
35414 
35415 			ZVAL_COPY_VALUE(retval, *zptr);
35416 			zendi_zval_copy_ctor(*retval);
35417 
35418 			incdec_op(*zptr);
35419 
35420 		}
35421 	}
35422 
35423 	if (!have_get_ptr) {
35424 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
35425 			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35426 			zval *z_copy;
35427 
35428 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
35429 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
35430 
35431 				if (Z_REFCOUNT_P(z) == 0) {
35432 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
35433 					zval_dtor(z);
35434 					FREE_ZVAL(z);
35435 				}
35436 				z = value;
35437 			}
35438 			ZVAL_COPY_VALUE(retval, z);
35439 			zendi_zval_copy_ctor(*retval);
35440 			ALLOC_ZVAL(z_copy);
35441 			INIT_PZVAL_COPY(z_copy, z);
35442 			zendi_zval_copy_ctor(*z_copy);
35443 			incdec_op(z_copy);
35444 			Z_ADDREF_P(z);
35445 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35446 			zval_ptr_dtor(&z_copy);
35447 			zval_ptr_dtor(&z);
35448 		} else {
35449 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
35450 			ZVAL_NULL(retval);
35451 		}
35452 	}
35453 
35454 	if (0) {
35455 		zval_ptr_dtor(&property);
35456 	} else {
35457 
35458 	}
35459 
35460 	CHECK_EXCEPTION();
35461 	ZEND_VM_NEXT_OPCODE();
35462 }
35463 
ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35464 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35465 {
35466 	return zend_post_incdec_property_helper_SPEC_CV_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35467 }
35468 
ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35469 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35470 {
35471 	return zend_post_incdec_property_helper_SPEC_CV_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35472 }
35473 
ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35474 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35475 {
35476 	USE_OPLINE
35477 
35478 	zval *container;
35479 
35480 	SAVE_OPLINE();
35481 
35482 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
35483 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
35484 	}
35485 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
35486 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
35487 
35488 
35489 	CHECK_EXCEPTION();
35490 	ZEND_VM_NEXT_OPCODE();
35491 }
35492 
ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35493 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35494 {
35495 	USE_OPLINE
35496 	zend_free_op free_op1;
35497 	zval **container;
35498 
35499 	SAVE_OPLINE();
35500 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35501 
35502 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35503 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35504 	}
35505 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
35506 
35507 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35508 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35509 	}
35510 
35511 	/* We are going to assign the result by reference */
35512 	if (UNEXPECTED(opline->extended_value != 0)) {
35513 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
35514 
35515 		if (retval_ptr) {
35516 			Z_DELREF_PP(retval_ptr);
35517 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
35518 			Z_ADDREF_PP(retval_ptr);
35519 		}
35520 	}
35521 
35522 	CHECK_EXCEPTION();
35523 	ZEND_VM_NEXT_OPCODE();
35524 }
35525 
ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35526 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35527 {
35528 	USE_OPLINE
35529 	zend_free_op free_op1;
35530 	zval **container;
35531 
35532 	SAVE_OPLINE();
35533 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35534 
35535 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35536 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35537 	}
35538 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_RW TSRMLS_CC);
35539 
35540 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35541 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35542 	}
35543 
35544 	CHECK_EXCEPTION();
35545 	ZEND_VM_NEXT_OPCODE();
35546 }
35547 
ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35548 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35549 {
35550 	USE_OPLINE
35551 
35552 	zval *container;
35553 
35554 	SAVE_OPLINE();
35555 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
35556 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_IS TSRMLS_CC);
35557 
35558 
35559 	CHECK_EXCEPTION();
35560 	ZEND_VM_NEXT_OPCODE();
35561 }
35562 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35563 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35564 {
35565 	USE_OPLINE
35566 	zend_free_op free_op1;
35567 
35568 	SAVE_OPLINE();
35569 
35570 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
35571 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35572 
35573 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35574 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35575 		}
35576 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
35577 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35578 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35579 		}
35580 
35581 
35582 	} else {
35583 		zval *container;
35584 
35585 		if (IS_CV == IS_UNUSED) {
35586 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
35587 		}
35588 		container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
35589 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
35590 
35591 
35592 	}
35593 	CHECK_EXCEPTION();
35594 	ZEND_VM_NEXT_OPCODE();
35595 }
35596 
ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35597 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35598 {
35599 	USE_OPLINE
35600 	zend_free_op free_op1;
35601 	zval **container;
35602 
35603 	SAVE_OPLINE();
35604 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
35605 
35606 	if (IS_CV == IS_CV) {
35607 		if (container != &EG(uninitialized_zval_ptr)) {
35608 			SEPARATE_ZVAL_IF_NOT_REF(container);
35609 		}
35610 	}
35611 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35612 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35613 	}
35614 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_UNSET TSRMLS_CC);
35615 
35616 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35617 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35618 	}
35619 
35620 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
35621 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
35622 	} else {
35623 		zend_free_op free_res;
35624 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
35625 
35626 		PZVAL_UNLOCK(*retval_ptr, &free_res);
35627 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
35628 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
35629 		}
35630 		PZVAL_LOCK(*retval_ptr);
35631 		FREE_OP_VAR_PTR(free_res);
35632 		CHECK_EXCEPTION();
35633 		ZEND_VM_NEXT_OPCODE();
35634 	}
35635 }
35636 
zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS)35637 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS)
35638 {
35639 	USE_OPLINE
35640 
35641 	zval *container;
35642 
35643 	zval *offset;
35644 
35645 	SAVE_OPLINE();
35646 	container = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
35647 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35648 
35649 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
35650 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
35651 		zend_error(E_NOTICE, "Trying to get property of non-object");
35652 		PZVAL_LOCK(&EG(uninitialized_zval));
35653 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
35654 
35655 	} else {
35656 		zval *retval;
35657 
35658 		if (0) {
35659 			MAKE_REAL_ZVAL_PTR(offset);
35660 		}
35661 
35662 		/* here we are sure we are dealing with an object */
35663 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35664 
35665 		PZVAL_LOCK(retval);
35666 		AI_SET_PTR(&EX_T(opline->result.var), retval);
35667 
35668 		if (0) {
35669 			zval_ptr_dtor(&offset);
35670 		} else {
35671 
35672 		}
35673 	}
35674 
35675 	CHECK_EXCEPTION();
35676 	ZEND_VM_NEXT_OPCODE();
35677 }
35678 
ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35679 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35680 {
35681 	return zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35682 }
35683 
ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35684 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35685 {
35686 	USE_OPLINE
35687 	zend_free_op free_op1;
35688 	zval *property;
35689 	zval **container;
35690 
35691 	SAVE_OPLINE();
35692 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35693 
35694 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
35695 		PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
35696 		EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
35697 	}
35698 
35699 	if (0) {
35700 		MAKE_REAL_ZVAL_PTR(property);
35701 	}
35702 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35703 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35704 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35705 	}
35706 
35707 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
35708 	if (0) {
35709 		zval_ptr_dtor(&property);
35710 	} else {
35711 
35712 	}
35713 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35714 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35715 	}
35716 
35717 	/* We are going to assign the result by reference */
35718 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
35719 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
35720 
35721 		Z_DELREF_PP(retval_ptr);
35722 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
35723 		Z_ADDREF_PP(retval_ptr);
35724 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
35725 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
35726 	}
35727 
35728 	CHECK_EXCEPTION();
35729 	ZEND_VM_NEXT_OPCODE();
35730 }
35731 
ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35732 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35733 {
35734 	USE_OPLINE
35735 	zend_free_op free_op1;
35736 	zval *property;
35737 	zval **container;
35738 
35739 	SAVE_OPLINE();
35740 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35741 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(EX_CVs(), opline->op1.var TSRMLS_CC);
35742 
35743 	if (0) {
35744 		MAKE_REAL_ZVAL_PTR(property);
35745 	}
35746 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35747 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35748 	}
35749 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
35750 	if (0) {
35751 		zval_ptr_dtor(&property);
35752 	} else {
35753 
35754 	}
35755 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35756 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35757 	}
35758 
35759 	CHECK_EXCEPTION();
35760 	ZEND_VM_NEXT_OPCODE();
35761 }
35762 
ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35763 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35764 {
35765 	USE_OPLINE
35766 
35767 	zval *container;
35768 
35769 	zval *offset;
35770 
35771 	SAVE_OPLINE();
35772 	container = _get_zval_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
35773 	offset  = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35774 
35775 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
35776 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
35777 		PZVAL_LOCK(&EG(uninitialized_zval));
35778 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
35779 
35780 	} else {
35781 		zval *retval;
35782 
35783 		if (0) {
35784 			MAKE_REAL_ZVAL_PTR(offset);
35785 		}
35786 
35787 		/* here we are sure we are dealing with an object */
35788 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35789 
35790 		PZVAL_LOCK(retval);
35791 		AI_SET_PTR(&EX_T(opline->result.var), retval);
35792 
35793 		if (0) {
35794 			zval_ptr_dtor(&offset);
35795 		} else {
35796 
35797 		}
35798 	}
35799 
35800 	CHECK_EXCEPTION();
35801 	ZEND_VM_NEXT_OPCODE();
35802 }
35803 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35804 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35805 {
35806 	USE_OPLINE
35807 
35808 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
35809 		/* Behave like FETCH_OBJ_W */
35810 		zend_free_op free_op1;
35811 		zval *property;
35812 		zval **container;
35813 
35814 		SAVE_OPLINE();
35815 		property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35816 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35817 
35818 		if (0) {
35819 			MAKE_REAL_ZVAL_PTR(property);
35820 		}
35821 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35822 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35823 		}
35824 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
35825 		if (0) {
35826 			zval_ptr_dtor(&property);
35827 		} else {
35828 
35829 		}
35830 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35831 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35832 		}
35833 
35834 		CHECK_EXCEPTION();
35835 		ZEND_VM_NEXT_OPCODE();
35836 	} else {
35837 		return zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35838 	}
35839 }
35840 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35841 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35842 {
35843 	USE_OPLINE
35844 	zend_free_op free_op1, free_res;
35845 	zval **container;
35846 	zval *property;
35847 
35848 	SAVE_OPLINE();
35849 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
35850 	property = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35851 
35852 	if (IS_CV == IS_CV) {
35853 		if (container != &EG(uninitialized_zval_ptr)) {
35854 			SEPARATE_ZVAL_IF_NOT_REF(container);
35855 		}
35856 	}
35857 	if (0) {
35858 		MAKE_REAL_ZVAL_PTR(property);
35859 	}
35860 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
35861 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35862 	}
35863 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
35864 	if (0) {
35865 		zval_ptr_dtor(&property);
35866 	} else {
35867 
35868 	}
35869 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
35870 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
35871 	}
35872 
35873 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
35874 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
35875 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
35876 	}
35877 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
35878 	FREE_OP_VAR_PTR(free_res);
35879 	CHECK_EXCEPTION();
35880 	ZEND_VM_NEXT_OPCODE();
35881 }
35882 
ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35883 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35884 {
35885 	USE_OPLINE
35886 
35887 	zval **object_ptr;
35888 	zval *property_name;
35889 
35890 	SAVE_OPLINE();
35891 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35892 	property_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35893 
35894 	if (0) {
35895 		MAKE_REAL_ZVAL_PTR(property_name);
35896 	}
35897 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35898 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35899 	}
35900 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35901 	if (0) {
35902 		zval_ptr_dtor(&property_name);
35903 	} else {
35904 
35905 	}
35906 
35907 	/* assign_obj has two opcodes! */
35908 	CHECK_EXCEPTION();
35909 	ZEND_VM_INC_OPCODE();
35910 	ZEND_VM_NEXT_OPCODE();
35911 }
35912 
ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35913 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35914 {
35915 	USE_OPLINE
35916 
35917 	zval **object_ptr;
35918 
35919 	SAVE_OPLINE();
35920 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
35921 
35922 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35923 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
35924 	}
35925 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
35926 
35927 		zval *property_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35928 
35929 		if (0) {
35930 			MAKE_REAL_ZVAL_PTR(property_name);
35931 		}
35932 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), ZEND_ASSIGN_DIM, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35933 		if (0) {
35934 			zval_ptr_dtor(&property_name);
35935 		} else {
35936 
35937 		}
35938 	} else {
35939 		zend_free_op free_op_data1, free_op_data2;
35940 		zval *value;
35941 		zval *dim = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
35942 		zval **variable_ptr_ptr;
35943 
35944 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CV, BP_VAR_W TSRMLS_CC);
35945 
35946 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, EX_Ts(), &free_op_data1, BP_VAR_R);
35947 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, EX_Ts(), &free_op_data2 TSRMLS_CC);
35948 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
35949 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
35950 				if (RETURN_VALUE_USED(opline)) {
35951 					zval *retval;
35952 
35953 					ALLOC_ZVAL(retval);
35954 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
35955 					INIT_PZVAL(retval);
35956 					AI_SET_PTR(&EX_T(opline->result.var), retval);
35957 				}
35958 			} else if (RETURN_VALUE_USED(opline)) {
35959 				PZVAL_LOCK(&EG(uninitialized_zval));
35960 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
35961 			}
35962 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
35963 			if (IS_TMP_FREE(free_op_data1)) {
35964 				zval_dtor(value);
35965 			}
35966 			if (RETURN_VALUE_USED(opline)) {
35967 				PZVAL_LOCK(&EG(uninitialized_zval));
35968 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
35969 			}
35970 		} else {
35971 			if ((opline+1)->op1_type == IS_TMP_VAR) {
35972 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
35973 			} else if ((opline+1)->op1_type == IS_CONST) {
35974 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
35975 			} else {
35976 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
35977 			}
35978 			if (RETURN_VALUE_USED(opline)) {
35979 				PZVAL_LOCK(value);
35980 				AI_SET_PTR(&EX_T(opline->result.var), value);
35981 			}
35982 		}
35983 		FREE_OP_VAR_PTR(free_op_data2);
35984 	 	FREE_OP_IF_VAR(free_op_data1);
35985 	}
35986 
35987 	/* assign_dim has two opcodes! */
35988 	CHECK_EXCEPTION();
35989 	ZEND_VM_INC_OPCODE();
35990 	ZEND_VM_NEXT_OPCODE();
35991 }
35992 
ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35993 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35994 {
35995 	USE_OPLINE
35996 
35997 	zval *value;
35998 	zval **variable_ptr_ptr;
35999 
36000 	SAVE_OPLINE();
36001 	value = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36002 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
36003 
36004 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
36005 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CV TSRMLS_CC)) {
36006 			if (RETURN_VALUE_USED(opline)) {
36007 				zval *retval;
36008 
36009 				ALLOC_ZVAL(retval);
36010 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
36011 				INIT_PZVAL(retval);
36012 				AI_SET_PTR(&EX_T(opline->result.var), retval);
36013 			}
36014 		} else if (RETURN_VALUE_USED(opline)) {
36015 			PZVAL_LOCK(&EG(uninitialized_zval));
36016 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
36017 		}
36018 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
36019 		if (0) {
36020 			zval_dtor(value);
36021 		}
36022 		if (RETURN_VALUE_USED(opline)) {
36023 			PZVAL_LOCK(&EG(uninitialized_zval));
36024 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
36025 		}
36026 	} else {
36027 		if (IS_CV == IS_TMP_VAR) {
36028 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
36029 		} else if (IS_CV == IS_CONST) {
36030 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
36031 		} else {
36032 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
36033 		}
36034 		if (RETURN_VALUE_USED(opline)) {
36035 			PZVAL_LOCK(value);
36036 			AI_SET_PTR(&EX_T(opline->result.var), value);
36037 		}
36038 	}
36039 
36040 	/* zend_assign_to_variable() always takes care of op2, never free it! */
36041 
36042 	CHECK_EXCEPTION();
36043 	ZEND_VM_NEXT_OPCODE();
36044 }
36045 
ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36046 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36047 {
36048 	USE_OPLINE
36049 	zend_free_op free_op2;
36050 	zval **variable_ptr_ptr;
36051 	zval **value_ptr_ptr;
36052 
36053 	SAVE_OPLINE();
36054 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op2.var TSRMLS_CC);
36055 
36056 	if (IS_CV == IS_VAR &&
36057 	    value_ptr_ptr &&
36058 	    !Z_ISREF_PP(value_ptr_ptr) &&
36059 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
36060 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
36061 		if (free_op2.var == NULL) {
36062 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
36063 		}
36064 		zend_error(E_STRICT, "Only variables should be assigned by reference");
36065 		if (UNEXPECTED(EG(exception) != NULL)) {
36066 
36067 			HANDLE_EXCEPTION();
36068 		}
36069 		return ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36070 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
36071 		PZVAL_LOCK(*value_ptr_ptr);
36072 	}
36073 	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
36074 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
36075 	}
36076 
36077 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
36078 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
36079 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
36080 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
36081 	}
36082 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
36083 
36084 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
36085 		Z_DELREF_PP(variable_ptr_ptr);
36086 	}
36087 
36088 	if (RETURN_VALUE_USED(opline)) {
36089 		PZVAL_LOCK(*variable_ptr_ptr);
36090 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
36091 	}
36092 
36093 
36094 	CHECK_EXCEPTION();
36095 	ZEND_VM_NEXT_OPCODE();
36096 }
36097 
ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36098 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36099 {
36100 	USE_OPLINE
36101 	zval *function_name;
36102 	char *function_name_strval;
36103 	int function_name_strlen;
36104 
36105 
36106 	SAVE_OPLINE();
36107 	zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(called_scope));
36108 
36109 	function_name = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36110 
36111 	if (IS_CV != IS_CONST &&
36112 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
36113 		zend_error_noreturn(E_ERROR, "Method name must be a string");
36114 	}
36115 
36116 	function_name_strval = Z_STRVAL_P(function_name);
36117 	function_name_strlen = Z_STRLEN_P(function_name);
36118 
36119 	EX(object) = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
36120 
36121 	if (EXPECTED(EX(object) != NULL) &&
36122 	    EXPECTED(Z_TYPE_P(EX(object)) == IS_OBJECT)) {
36123 		EX(called_scope) = Z_OBJCE_P(EX(object));
36124 
36125 		if (IS_CV != IS_CONST ||
36126 		    (EX(fbc) = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope))) == NULL) {
36127 		    zval *object = EX(object);
36128 
36129 			if (UNEXPECTED(Z_OBJ_HT_P(EX(object))->get_method == NULL)) {
36130 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
36131 			}
36132 
36133 			/* First, locate the function. */
36134 			EX(fbc) = Z_OBJ_HT_P(EX(object))->get_method(&EX(object), function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
36135 			if (UNEXPECTED(EX(fbc) == NULL)) {
36136 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), function_name_strval);
36137 			}
36138 			if (IS_CV == IS_CONST &&
36139 			    EXPECTED(EX(fbc)->type <= ZEND_USER_FUNCTION) &&
36140 			    EXPECTED((EX(fbc)->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
36141 			    EXPECTED(EX(object) == object)) {
36142 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, EX(called_scope), EX(fbc));
36143 			}
36144 		}
36145 	} else {
36146 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
36147 	}
36148 
36149 	if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
36150 		EX(object) = NULL;
36151 	} else {
36152 		if (!PZVAL_IS_REF(EX(object))) {
36153 			Z_ADDREF_P(EX(object)); /* For $this pointer */
36154 		} else {
36155 			zval *this_ptr;
36156 			ALLOC_ZVAL(this_ptr);
36157 			INIT_PZVAL_COPY(this_ptr, EX(object));
36158 			zval_copy_ctor(this_ptr);
36159 			EX(object) = this_ptr;
36160 		}
36161 	}
36162 
36163 
36164 	CHECK_EXCEPTION();
36165 	ZEND_VM_NEXT_OPCODE();
36166 }
36167 
ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36168 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36169 {
36170 	USE_OPLINE
36171 
36172 
36173 	SAVE_OPLINE();
36174 	if (IS_CV==IS_VAR) {
36175 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
36176 	}
36177 	is_equal_function(&EX_T(opline->result.var).tmp_var,
36178 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC),
36179 				 _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC) TSRMLS_CC);
36180 
36181 	CHECK_EXCEPTION();
36182 	ZEND_VM_NEXT_OPCODE();
36183 }
36184 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36185 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36186 {
36187 	USE_OPLINE
36188 
36189 	zval *expr_ptr;
36190 
36191 	SAVE_OPLINE();
36192 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
36193 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(EX_CVs(), opline->op1.var TSRMLS_CC);
36194 
36195 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
36196 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
36197 		}
36198 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
36199 		expr_ptr = *expr_ptr_ptr;
36200 		Z_ADDREF_P(expr_ptr);
36201 	} else {
36202 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
36203 		if (0) { /* temporary variable */
36204 			zval *new_expr;
36205 
36206 			ALLOC_ZVAL(new_expr);
36207 			INIT_PZVAL_COPY(new_expr, expr_ptr);
36208 			expr_ptr = new_expr;
36209 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
36210 			zval *new_expr;
36211 
36212 			ALLOC_ZVAL(new_expr);
36213 			INIT_PZVAL_COPY(new_expr, expr_ptr);
36214 			expr_ptr = new_expr;
36215 			zendi_zval_copy_ctor(*expr_ptr);
36216 		} else {
36217 			Z_ADDREF_P(expr_ptr);
36218 		}
36219 	}
36220 
36221 	if (IS_CV != IS_UNUSED) {
36222 
36223 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36224 		ulong hval;
36225 
36226 		switch (Z_TYPE_P(offset)) {
36227 			case IS_DOUBLE:
36228 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
36229 				goto num_index;
36230 			case IS_LONG:
36231 			case IS_BOOL:
36232 				hval = Z_LVAL_P(offset);
36233 num_index:
36234 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
36235 				break;
36236 			case IS_STRING:
36237 				if (IS_CV == IS_CONST) {
36238 					hval = Z_HASH_P(offset);
36239 				} else {
36240 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
36241 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
36242 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
36243 					} else {
36244 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
36245 					}
36246 				}
36247 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
36248 				break;
36249 			case IS_NULL:
36250 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
36251 				break;
36252 			default:
36253 				zend_error(E_WARNING, "Illegal offset type");
36254 				zval_ptr_dtor(&expr_ptr);
36255 				/* do nothing */
36256 				break;
36257 		}
36258 
36259 	} else {
36260 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
36261 	}
36262 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
36263 
36264 	} else {
36265 
36266 	}
36267 	CHECK_EXCEPTION();
36268 	ZEND_VM_NEXT_OPCODE();
36269 }
36270 
ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36271 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36272 {
36273 	USE_OPLINE
36274 
36275 	array_init(&EX_T(opline->result.var).tmp_var);
36276 	if (IS_CV == IS_UNUSED) {
36277 		ZEND_VM_NEXT_OPCODE();
36278 #if 0 || IS_CV != IS_UNUSED
36279 	} else {
36280 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36281 #endif
36282 	}
36283 }
36284 
ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36285 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36286 {
36287 	USE_OPLINE
36288 
36289 	zval **container;
36290 	zval *offset;
36291 	ulong hval;
36292 
36293 	SAVE_OPLINE();
36294 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
36295 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
36296 		SEPARATE_ZVAL_IF_NOT_REF(container);
36297 	}
36298 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36299 
36300 	if (IS_CV != IS_VAR || container) {
36301 		switch (Z_TYPE_PP(container)) {
36302 			case IS_ARRAY: {
36303 				HashTable *ht = Z_ARRVAL_PP(container);
36304 
36305 				switch (Z_TYPE_P(offset)) {
36306 					case IS_DOUBLE:
36307 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
36308 						zend_hash_index_del(ht, hval);
36309 						break;
36310 					case IS_RESOURCE:
36311 					case IS_BOOL:
36312 					case IS_LONG:
36313 						hval = Z_LVAL_P(offset);
36314 						zend_hash_index_del(ht, hval);
36315 						break;
36316 					case IS_STRING:
36317 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
36318 							Z_ADDREF_P(offset);
36319 						}
36320 						if (IS_CV == IS_CONST) {
36321 							hval = Z_HASH_P(offset);
36322 						} else {
36323 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
36324 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
36325 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
36326 							} else {
36327 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
36328 							}
36329 						}
36330 						if (ht == &EG(symbol_table)) {
36331 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
36332 						} else {
36333 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
36334 						}
36335 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
36336 							zval_ptr_dtor(&offset);
36337 						}
36338 						break;
36339 num_index_dim:
36340 						zend_hash_index_del(ht, hval);
36341 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
36342 							zval_ptr_dtor(&offset);
36343 						}
36344 						break;
36345 					case IS_NULL:
36346 						zend_hash_del(ht, "", sizeof(""));
36347 						break;
36348 					default:
36349 						zend_error(E_WARNING, "Illegal offset type in unset");
36350 						break;
36351 				}
36352 
36353 				break;
36354 			}
36355 			case IS_OBJECT:
36356 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
36357 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
36358 				}
36359 				if (0) {
36360 					MAKE_REAL_ZVAL_PTR(offset);
36361 				}
36362 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
36363 				if (0) {
36364 					zval_ptr_dtor(&offset);
36365 				} else {
36366 
36367 				}
36368 				break;
36369 			case IS_STRING:
36370 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
36371 				ZEND_VM_CONTINUE(); /* bailed out before */
36372 			default:
36373 
36374 				break;
36375 		}
36376 	} else {
36377 
36378 	}
36379 
36380 	CHECK_EXCEPTION();
36381 	ZEND_VM_NEXT_OPCODE();
36382 }
36383 
ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36384 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36385 {
36386 	USE_OPLINE
36387 
36388 	zval **container;
36389 	zval *offset;
36390 
36391 	SAVE_OPLINE();
36392 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
36393 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36394 
36395 	if (IS_CV != IS_VAR || container) {
36396 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
36397 			SEPARATE_ZVAL_IF_NOT_REF(container);
36398 		}
36399 		if (Z_TYPE_PP(container) == IS_OBJECT) {
36400 			if (0) {
36401 				MAKE_REAL_ZVAL_PTR(offset);
36402 			}
36403 			if (Z_OBJ_HT_P(*container)->unset_property) {
36404 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36405 			} else {
36406 				zend_error(E_NOTICE, "Trying to unset property of non-object");
36407 			}
36408 			if (0) {
36409 				zval_ptr_dtor(&offset);
36410 			} else {
36411 
36412 			}
36413 		} else {
36414 
36415 		}
36416 	} else {
36417 
36418 	}
36419 
36420 	CHECK_EXCEPTION();
36421 	ZEND_VM_NEXT_OPCODE();
36422 }
36423 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)36424 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
36425 {
36426 	USE_OPLINE
36427 
36428 	zval **container;
36429 	zval **value = NULL;
36430 	int result = 0;
36431 	ulong hval;
36432 	zval *offset;
36433 
36434 	SAVE_OPLINE();
36435 	container = _get_zval_ptr_ptr_cv_BP_VAR_IS(EX_CVs(), opline->op1.var TSRMLS_CC);
36436 
36437 	offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
36438 
36439 	if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
36440 		HashTable *ht;
36441 		int isset = 0;
36442 
36443 		ht = Z_ARRVAL_PP(container);
36444 
36445 		switch (Z_TYPE_P(offset)) {
36446 			case IS_DOUBLE:
36447 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
36448 				goto num_index_prop;
36449 			case IS_RESOURCE:
36450 			case IS_BOOL:
36451 			case IS_LONG:
36452 				hval = Z_LVAL_P(offset);
36453 num_index_prop:
36454 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
36455 					isset = 1;
36456 				}
36457 				break;
36458 			case IS_STRING:
36459 				if (IS_CV == IS_CONST) {
36460 					hval = Z_HASH_P(offset);
36461 				} else {
36462 					if (!prop_dim) {
36463 						ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
36464 					}
36465 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
36466 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
36467 					} else {
36468 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
36469 					}
36470 				}
36471 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
36472 					isset = 1;
36473 				}
36474 				break;
36475 			case IS_NULL:
36476 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
36477 					isset = 1;
36478 				}
36479 				break;
36480 			default:
36481 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
36482 				break;
36483 		}
36484 
36485 		if (opline->extended_value & ZEND_ISSET) {
36486 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
36487 				result = 0;
36488 			} else {
36489 				result = isset;
36490 			}
36491 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
36492 			if (!isset || !i_zend_is_true(*value)) {
36493 				result = 0;
36494 			} else {
36495 				result = 1;
36496 			}
36497 		}
36498 
36499 	} else if (Z_TYPE_PP(container) == IS_OBJECT) {
36500 		if (0) {
36501 			MAKE_REAL_ZVAL_PTR(offset);
36502 		}
36503 		if (prop_dim) {
36504 			if (Z_OBJ_HT_P(*container)->has_property) {
36505 				result = Z_OBJ_HT_P(*container)->has_property(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36506 			} else {
36507 				zend_error(E_NOTICE, "Trying to check property of non-object");
36508 				result = 0;
36509 			}
36510 		} else {
36511 			if (Z_OBJ_HT_P(*container)->has_dimension) {
36512 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
36513 			} else {
36514 				zend_error(E_NOTICE, "Trying to check element of non-array");
36515 				result = 0;
36516 			}
36517 		}
36518 		if (0) {
36519 			zval_ptr_dtor(&offset);
36520 		} else {
36521 
36522 		}
36523 	} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
36524 		zval tmp;
36525 
36526 		if (Z_TYPE_P(offset) != IS_LONG) {
36527 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
36528 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
36529 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
36530 				ZVAL_COPY_VALUE(&tmp, offset);
36531 				zval_copy_ctor(&tmp);
36532 				convert_to_long(&tmp);
36533 				offset = &tmp;
36534 			} else {
36535 				/* can not be converted to proper offset, return "not set" */
36536 				result = 0;
36537 			}
36538 		}
36539 		if (Z_TYPE_P(offset) == IS_LONG) {
36540 			if (opline->extended_value & ZEND_ISSET) {
36541 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
36542 					result = 1;
36543 				}
36544 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
36545 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
36546 					result = 1;
36547 				}
36548 			}
36549 		}
36550 
36551 	} else {
36552 
36553 	}
36554 
36555 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
36556 	if (opline->extended_value & ZEND_ISSET) {
36557 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
36558 	} else {
36559 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
36560 	}
36561 
36562 	CHECK_EXCEPTION();
36563 	ZEND_VM_NEXT_OPCODE();
36564 }
36565 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36566 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36567 {
36568 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36569 }
36570 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36571 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36572 {
36573 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36574 }
36575 
ZEND_NULL_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36576 static int ZEND_FASTCALL ZEND_NULL_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36577 {
36578 	zend_error_noreturn(E_ERROR, "Invalid opcode %d/%d/%d.", OPLINE->opcode, OPLINE->op1_type, OPLINE->op2_type);
36579 }
36580 
36581 
zend_init_opcodes_handlers(void)36582 void zend_init_opcodes_handlers(void)
36583 {
36584   static const opcode_handler_t labels[] = {
36585   	ZEND_NOP_SPEC_HANDLER,
36586   	ZEND_NOP_SPEC_HANDLER,
36587   	ZEND_NOP_SPEC_HANDLER,
36588   	ZEND_NOP_SPEC_HANDLER,
36589   	ZEND_NOP_SPEC_HANDLER,
36590   	ZEND_NOP_SPEC_HANDLER,
36591   	ZEND_NOP_SPEC_HANDLER,
36592   	ZEND_NOP_SPEC_HANDLER,
36593   	ZEND_NOP_SPEC_HANDLER,
36594   	ZEND_NOP_SPEC_HANDLER,
36595   	ZEND_NOP_SPEC_HANDLER,
36596   	ZEND_NOP_SPEC_HANDLER,
36597   	ZEND_NOP_SPEC_HANDLER,
36598   	ZEND_NOP_SPEC_HANDLER,
36599   	ZEND_NOP_SPEC_HANDLER,
36600   	ZEND_NOP_SPEC_HANDLER,
36601   	ZEND_NOP_SPEC_HANDLER,
36602   	ZEND_NOP_SPEC_HANDLER,
36603   	ZEND_NOP_SPEC_HANDLER,
36604   	ZEND_NOP_SPEC_HANDLER,
36605   	ZEND_NOP_SPEC_HANDLER,
36606   	ZEND_NOP_SPEC_HANDLER,
36607   	ZEND_NOP_SPEC_HANDLER,
36608   	ZEND_NOP_SPEC_HANDLER,
36609   	ZEND_NOP_SPEC_HANDLER,
36610   	ZEND_ADD_SPEC_CONST_CONST_HANDLER,
36611   	ZEND_ADD_SPEC_CONST_TMP_HANDLER,
36612   	ZEND_ADD_SPEC_CONST_VAR_HANDLER,
36613   	ZEND_NULL_HANDLER,
36614   	ZEND_ADD_SPEC_CONST_CV_HANDLER,
36615   	ZEND_ADD_SPEC_TMP_CONST_HANDLER,
36616   	ZEND_ADD_SPEC_TMP_TMP_HANDLER,
36617   	ZEND_ADD_SPEC_TMP_VAR_HANDLER,
36618   	ZEND_NULL_HANDLER,
36619   	ZEND_ADD_SPEC_TMP_CV_HANDLER,
36620   	ZEND_ADD_SPEC_VAR_CONST_HANDLER,
36621   	ZEND_ADD_SPEC_VAR_TMP_HANDLER,
36622   	ZEND_ADD_SPEC_VAR_VAR_HANDLER,
36623   	ZEND_NULL_HANDLER,
36624   	ZEND_ADD_SPEC_VAR_CV_HANDLER,
36625   	ZEND_NULL_HANDLER,
36626   	ZEND_NULL_HANDLER,
36627   	ZEND_NULL_HANDLER,
36628   	ZEND_NULL_HANDLER,
36629   	ZEND_NULL_HANDLER,
36630   	ZEND_ADD_SPEC_CV_CONST_HANDLER,
36631   	ZEND_ADD_SPEC_CV_TMP_HANDLER,
36632   	ZEND_ADD_SPEC_CV_VAR_HANDLER,
36633   	ZEND_NULL_HANDLER,
36634   	ZEND_ADD_SPEC_CV_CV_HANDLER,
36635   	ZEND_SUB_SPEC_CONST_CONST_HANDLER,
36636   	ZEND_SUB_SPEC_CONST_TMP_HANDLER,
36637   	ZEND_SUB_SPEC_CONST_VAR_HANDLER,
36638   	ZEND_NULL_HANDLER,
36639   	ZEND_SUB_SPEC_CONST_CV_HANDLER,
36640   	ZEND_SUB_SPEC_TMP_CONST_HANDLER,
36641   	ZEND_SUB_SPEC_TMP_TMP_HANDLER,
36642   	ZEND_SUB_SPEC_TMP_VAR_HANDLER,
36643   	ZEND_NULL_HANDLER,
36644   	ZEND_SUB_SPEC_TMP_CV_HANDLER,
36645   	ZEND_SUB_SPEC_VAR_CONST_HANDLER,
36646   	ZEND_SUB_SPEC_VAR_TMP_HANDLER,
36647   	ZEND_SUB_SPEC_VAR_VAR_HANDLER,
36648   	ZEND_NULL_HANDLER,
36649   	ZEND_SUB_SPEC_VAR_CV_HANDLER,
36650   	ZEND_NULL_HANDLER,
36651   	ZEND_NULL_HANDLER,
36652   	ZEND_NULL_HANDLER,
36653   	ZEND_NULL_HANDLER,
36654   	ZEND_NULL_HANDLER,
36655   	ZEND_SUB_SPEC_CV_CONST_HANDLER,
36656   	ZEND_SUB_SPEC_CV_TMP_HANDLER,
36657   	ZEND_SUB_SPEC_CV_VAR_HANDLER,
36658   	ZEND_NULL_HANDLER,
36659   	ZEND_SUB_SPEC_CV_CV_HANDLER,
36660   	ZEND_MUL_SPEC_CONST_CONST_HANDLER,
36661   	ZEND_MUL_SPEC_CONST_TMP_HANDLER,
36662   	ZEND_MUL_SPEC_CONST_VAR_HANDLER,
36663   	ZEND_NULL_HANDLER,
36664   	ZEND_MUL_SPEC_CONST_CV_HANDLER,
36665   	ZEND_MUL_SPEC_TMP_CONST_HANDLER,
36666   	ZEND_MUL_SPEC_TMP_TMP_HANDLER,
36667   	ZEND_MUL_SPEC_TMP_VAR_HANDLER,
36668   	ZEND_NULL_HANDLER,
36669   	ZEND_MUL_SPEC_TMP_CV_HANDLER,
36670   	ZEND_MUL_SPEC_VAR_CONST_HANDLER,
36671   	ZEND_MUL_SPEC_VAR_TMP_HANDLER,
36672   	ZEND_MUL_SPEC_VAR_VAR_HANDLER,
36673   	ZEND_NULL_HANDLER,
36674   	ZEND_MUL_SPEC_VAR_CV_HANDLER,
36675   	ZEND_NULL_HANDLER,
36676   	ZEND_NULL_HANDLER,
36677   	ZEND_NULL_HANDLER,
36678   	ZEND_NULL_HANDLER,
36679   	ZEND_NULL_HANDLER,
36680   	ZEND_MUL_SPEC_CV_CONST_HANDLER,
36681   	ZEND_MUL_SPEC_CV_TMP_HANDLER,
36682   	ZEND_MUL_SPEC_CV_VAR_HANDLER,
36683   	ZEND_NULL_HANDLER,
36684   	ZEND_MUL_SPEC_CV_CV_HANDLER,
36685   	ZEND_DIV_SPEC_CONST_CONST_HANDLER,
36686   	ZEND_DIV_SPEC_CONST_TMP_HANDLER,
36687   	ZEND_DIV_SPEC_CONST_VAR_HANDLER,
36688   	ZEND_NULL_HANDLER,
36689   	ZEND_DIV_SPEC_CONST_CV_HANDLER,
36690   	ZEND_DIV_SPEC_TMP_CONST_HANDLER,
36691   	ZEND_DIV_SPEC_TMP_TMP_HANDLER,
36692   	ZEND_DIV_SPEC_TMP_VAR_HANDLER,
36693   	ZEND_NULL_HANDLER,
36694   	ZEND_DIV_SPEC_TMP_CV_HANDLER,
36695   	ZEND_DIV_SPEC_VAR_CONST_HANDLER,
36696   	ZEND_DIV_SPEC_VAR_TMP_HANDLER,
36697   	ZEND_DIV_SPEC_VAR_VAR_HANDLER,
36698   	ZEND_NULL_HANDLER,
36699   	ZEND_DIV_SPEC_VAR_CV_HANDLER,
36700   	ZEND_NULL_HANDLER,
36701   	ZEND_NULL_HANDLER,
36702   	ZEND_NULL_HANDLER,
36703   	ZEND_NULL_HANDLER,
36704   	ZEND_NULL_HANDLER,
36705   	ZEND_DIV_SPEC_CV_CONST_HANDLER,
36706   	ZEND_DIV_SPEC_CV_TMP_HANDLER,
36707   	ZEND_DIV_SPEC_CV_VAR_HANDLER,
36708   	ZEND_NULL_HANDLER,
36709   	ZEND_DIV_SPEC_CV_CV_HANDLER,
36710   	ZEND_MOD_SPEC_CONST_CONST_HANDLER,
36711   	ZEND_MOD_SPEC_CONST_TMP_HANDLER,
36712   	ZEND_MOD_SPEC_CONST_VAR_HANDLER,
36713   	ZEND_NULL_HANDLER,
36714   	ZEND_MOD_SPEC_CONST_CV_HANDLER,
36715   	ZEND_MOD_SPEC_TMP_CONST_HANDLER,
36716   	ZEND_MOD_SPEC_TMP_TMP_HANDLER,
36717   	ZEND_MOD_SPEC_TMP_VAR_HANDLER,
36718   	ZEND_NULL_HANDLER,
36719   	ZEND_MOD_SPEC_TMP_CV_HANDLER,
36720   	ZEND_MOD_SPEC_VAR_CONST_HANDLER,
36721   	ZEND_MOD_SPEC_VAR_TMP_HANDLER,
36722   	ZEND_MOD_SPEC_VAR_VAR_HANDLER,
36723   	ZEND_NULL_HANDLER,
36724   	ZEND_MOD_SPEC_VAR_CV_HANDLER,
36725   	ZEND_NULL_HANDLER,
36726   	ZEND_NULL_HANDLER,
36727   	ZEND_NULL_HANDLER,
36728   	ZEND_NULL_HANDLER,
36729   	ZEND_NULL_HANDLER,
36730   	ZEND_MOD_SPEC_CV_CONST_HANDLER,
36731   	ZEND_MOD_SPEC_CV_TMP_HANDLER,
36732   	ZEND_MOD_SPEC_CV_VAR_HANDLER,
36733   	ZEND_NULL_HANDLER,
36734   	ZEND_MOD_SPEC_CV_CV_HANDLER,
36735   	ZEND_SL_SPEC_CONST_CONST_HANDLER,
36736   	ZEND_SL_SPEC_CONST_TMP_HANDLER,
36737   	ZEND_SL_SPEC_CONST_VAR_HANDLER,
36738   	ZEND_NULL_HANDLER,
36739   	ZEND_SL_SPEC_CONST_CV_HANDLER,
36740   	ZEND_SL_SPEC_TMP_CONST_HANDLER,
36741   	ZEND_SL_SPEC_TMP_TMP_HANDLER,
36742   	ZEND_SL_SPEC_TMP_VAR_HANDLER,
36743   	ZEND_NULL_HANDLER,
36744   	ZEND_SL_SPEC_TMP_CV_HANDLER,
36745   	ZEND_SL_SPEC_VAR_CONST_HANDLER,
36746   	ZEND_SL_SPEC_VAR_TMP_HANDLER,
36747   	ZEND_SL_SPEC_VAR_VAR_HANDLER,
36748   	ZEND_NULL_HANDLER,
36749   	ZEND_SL_SPEC_VAR_CV_HANDLER,
36750   	ZEND_NULL_HANDLER,
36751   	ZEND_NULL_HANDLER,
36752   	ZEND_NULL_HANDLER,
36753   	ZEND_NULL_HANDLER,
36754   	ZEND_NULL_HANDLER,
36755   	ZEND_SL_SPEC_CV_CONST_HANDLER,
36756   	ZEND_SL_SPEC_CV_TMP_HANDLER,
36757   	ZEND_SL_SPEC_CV_VAR_HANDLER,
36758   	ZEND_NULL_HANDLER,
36759   	ZEND_SL_SPEC_CV_CV_HANDLER,
36760   	ZEND_SR_SPEC_CONST_CONST_HANDLER,
36761   	ZEND_SR_SPEC_CONST_TMP_HANDLER,
36762   	ZEND_SR_SPEC_CONST_VAR_HANDLER,
36763   	ZEND_NULL_HANDLER,
36764   	ZEND_SR_SPEC_CONST_CV_HANDLER,
36765   	ZEND_SR_SPEC_TMP_CONST_HANDLER,
36766   	ZEND_SR_SPEC_TMP_TMP_HANDLER,
36767   	ZEND_SR_SPEC_TMP_VAR_HANDLER,
36768   	ZEND_NULL_HANDLER,
36769   	ZEND_SR_SPEC_TMP_CV_HANDLER,
36770   	ZEND_SR_SPEC_VAR_CONST_HANDLER,
36771   	ZEND_SR_SPEC_VAR_TMP_HANDLER,
36772   	ZEND_SR_SPEC_VAR_VAR_HANDLER,
36773   	ZEND_NULL_HANDLER,
36774   	ZEND_SR_SPEC_VAR_CV_HANDLER,
36775   	ZEND_NULL_HANDLER,
36776   	ZEND_NULL_HANDLER,
36777   	ZEND_NULL_HANDLER,
36778   	ZEND_NULL_HANDLER,
36779   	ZEND_NULL_HANDLER,
36780   	ZEND_SR_SPEC_CV_CONST_HANDLER,
36781   	ZEND_SR_SPEC_CV_TMP_HANDLER,
36782   	ZEND_SR_SPEC_CV_VAR_HANDLER,
36783   	ZEND_NULL_HANDLER,
36784   	ZEND_SR_SPEC_CV_CV_HANDLER,
36785   	ZEND_CONCAT_SPEC_CONST_CONST_HANDLER,
36786   	ZEND_CONCAT_SPEC_CONST_TMP_HANDLER,
36787   	ZEND_CONCAT_SPEC_CONST_VAR_HANDLER,
36788   	ZEND_NULL_HANDLER,
36789   	ZEND_CONCAT_SPEC_CONST_CV_HANDLER,
36790   	ZEND_CONCAT_SPEC_TMP_CONST_HANDLER,
36791   	ZEND_CONCAT_SPEC_TMP_TMP_HANDLER,
36792   	ZEND_CONCAT_SPEC_TMP_VAR_HANDLER,
36793   	ZEND_NULL_HANDLER,
36794   	ZEND_CONCAT_SPEC_TMP_CV_HANDLER,
36795   	ZEND_CONCAT_SPEC_VAR_CONST_HANDLER,
36796   	ZEND_CONCAT_SPEC_VAR_TMP_HANDLER,
36797   	ZEND_CONCAT_SPEC_VAR_VAR_HANDLER,
36798   	ZEND_NULL_HANDLER,
36799   	ZEND_CONCAT_SPEC_VAR_CV_HANDLER,
36800   	ZEND_NULL_HANDLER,
36801   	ZEND_NULL_HANDLER,
36802   	ZEND_NULL_HANDLER,
36803   	ZEND_NULL_HANDLER,
36804   	ZEND_NULL_HANDLER,
36805   	ZEND_CONCAT_SPEC_CV_CONST_HANDLER,
36806   	ZEND_CONCAT_SPEC_CV_TMP_HANDLER,
36807   	ZEND_CONCAT_SPEC_CV_VAR_HANDLER,
36808   	ZEND_NULL_HANDLER,
36809   	ZEND_CONCAT_SPEC_CV_CV_HANDLER,
36810   	ZEND_BW_OR_SPEC_CONST_CONST_HANDLER,
36811   	ZEND_BW_OR_SPEC_CONST_TMP_HANDLER,
36812   	ZEND_BW_OR_SPEC_CONST_VAR_HANDLER,
36813   	ZEND_NULL_HANDLER,
36814   	ZEND_BW_OR_SPEC_CONST_CV_HANDLER,
36815   	ZEND_BW_OR_SPEC_TMP_CONST_HANDLER,
36816   	ZEND_BW_OR_SPEC_TMP_TMP_HANDLER,
36817   	ZEND_BW_OR_SPEC_TMP_VAR_HANDLER,
36818   	ZEND_NULL_HANDLER,
36819   	ZEND_BW_OR_SPEC_TMP_CV_HANDLER,
36820   	ZEND_BW_OR_SPEC_VAR_CONST_HANDLER,
36821   	ZEND_BW_OR_SPEC_VAR_TMP_HANDLER,
36822   	ZEND_BW_OR_SPEC_VAR_VAR_HANDLER,
36823   	ZEND_NULL_HANDLER,
36824   	ZEND_BW_OR_SPEC_VAR_CV_HANDLER,
36825   	ZEND_NULL_HANDLER,
36826   	ZEND_NULL_HANDLER,
36827   	ZEND_NULL_HANDLER,
36828   	ZEND_NULL_HANDLER,
36829   	ZEND_NULL_HANDLER,
36830   	ZEND_BW_OR_SPEC_CV_CONST_HANDLER,
36831   	ZEND_BW_OR_SPEC_CV_TMP_HANDLER,
36832   	ZEND_BW_OR_SPEC_CV_VAR_HANDLER,
36833   	ZEND_NULL_HANDLER,
36834   	ZEND_BW_OR_SPEC_CV_CV_HANDLER,
36835   	ZEND_BW_AND_SPEC_CONST_CONST_HANDLER,
36836   	ZEND_BW_AND_SPEC_CONST_TMP_HANDLER,
36837   	ZEND_BW_AND_SPEC_CONST_VAR_HANDLER,
36838   	ZEND_NULL_HANDLER,
36839   	ZEND_BW_AND_SPEC_CONST_CV_HANDLER,
36840   	ZEND_BW_AND_SPEC_TMP_CONST_HANDLER,
36841   	ZEND_BW_AND_SPEC_TMP_TMP_HANDLER,
36842   	ZEND_BW_AND_SPEC_TMP_VAR_HANDLER,
36843   	ZEND_NULL_HANDLER,
36844   	ZEND_BW_AND_SPEC_TMP_CV_HANDLER,
36845   	ZEND_BW_AND_SPEC_VAR_CONST_HANDLER,
36846   	ZEND_BW_AND_SPEC_VAR_TMP_HANDLER,
36847   	ZEND_BW_AND_SPEC_VAR_VAR_HANDLER,
36848   	ZEND_NULL_HANDLER,
36849   	ZEND_BW_AND_SPEC_VAR_CV_HANDLER,
36850   	ZEND_NULL_HANDLER,
36851   	ZEND_NULL_HANDLER,
36852   	ZEND_NULL_HANDLER,
36853   	ZEND_NULL_HANDLER,
36854   	ZEND_NULL_HANDLER,
36855   	ZEND_BW_AND_SPEC_CV_CONST_HANDLER,
36856   	ZEND_BW_AND_SPEC_CV_TMP_HANDLER,
36857   	ZEND_BW_AND_SPEC_CV_VAR_HANDLER,
36858   	ZEND_NULL_HANDLER,
36859   	ZEND_BW_AND_SPEC_CV_CV_HANDLER,
36860   	ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER,
36861   	ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER,
36862   	ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER,
36863   	ZEND_NULL_HANDLER,
36864   	ZEND_BW_XOR_SPEC_CONST_CV_HANDLER,
36865   	ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER,
36866   	ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER,
36867   	ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER,
36868   	ZEND_NULL_HANDLER,
36869   	ZEND_BW_XOR_SPEC_TMP_CV_HANDLER,
36870   	ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER,
36871   	ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER,
36872   	ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER,
36873   	ZEND_NULL_HANDLER,
36874   	ZEND_BW_XOR_SPEC_VAR_CV_HANDLER,
36875   	ZEND_NULL_HANDLER,
36876   	ZEND_NULL_HANDLER,
36877   	ZEND_NULL_HANDLER,
36878   	ZEND_NULL_HANDLER,
36879   	ZEND_NULL_HANDLER,
36880   	ZEND_BW_XOR_SPEC_CV_CONST_HANDLER,
36881   	ZEND_BW_XOR_SPEC_CV_TMP_HANDLER,
36882   	ZEND_BW_XOR_SPEC_CV_VAR_HANDLER,
36883   	ZEND_NULL_HANDLER,
36884   	ZEND_BW_XOR_SPEC_CV_CV_HANDLER,
36885   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
36886   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
36887   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
36888   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
36889   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
36890   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
36891   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
36892   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
36893   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
36894   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
36895   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
36896   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
36897   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
36898   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
36899   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
36900   	ZEND_NULL_HANDLER,
36901   	ZEND_NULL_HANDLER,
36902   	ZEND_NULL_HANDLER,
36903   	ZEND_NULL_HANDLER,
36904   	ZEND_NULL_HANDLER,
36905   	ZEND_BW_NOT_SPEC_CV_HANDLER,
36906   	ZEND_BW_NOT_SPEC_CV_HANDLER,
36907   	ZEND_BW_NOT_SPEC_CV_HANDLER,
36908   	ZEND_BW_NOT_SPEC_CV_HANDLER,
36909   	ZEND_BW_NOT_SPEC_CV_HANDLER,
36910   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
36911   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
36912   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
36913   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
36914   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
36915   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
36916   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
36917   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
36918   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
36919   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
36920   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
36921   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
36922   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
36923   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
36924   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
36925   	ZEND_NULL_HANDLER,
36926   	ZEND_NULL_HANDLER,
36927   	ZEND_NULL_HANDLER,
36928   	ZEND_NULL_HANDLER,
36929   	ZEND_NULL_HANDLER,
36930   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
36931   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
36932   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
36933   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
36934   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
36935   	ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER,
36936   	ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER,
36937   	ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER,
36938   	ZEND_NULL_HANDLER,
36939   	ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER,
36940   	ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER,
36941   	ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER,
36942   	ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER,
36943   	ZEND_NULL_HANDLER,
36944   	ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER,
36945   	ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER,
36946   	ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER,
36947   	ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER,
36948   	ZEND_NULL_HANDLER,
36949   	ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER,
36950   	ZEND_NULL_HANDLER,
36951   	ZEND_NULL_HANDLER,
36952   	ZEND_NULL_HANDLER,
36953   	ZEND_NULL_HANDLER,
36954   	ZEND_NULL_HANDLER,
36955   	ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER,
36956   	ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER,
36957   	ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER,
36958   	ZEND_NULL_HANDLER,
36959   	ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER,
36960   	ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER,
36961   	ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER,
36962   	ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER,
36963   	ZEND_NULL_HANDLER,
36964   	ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER,
36965   	ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER,
36966   	ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER,
36967   	ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER,
36968   	ZEND_NULL_HANDLER,
36969   	ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER,
36970   	ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER,
36971   	ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER,
36972   	ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER,
36973   	ZEND_NULL_HANDLER,
36974   	ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER,
36975   	ZEND_NULL_HANDLER,
36976   	ZEND_NULL_HANDLER,
36977   	ZEND_NULL_HANDLER,
36978   	ZEND_NULL_HANDLER,
36979   	ZEND_NULL_HANDLER,
36980   	ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER,
36981   	ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER,
36982   	ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER,
36983   	ZEND_NULL_HANDLER,
36984   	ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER,
36985   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER,
36986   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER,
36987   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER,
36988   	ZEND_NULL_HANDLER,
36989   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER,
36990   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER,
36991   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER,
36992   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER,
36993   	ZEND_NULL_HANDLER,
36994   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER,
36995   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER,
36996   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER,
36997   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER,
36998   	ZEND_NULL_HANDLER,
36999   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER,
37000   	ZEND_NULL_HANDLER,
37001   	ZEND_NULL_HANDLER,
37002   	ZEND_NULL_HANDLER,
37003   	ZEND_NULL_HANDLER,
37004   	ZEND_NULL_HANDLER,
37005   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER,
37006   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER,
37007   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER,
37008   	ZEND_NULL_HANDLER,
37009   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER,
37010   	ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER,
37011   	ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER,
37012   	ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER,
37013   	ZEND_NULL_HANDLER,
37014   	ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER,
37015   	ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER,
37016   	ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER,
37017   	ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER,
37018   	ZEND_NULL_HANDLER,
37019   	ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER,
37020   	ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER,
37021   	ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER,
37022   	ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER,
37023   	ZEND_NULL_HANDLER,
37024   	ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER,
37025   	ZEND_NULL_HANDLER,
37026   	ZEND_NULL_HANDLER,
37027   	ZEND_NULL_HANDLER,
37028   	ZEND_NULL_HANDLER,
37029   	ZEND_NULL_HANDLER,
37030   	ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER,
37031   	ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER,
37032   	ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER,
37033   	ZEND_NULL_HANDLER,
37034   	ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER,
37035   	ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER,
37036   	ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER,
37037   	ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER,
37038   	ZEND_NULL_HANDLER,
37039   	ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER,
37040   	ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER,
37041   	ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER,
37042   	ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER,
37043   	ZEND_NULL_HANDLER,
37044   	ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER,
37045   	ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER,
37046   	ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER,
37047   	ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER,
37048   	ZEND_NULL_HANDLER,
37049   	ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER,
37050   	ZEND_NULL_HANDLER,
37051   	ZEND_NULL_HANDLER,
37052   	ZEND_NULL_HANDLER,
37053   	ZEND_NULL_HANDLER,
37054   	ZEND_NULL_HANDLER,
37055   	ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER,
37056   	ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER,
37057   	ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER,
37058   	ZEND_NULL_HANDLER,
37059   	ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER,
37060   	ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER,
37061   	ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER,
37062   	ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER,
37063   	ZEND_NULL_HANDLER,
37064   	ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER,
37065   	ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER,
37066   	ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER,
37067   	ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER,
37068   	ZEND_NULL_HANDLER,
37069   	ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER,
37070   	ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER,
37071   	ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER,
37072   	ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER,
37073   	ZEND_NULL_HANDLER,
37074   	ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER,
37075   	ZEND_NULL_HANDLER,
37076   	ZEND_NULL_HANDLER,
37077   	ZEND_NULL_HANDLER,
37078   	ZEND_NULL_HANDLER,
37079   	ZEND_NULL_HANDLER,
37080   	ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER,
37081   	ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER,
37082   	ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER,
37083   	ZEND_NULL_HANDLER,
37084   	ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER,
37085   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER,
37086   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER,
37087   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER,
37088   	ZEND_NULL_HANDLER,
37089   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER,
37090   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER,
37091   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER,
37092   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER,
37093   	ZEND_NULL_HANDLER,
37094   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER,
37095   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER,
37096   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER,
37097   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER,
37098   	ZEND_NULL_HANDLER,
37099   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER,
37100   	ZEND_NULL_HANDLER,
37101   	ZEND_NULL_HANDLER,
37102   	ZEND_NULL_HANDLER,
37103   	ZEND_NULL_HANDLER,
37104   	ZEND_NULL_HANDLER,
37105   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER,
37106   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER,
37107   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER,
37108   	ZEND_NULL_HANDLER,
37109   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER,
37110   	ZEND_CAST_SPEC_CONST_HANDLER,
37111   	ZEND_CAST_SPEC_CONST_HANDLER,
37112   	ZEND_CAST_SPEC_CONST_HANDLER,
37113   	ZEND_CAST_SPEC_CONST_HANDLER,
37114   	ZEND_CAST_SPEC_CONST_HANDLER,
37115   	ZEND_CAST_SPEC_TMP_HANDLER,
37116   	ZEND_CAST_SPEC_TMP_HANDLER,
37117   	ZEND_CAST_SPEC_TMP_HANDLER,
37118   	ZEND_CAST_SPEC_TMP_HANDLER,
37119   	ZEND_CAST_SPEC_TMP_HANDLER,
37120   	ZEND_CAST_SPEC_VAR_HANDLER,
37121   	ZEND_CAST_SPEC_VAR_HANDLER,
37122   	ZEND_CAST_SPEC_VAR_HANDLER,
37123   	ZEND_CAST_SPEC_VAR_HANDLER,
37124   	ZEND_CAST_SPEC_VAR_HANDLER,
37125   	ZEND_NULL_HANDLER,
37126   	ZEND_NULL_HANDLER,
37127   	ZEND_NULL_HANDLER,
37128   	ZEND_NULL_HANDLER,
37129   	ZEND_NULL_HANDLER,
37130   	ZEND_CAST_SPEC_CV_HANDLER,
37131   	ZEND_CAST_SPEC_CV_HANDLER,
37132   	ZEND_CAST_SPEC_CV_HANDLER,
37133   	ZEND_CAST_SPEC_CV_HANDLER,
37134   	ZEND_CAST_SPEC_CV_HANDLER,
37135   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
37136   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
37137   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
37138   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
37139   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
37140   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
37141   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
37142   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
37143   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
37144   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
37145   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
37146   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
37147   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
37148   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
37149   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
37150   	ZEND_NULL_HANDLER,
37151   	ZEND_NULL_HANDLER,
37152   	ZEND_NULL_HANDLER,
37153   	ZEND_NULL_HANDLER,
37154   	ZEND_NULL_HANDLER,
37155   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
37156   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
37157   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
37158   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
37159   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
37160   	ZEND_NULL_HANDLER,
37161   	ZEND_NULL_HANDLER,
37162   	ZEND_NULL_HANDLER,
37163   	ZEND_NULL_HANDLER,
37164   	ZEND_NULL_HANDLER,
37165   	ZEND_NULL_HANDLER,
37166   	ZEND_NULL_HANDLER,
37167   	ZEND_NULL_HANDLER,
37168   	ZEND_NULL_HANDLER,
37169   	ZEND_NULL_HANDLER,
37170   	ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER,
37171   	ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER,
37172   	ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER,
37173   	ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER,
37174   	ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER,
37175   	ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER,
37176   	ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER,
37177   	ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER,
37178   	ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER,
37179   	ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER,
37180   	ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER,
37181   	ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER,
37182   	ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER,
37183   	ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER,
37184   	ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER,
37185   	ZEND_NULL_HANDLER,
37186   	ZEND_NULL_HANDLER,
37187   	ZEND_NULL_HANDLER,
37188   	ZEND_NULL_HANDLER,
37189   	ZEND_NULL_HANDLER,
37190   	ZEND_NULL_HANDLER,
37191   	ZEND_NULL_HANDLER,
37192   	ZEND_NULL_HANDLER,
37193   	ZEND_NULL_HANDLER,
37194   	ZEND_NULL_HANDLER,
37195   	ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER,
37196   	ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER,
37197   	ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER,
37198   	ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER,
37199   	ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER,
37200   	ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER,
37201   	ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER,
37202   	ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER,
37203   	ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER,
37204   	ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER,
37205   	ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER,
37206   	ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER,
37207   	ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER,
37208   	ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER,
37209   	ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER,
37210   	ZEND_NULL_HANDLER,
37211   	ZEND_NULL_HANDLER,
37212   	ZEND_NULL_HANDLER,
37213   	ZEND_NULL_HANDLER,
37214   	ZEND_NULL_HANDLER,
37215   	ZEND_NULL_HANDLER,
37216   	ZEND_NULL_HANDLER,
37217   	ZEND_NULL_HANDLER,
37218   	ZEND_NULL_HANDLER,
37219   	ZEND_NULL_HANDLER,
37220   	ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER,
37221   	ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER,
37222   	ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER,
37223   	ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER,
37224   	ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER,
37225   	ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER,
37226   	ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER,
37227   	ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER,
37228   	ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER,
37229   	ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER,
37230   	ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER,
37231   	ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER,
37232   	ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER,
37233   	ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER,
37234   	ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER,
37235   	ZEND_NULL_HANDLER,
37236   	ZEND_NULL_HANDLER,
37237   	ZEND_NULL_HANDLER,
37238   	ZEND_NULL_HANDLER,
37239   	ZEND_NULL_HANDLER,
37240   	ZEND_NULL_HANDLER,
37241   	ZEND_NULL_HANDLER,
37242   	ZEND_NULL_HANDLER,
37243   	ZEND_NULL_HANDLER,
37244   	ZEND_NULL_HANDLER,
37245   	ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER,
37246   	ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER,
37247   	ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER,
37248   	ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER,
37249   	ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER,
37250   	ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER,
37251   	ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER,
37252   	ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER,
37253   	ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER,
37254   	ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER,
37255   	ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER,
37256   	ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER,
37257   	ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER,
37258   	ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER,
37259   	ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER,
37260   	ZEND_NULL_HANDLER,
37261   	ZEND_NULL_HANDLER,
37262   	ZEND_NULL_HANDLER,
37263   	ZEND_NULL_HANDLER,
37264   	ZEND_NULL_HANDLER,
37265   	ZEND_NULL_HANDLER,
37266   	ZEND_NULL_HANDLER,
37267   	ZEND_NULL_HANDLER,
37268   	ZEND_NULL_HANDLER,
37269   	ZEND_NULL_HANDLER,
37270   	ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER,
37271   	ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER,
37272   	ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER,
37273   	ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER,
37274   	ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER,
37275   	ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER,
37276   	ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER,
37277   	ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER,
37278   	ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER,
37279   	ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER,
37280   	ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER,
37281   	ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER,
37282   	ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER,
37283   	ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER,
37284   	ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER,
37285   	ZEND_NULL_HANDLER,
37286   	ZEND_NULL_HANDLER,
37287   	ZEND_NULL_HANDLER,
37288   	ZEND_NULL_HANDLER,
37289   	ZEND_NULL_HANDLER,
37290   	ZEND_NULL_HANDLER,
37291   	ZEND_NULL_HANDLER,
37292   	ZEND_NULL_HANDLER,
37293   	ZEND_NULL_HANDLER,
37294   	ZEND_NULL_HANDLER,
37295   	ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER,
37296   	ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER,
37297   	ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER,
37298   	ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER,
37299   	ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER,
37300   	ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER,
37301   	ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER,
37302   	ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER,
37303   	ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER,
37304   	ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER,
37305   	ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER,
37306   	ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER,
37307   	ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER,
37308   	ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER,
37309   	ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER,
37310   	ZEND_NULL_HANDLER,
37311   	ZEND_NULL_HANDLER,
37312   	ZEND_NULL_HANDLER,
37313   	ZEND_NULL_HANDLER,
37314   	ZEND_NULL_HANDLER,
37315   	ZEND_NULL_HANDLER,
37316   	ZEND_NULL_HANDLER,
37317   	ZEND_NULL_HANDLER,
37318   	ZEND_NULL_HANDLER,
37319   	ZEND_NULL_HANDLER,
37320   	ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER,
37321   	ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER,
37322   	ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER,
37323   	ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER,
37324   	ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER,
37325   	ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER,
37326   	ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER,
37327   	ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER,
37328   	ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER,
37329   	ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER,
37330   	ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER,
37331   	ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER,
37332   	ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER,
37333   	ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER,
37334   	ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER,
37335   	ZEND_NULL_HANDLER,
37336   	ZEND_NULL_HANDLER,
37337   	ZEND_NULL_HANDLER,
37338   	ZEND_NULL_HANDLER,
37339   	ZEND_NULL_HANDLER,
37340   	ZEND_NULL_HANDLER,
37341   	ZEND_NULL_HANDLER,
37342   	ZEND_NULL_HANDLER,
37343   	ZEND_NULL_HANDLER,
37344   	ZEND_NULL_HANDLER,
37345   	ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER,
37346   	ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER,
37347   	ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER,
37348   	ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER,
37349   	ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER,
37350   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER,
37351   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER,
37352   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER,
37353   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER,
37354   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER,
37355   	ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER,
37356   	ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER,
37357   	ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER,
37358   	ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER,
37359   	ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER,
37360   	ZEND_NULL_HANDLER,
37361   	ZEND_NULL_HANDLER,
37362   	ZEND_NULL_HANDLER,
37363   	ZEND_NULL_HANDLER,
37364   	ZEND_NULL_HANDLER,
37365   	ZEND_NULL_HANDLER,
37366   	ZEND_NULL_HANDLER,
37367   	ZEND_NULL_HANDLER,
37368   	ZEND_NULL_HANDLER,
37369   	ZEND_NULL_HANDLER,
37370   	ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER,
37371   	ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER,
37372   	ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER,
37373   	ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER,
37374   	ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER,
37375   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER,
37376   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER,
37377   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER,
37378   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER,
37379   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER,
37380   	ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER,
37381   	ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER,
37382   	ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER,
37383   	ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER,
37384   	ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER,
37385   	ZEND_NULL_HANDLER,
37386   	ZEND_NULL_HANDLER,
37387   	ZEND_NULL_HANDLER,
37388   	ZEND_NULL_HANDLER,
37389   	ZEND_NULL_HANDLER,
37390   	ZEND_NULL_HANDLER,
37391   	ZEND_NULL_HANDLER,
37392   	ZEND_NULL_HANDLER,
37393   	ZEND_NULL_HANDLER,
37394   	ZEND_NULL_HANDLER,
37395   	ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER,
37396   	ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER,
37397   	ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER,
37398   	ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER,
37399   	ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER,
37400   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER,
37401   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER,
37402   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER,
37403   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER,
37404   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER,
37405   	ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER,
37406   	ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER,
37407   	ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER,
37408   	ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER,
37409   	ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER,
37410   	ZEND_NULL_HANDLER,
37411   	ZEND_NULL_HANDLER,
37412   	ZEND_NULL_HANDLER,
37413   	ZEND_NULL_HANDLER,
37414   	ZEND_NULL_HANDLER,
37415   	ZEND_NULL_HANDLER,
37416   	ZEND_NULL_HANDLER,
37417   	ZEND_NULL_HANDLER,
37418   	ZEND_NULL_HANDLER,
37419   	ZEND_NULL_HANDLER,
37420   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER,
37421   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER,
37422   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER,
37423   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER,
37424   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER,
37425   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER,
37426   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER,
37427   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER,
37428   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER,
37429   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER,
37430   	ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER,
37431   	ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER,
37432   	ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER,
37433   	ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER,
37434   	ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER,
37435   	ZEND_NULL_HANDLER,
37436   	ZEND_NULL_HANDLER,
37437   	ZEND_NULL_HANDLER,
37438   	ZEND_NULL_HANDLER,
37439   	ZEND_NULL_HANDLER,
37440   	ZEND_NULL_HANDLER,
37441   	ZEND_NULL_HANDLER,
37442   	ZEND_NULL_HANDLER,
37443   	ZEND_NULL_HANDLER,
37444   	ZEND_NULL_HANDLER,
37445   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
37446   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
37447   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
37448   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
37449   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
37450   	ZEND_NULL_HANDLER,
37451   	ZEND_NULL_HANDLER,
37452   	ZEND_NULL_HANDLER,
37453   	ZEND_NULL_HANDLER,
37454   	ZEND_NULL_HANDLER,
37455   	ZEND_PRE_INC_SPEC_CV_HANDLER,
37456   	ZEND_PRE_INC_SPEC_CV_HANDLER,
37457   	ZEND_PRE_INC_SPEC_CV_HANDLER,
37458   	ZEND_PRE_INC_SPEC_CV_HANDLER,
37459   	ZEND_PRE_INC_SPEC_CV_HANDLER,
37460   	ZEND_NULL_HANDLER,
37461   	ZEND_NULL_HANDLER,
37462   	ZEND_NULL_HANDLER,
37463   	ZEND_NULL_HANDLER,
37464   	ZEND_NULL_HANDLER,
37465   	ZEND_NULL_HANDLER,
37466   	ZEND_NULL_HANDLER,
37467   	ZEND_NULL_HANDLER,
37468   	ZEND_NULL_HANDLER,
37469   	ZEND_NULL_HANDLER,
37470   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
37471   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
37472   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
37473   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
37474   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
37475   	ZEND_NULL_HANDLER,
37476   	ZEND_NULL_HANDLER,
37477   	ZEND_NULL_HANDLER,
37478   	ZEND_NULL_HANDLER,
37479   	ZEND_NULL_HANDLER,
37480   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
37481   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
37482   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
37483   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
37484   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
37485   	ZEND_NULL_HANDLER,
37486   	ZEND_NULL_HANDLER,
37487   	ZEND_NULL_HANDLER,
37488   	ZEND_NULL_HANDLER,
37489   	ZEND_NULL_HANDLER,
37490   	ZEND_NULL_HANDLER,
37491   	ZEND_NULL_HANDLER,
37492   	ZEND_NULL_HANDLER,
37493   	ZEND_NULL_HANDLER,
37494   	ZEND_NULL_HANDLER,
37495   	ZEND_POST_INC_SPEC_VAR_HANDLER,
37496   	ZEND_POST_INC_SPEC_VAR_HANDLER,
37497   	ZEND_POST_INC_SPEC_VAR_HANDLER,
37498   	ZEND_POST_INC_SPEC_VAR_HANDLER,
37499   	ZEND_POST_INC_SPEC_VAR_HANDLER,
37500   	ZEND_NULL_HANDLER,
37501   	ZEND_NULL_HANDLER,
37502   	ZEND_NULL_HANDLER,
37503   	ZEND_NULL_HANDLER,
37504   	ZEND_NULL_HANDLER,
37505   	ZEND_POST_INC_SPEC_CV_HANDLER,
37506   	ZEND_POST_INC_SPEC_CV_HANDLER,
37507   	ZEND_POST_INC_SPEC_CV_HANDLER,
37508   	ZEND_POST_INC_SPEC_CV_HANDLER,
37509   	ZEND_POST_INC_SPEC_CV_HANDLER,
37510   	ZEND_NULL_HANDLER,
37511   	ZEND_NULL_HANDLER,
37512   	ZEND_NULL_HANDLER,
37513   	ZEND_NULL_HANDLER,
37514   	ZEND_NULL_HANDLER,
37515   	ZEND_NULL_HANDLER,
37516   	ZEND_NULL_HANDLER,
37517   	ZEND_NULL_HANDLER,
37518   	ZEND_NULL_HANDLER,
37519   	ZEND_NULL_HANDLER,
37520   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
37521   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
37522   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
37523   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
37524   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
37525   	ZEND_NULL_HANDLER,
37526   	ZEND_NULL_HANDLER,
37527   	ZEND_NULL_HANDLER,
37528   	ZEND_NULL_HANDLER,
37529   	ZEND_NULL_HANDLER,
37530   	ZEND_POST_DEC_SPEC_CV_HANDLER,
37531   	ZEND_POST_DEC_SPEC_CV_HANDLER,
37532   	ZEND_POST_DEC_SPEC_CV_HANDLER,
37533   	ZEND_POST_DEC_SPEC_CV_HANDLER,
37534   	ZEND_POST_DEC_SPEC_CV_HANDLER,
37535   	ZEND_NULL_HANDLER,
37536   	ZEND_NULL_HANDLER,
37537   	ZEND_NULL_HANDLER,
37538   	ZEND_NULL_HANDLER,
37539   	ZEND_NULL_HANDLER,
37540   	ZEND_NULL_HANDLER,
37541   	ZEND_NULL_HANDLER,
37542   	ZEND_NULL_HANDLER,
37543   	ZEND_NULL_HANDLER,
37544   	ZEND_NULL_HANDLER,
37545   	ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER,
37546   	ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER,
37547   	ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER,
37548   	ZEND_NULL_HANDLER,
37549   	ZEND_ASSIGN_SPEC_VAR_CV_HANDLER,
37550   	ZEND_NULL_HANDLER,
37551   	ZEND_NULL_HANDLER,
37552   	ZEND_NULL_HANDLER,
37553   	ZEND_NULL_HANDLER,
37554   	ZEND_NULL_HANDLER,
37555   	ZEND_ASSIGN_SPEC_CV_CONST_HANDLER,
37556   	ZEND_ASSIGN_SPEC_CV_TMP_HANDLER,
37557   	ZEND_ASSIGN_SPEC_CV_VAR_HANDLER,
37558   	ZEND_NULL_HANDLER,
37559   	ZEND_ASSIGN_SPEC_CV_CV_HANDLER,
37560   	ZEND_NULL_HANDLER,
37561   	ZEND_NULL_HANDLER,
37562   	ZEND_NULL_HANDLER,
37563   	ZEND_NULL_HANDLER,
37564   	ZEND_NULL_HANDLER,
37565   	ZEND_NULL_HANDLER,
37566   	ZEND_NULL_HANDLER,
37567   	ZEND_NULL_HANDLER,
37568   	ZEND_NULL_HANDLER,
37569   	ZEND_NULL_HANDLER,
37570   	ZEND_NULL_HANDLER,
37571   	ZEND_NULL_HANDLER,
37572   	ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER,
37573   	ZEND_NULL_HANDLER,
37574   	ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER,
37575   	ZEND_NULL_HANDLER,
37576   	ZEND_NULL_HANDLER,
37577   	ZEND_NULL_HANDLER,
37578   	ZEND_NULL_HANDLER,
37579   	ZEND_NULL_HANDLER,
37580   	ZEND_NULL_HANDLER,
37581   	ZEND_NULL_HANDLER,
37582   	ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER,
37583   	ZEND_NULL_HANDLER,
37584   	ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER,
37585   	ZEND_ECHO_SPEC_CONST_HANDLER,
37586   	ZEND_ECHO_SPEC_CONST_HANDLER,
37587   	ZEND_ECHO_SPEC_CONST_HANDLER,
37588   	ZEND_ECHO_SPEC_CONST_HANDLER,
37589   	ZEND_ECHO_SPEC_CONST_HANDLER,
37590   	ZEND_ECHO_SPEC_TMP_HANDLER,
37591   	ZEND_ECHO_SPEC_TMP_HANDLER,
37592   	ZEND_ECHO_SPEC_TMP_HANDLER,
37593   	ZEND_ECHO_SPEC_TMP_HANDLER,
37594   	ZEND_ECHO_SPEC_TMP_HANDLER,
37595   	ZEND_ECHO_SPEC_VAR_HANDLER,
37596   	ZEND_ECHO_SPEC_VAR_HANDLER,
37597   	ZEND_ECHO_SPEC_VAR_HANDLER,
37598   	ZEND_ECHO_SPEC_VAR_HANDLER,
37599   	ZEND_ECHO_SPEC_VAR_HANDLER,
37600   	ZEND_NULL_HANDLER,
37601   	ZEND_NULL_HANDLER,
37602   	ZEND_NULL_HANDLER,
37603   	ZEND_NULL_HANDLER,
37604   	ZEND_NULL_HANDLER,
37605   	ZEND_ECHO_SPEC_CV_HANDLER,
37606   	ZEND_ECHO_SPEC_CV_HANDLER,
37607   	ZEND_ECHO_SPEC_CV_HANDLER,
37608   	ZEND_ECHO_SPEC_CV_HANDLER,
37609   	ZEND_ECHO_SPEC_CV_HANDLER,
37610   	ZEND_PRINT_SPEC_CONST_HANDLER,
37611   	ZEND_PRINT_SPEC_CONST_HANDLER,
37612   	ZEND_PRINT_SPEC_CONST_HANDLER,
37613   	ZEND_PRINT_SPEC_CONST_HANDLER,
37614   	ZEND_PRINT_SPEC_CONST_HANDLER,
37615   	ZEND_PRINT_SPEC_TMP_HANDLER,
37616   	ZEND_PRINT_SPEC_TMP_HANDLER,
37617   	ZEND_PRINT_SPEC_TMP_HANDLER,
37618   	ZEND_PRINT_SPEC_TMP_HANDLER,
37619   	ZEND_PRINT_SPEC_TMP_HANDLER,
37620   	ZEND_PRINT_SPEC_VAR_HANDLER,
37621   	ZEND_PRINT_SPEC_VAR_HANDLER,
37622   	ZEND_PRINT_SPEC_VAR_HANDLER,
37623   	ZEND_PRINT_SPEC_VAR_HANDLER,
37624   	ZEND_PRINT_SPEC_VAR_HANDLER,
37625   	ZEND_NULL_HANDLER,
37626   	ZEND_NULL_HANDLER,
37627   	ZEND_NULL_HANDLER,
37628   	ZEND_NULL_HANDLER,
37629   	ZEND_NULL_HANDLER,
37630   	ZEND_PRINT_SPEC_CV_HANDLER,
37631   	ZEND_PRINT_SPEC_CV_HANDLER,
37632   	ZEND_PRINT_SPEC_CV_HANDLER,
37633   	ZEND_PRINT_SPEC_CV_HANDLER,
37634   	ZEND_PRINT_SPEC_CV_HANDLER,
37635   	ZEND_JMP_SPEC_HANDLER,
37636   	ZEND_JMP_SPEC_HANDLER,
37637   	ZEND_JMP_SPEC_HANDLER,
37638   	ZEND_JMP_SPEC_HANDLER,
37639   	ZEND_JMP_SPEC_HANDLER,
37640   	ZEND_JMP_SPEC_HANDLER,
37641   	ZEND_JMP_SPEC_HANDLER,
37642   	ZEND_JMP_SPEC_HANDLER,
37643   	ZEND_JMP_SPEC_HANDLER,
37644   	ZEND_JMP_SPEC_HANDLER,
37645   	ZEND_JMP_SPEC_HANDLER,
37646   	ZEND_JMP_SPEC_HANDLER,
37647   	ZEND_JMP_SPEC_HANDLER,
37648   	ZEND_JMP_SPEC_HANDLER,
37649   	ZEND_JMP_SPEC_HANDLER,
37650   	ZEND_JMP_SPEC_HANDLER,
37651   	ZEND_JMP_SPEC_HANDLER,
37652   	ZEND_JMP_SPEC_HANDLER,
37653   	ZEND_JMP_SPEC_HANDLER,
37654   	ZEND_JMP_SPEC_HANDLER,
37655   	ZEND_JMP_SPEC_HANDLER,
37656   	ZEND_JMP_SPEC_HANDLER,
37657   	ZEND_JMP_SPEC_HANDLER,
37658   	ZEND_JMP_SPEC_HANDLER,
37659   	ZEND_JMP_SPEC_HANDLER,
37660   	ZEND_JMPZ_SPEC_CONST_HANDLER,
37661   	ZEND_JMPZ_SPEC_CONST_HANDLER,
37662   	ZEND_JMPZ_SPEC_CONST_HANDLER,
37663   	ZEND_JMPZ_SPEC_CONST_HANDLER,
37664   	ZEND_JMPZ_SPEC_CONST_HANDLER,
37665   	ZEND_JMPZ_SPEC_TMP_HANDLER,
37666   	ZEND_JMPZ_SPEC_TMP_HANDLER,
37667   	ZEND_JMPZ_SPEC_TMP_HANDLER,
37668   	ZEND_JMPZ_SPEC_TMP_HANDLER,
37669   	ZEND_JMPZ_SPEC_TMP_HANDLER,
37670   	ZEND_JMPZ_SPEC_VAR_HANDLER,
37671   	ZEND_JMPZ_SPEC_VAR_HANDLER,
37672   	ZEND_JMPZ_SPEC_VAR_HANDLER,
37673   	ZEND_JMPZ_SPEC_VAR_HANDLER,
37674   	ZEND_JMPZ_SPEC_VAR_HANDLER,
37675   	ZEND_NULL_HANDLER,
37676   	ZEND_NULL_HANDLER,
37677   	ZEND_NULL_HANDLER,
37678   	ZEND_NULL_HANDLER,
37679   	ZEND_NULL_HANDLER,
37680   	ZEND_JMPZ_SPEC_CV_HANDLER,
37681   	ZEND_JMPZ_SPEC_CV_HANDLER,
37682   	ZEND_JMPZ_SPEC_CV_HANDLER,
37683   	ZEND_JMPZ_SPEC_CV_HANDLER,
37684   	ZEND_JMPZ_SPEC_CV_HANDLER,
37685   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
37686   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
37687   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
37688   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
37689   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
37690   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
37691   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
37692   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
37693   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
37694   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
37695   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
37696   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
37697   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
37698   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
37699   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
37700   	ZEND_NULL_HANDLER,
37701   	ZEND_NULL_HANDLER,
37702   	ZEND_NULL_HANDLER,
37703   	ZEND_NULL_HANDLER,
37704   	ZEND_NULL_HANDLER,
37705   	ZEND_JMPNZ_SPEC_CV_HANDLER,
37706   	ZEND_JMPNZ_SPEC_CV_HANDLER,
37707   	ZEND_JMPNZ_SPEC_CV_HANDLER,
37708   	ZEND_JMPNZ_SPEC_CV_HANDLER,
37709   	ZEND_JMPNZ_SPEC_CV_HANDLER,
37710   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
37711   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
37712   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
37713   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
37714   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
37715   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
37716   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
37717   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
37718   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
37719   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
37720   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
37721   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
37722   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
37723   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
37724   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
37725   	ZEND_NULL_HANDLER,
37726   	ZEND_NULL_HANDLER,
37727   	ZEND_NULL_HANDLER,
37728   	ZEND_NULL_HANDLER,
37729   	ZEND_NULL_HANDLER,
37730   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
37731   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
37732   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
37733   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
37734   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
37735   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
37736   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
37737   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
37738   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
37739   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
37740   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
37741   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
37742   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
37743   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
37744   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
37745   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
37746   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
37747   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
37748   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
37749   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
37750   	ZEND_NULL_HANDLER,
37751   	ZEND_NULL_HANDLER,
37752   	ZEND_NULL_HANDLER,
37753   	ZEND_NULL_HANDLER,
37754   	ZEND_NULL_HANDLER,
37755   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
37756   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
37757   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
37758   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
37759   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
37760   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
37761   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
37762   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
37763   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
37764   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
37765   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
37766   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
37767   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
37768   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
37769   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
37770   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
37771   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
37772   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
37773   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
37774   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
37775   	ZEND_NULL_HANDLER,
37776   	ZEND_NULL_HANDLER,
37777   	ZEND_NULL_HANDLER,
37778   	ZEND_NULL_HANDLER,
37779   	ZEND_NULL_HANDLER,
37780   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
37781   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
37782   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
37783   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
37784   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
37785   	ZEND_CASE_SPEC_CONST_CONST_HANDLER,
37786   	ZEND_CASE_SPEC_CONST_TMP_HANDLER,
37787   	ZEND_CASE_SPEC_CONST_VAR_HANDLER,
37788   	ZEND_NULL_HANDLER,
37789   	ZEND_CASE_SPEC_CONST_CV_HANDLER,
37790   	ZEND_CASE_SPEC_TMP_CONST_HANDLER,
37791   	ZEND_CASE_SPEC_TMP_TMP_HANDLER,
37792   	ZEND_CASE_SPEC_TMP_VAR_HANDLER,
37793   	ZEND_NULL_HANDLER,
37794   	ZEND_CASE_SPEC_TMP_CV_HANDLER,
37795   	ZEND_CASE_SPEC_VAR_CONST_HANDLER,
37796   	ZEND_CASE_SPEC_VAR_TMP_HANDLER,
37797   	ZEND_CASE_SPEC_VAR_VAR_HANDLER,
37798   	ZEND_NULL_HANDLER,
37799   	ZEND_CASE_SPEC_VAR_CV_HANDLER,
37800   	ZEND_NULL_HANDLER,
37801   	ZEND_NULL_HANDLER,
37802   	ZEND_NULL_HANDLER,
37803   	ZEND_NULL_HANDLER,
37804   	ZEND_NULL_HANDLER,
37805   	ZEND_CASE_SPEC_CV_CONST_HANDLER,
37806   	ZEND_CASE_SPEC_CV_TMP_HANDLER,
37807   	ZEND_CASE_SPEC_CV_VAR_HANDLER,
37808   	ZEND_NULL_HANDLER,
37809   	ZEND_CASE_SPEC_CV_CV_HANDLER,
37810   	ZEND_NULL_HANDLER,
37811   	ZEND_NULL_HANDLER,
37812   	ZEND_NULL_HANDLER,
37813   	ZEND_NULL_HANDLER,
37814   	ZEND_NULL_HANDLER,
37815   	ZEND_NULL_HANDLER,
37816   	ZEND_NULL_HANDLER,
37817   	ZEND_NULL_HANDLER,
37818   	ZEND_NULL_HANDLER,
37819   	ZEND_NULL_HANDLER,
37820   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
37821   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
37822   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
37823   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
37824   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
37825   	ZEND_NULL_HANDLER,
37826   	ZEND_NULL_HANDLER,
37827   	ZEND_NULL_HANDLER,
37828   	ZEND_NULL_HANDLER,
37829   	ZEND_NULL_HANDLER,
37830   	ZEND_NULL_HANDLER,
37831   	ZEND_NULL_HANDLER,
37832   	ZEND_NULL_HANDLER,
37833   	ZEND_NULL_HANDLER,
37834   	ZEND_NULL_HANDLER,
37835   	ZEND_BRK_SPEC_CONST_HANDLER,
37836   	ZEND_NULL_HANDLER,
37837   	ZEND_NULL_HANDLER,
37838   	ZEND_NULL_HANDLER,
37839   	ZEND_NULL_HANDLER,
37840   	ZEND_BRK_SPEC_CONST_HANDLER,
37841   	ZEND_NULL_HANDLER,
37842   	ZEND_NULL_HANDLER,
37843   	ZEND_NULL_HANDLER,
37844   	ZEND_NULL_HANDLER,
37845   	ZEND_BRK_SPEC_CONST_HANDLER,
37846   	ZEND_NULL_HANDLER,
37847   	ZEND_NULL_HANDLER,
37848   	ZEND_NULL_HANDLER,
37849   	ZEND_NULL_HANDLER,
37850   	ZEND_BRK_SPEC_CONST_HANDLER,
37851   	ZEND_NULL_HANDLER,
37852   	ZEND_NULL_HANDLER,
37853   	ZEND_NULL_HANDLER,
37854   	ZEND_NULL_HANDLER,
37855   	ZEND_BRK_SPEC_CONST_HANDLER,
37856   	ZEND_NULL_HANDLER,
37857   	ZEND_NULL_HANDLER,
37858   	ZEND_NULL_HANDLER,
37859   	ZEND_NULL_HANDLER,
37860   	ZEND_CONT_SPEC_CONST_HANDLER,
37861   	ZEND_NULL_HANDLER,
37862   	ZEND_NULL_HANDLER,
37863   	ZEND_NULL_HANDLER,
37864   	ZEND_NULL_HANDLER,
37865   	ZEND_CONT_SPEC_CONST_HANDLER,
37866   	ZEND_NULL_HANDLER,
37867   	ZEND_NULL_HANDLER,
37868   	ZEND_NULL_HANDLER,
37869   	ZEND_NULL_HANDLER,
37870   	ZEND_CONT_SPEC_CONST_HANDLER,
37871   	ZEND_NULL_HANDLER,
37872   	ZEND_NULL_HANDLER,
37873   	ZEND_NULL_HANDLER,
37874   	ZEND_NULL_HANDLER,
37875   	ZEND_CONT_SPEC_CONST_HANDLER,
37876   	ZEND_NULL_HANDLER,
37877   	ZEND_NULL_HANDLER,
37878   	ZEND_NULL_HANDLER,
37879   	ZEND_NULL_HANDLER,
37880   	ZEND_CONT_SPEC_CONST_HANDLER,
37881   	ZEND_NULL_HANDLER,
37882   	ZEND_NULL_HANDLER,
37883   	ZEND_NULL_HANDLER,
37884   	ZEND_NULL_HANDLER,
37885   	ZEND_BOOL_SPEC_CONST_HANDLER,
37886   	ZEND_BOOL_SPEC_CONST_HANDLER,
37887   	ZEND_BOOL_SPEC_CONST_HANDLER,
37888   	ZEND_BOOL_SPEC_CONST_HANDLER,
37889   	ZEND_BOOL_SPEC_CONST_HANDLER,
37890   	ZEND_BOOL_SPEC_TMP_HANDLER,
37891   	ZEND_BOOL_SPEC_TMP_HANDLER,
37892   	ZEND_BOOL_SPEC_TMP_HANDLER,
37893   	ZEND_BOOL_SPEC_TMP_HANDLER,
37894   	ZEND_BOOL_SPEC_TMP_HANDLER,
37895   	ZEND_BOOL_SPEC_VAR_HANDLER,
37896   	ZEND_BOOL_SPEC_VAR_HANDLER,
37897   	ZEND_BOOL_SPEC_VAR_HANDLER,
37898   	ZEND_BOOL_SPEC_VAR_HANDLER,
37899   	ZEND_BOOL_SPEC_VAR_HANDLER,
37900   	ZEND_NULL_HANDLER,
37901   	ZEND_NULL_HANDLER,
37902   	ZEND_NULL_HANDLER,
37903   	ZEND_NULL_HANDLER,
37904   	ZEND_NULL_HANDLER,
37905   	ZEND_BOOL_SPEC_CV_HANDLER,
37906   	ZEND_BOOL_SPEC_CV_HANDLER,
37907   	ZEND_BOOL_SPEC_CV_HANDLER,
37908   	ZEND_BOOL_SPEC_CV_HANDLER,
37909   	ZEND_BOOL_SPEC_CV_HANDLER,
37910   	ZEND_INIT_STRING_SPEC_HANDLER,
37911   	ZEND_INIT_STRING_SPEC_HANDLER,
37912   	ZEND_INIT_STRING_SPEC_HANDLER,
37913   	ZEND_INIT_STRING_SPEC_HANDLER,
37914   	ZEND_INIT_STRING_SPEC_HANDLER,
37915   	ZEND_INIT_STRING_SPEC_HANDLER,
37916   	ZEND_INIT_STRING_SPEC_HANDLER,
37917   	ZEND_INIT_STRING_SPEC_HANDLER,
37918   	ZEND_INIT_STRING_SPEC_HANDLER,
37919   	ZEND_INIT_STRING_SPEC_HANDLER,
37920   	ZEND_INIT_STRING_SPEC_HANDLER,
37921   	ZEND_INIT_STRING_SPEC_HANDLER,
37922   	ZEND_INIT_STRING_SPEC_HANDLER,
37923   	ZEND_INIT_STRING_SPEC_HANDLER,
37924   	ZEND_INIT_STRING_SPEC_HANDLER,
37925   	ZEND_INIT_STRING_SPEC_HANDLER,
37926   	ZEND_INIT_STRING_SPEC_HANDLER,
37927   	ZEND_INIT_STRING_SPEC_HANDLER,
37928   	ZEND_INIT_STRING_SPEC_HANDLER,
37929   	ZEND_INIT_STRING_SPEC_HANDLER,
37930   	ZEND_INIT_STRING_SPEC_HANDLER,
37931   	ZEND_INIT_STRING_SPEC_HANDLER,
37932   	ZEND_INIT_STRING_SPEC_HANDLER,
37933   	ZEND_INIT_STRING_SPEC_HANDLER,
37934   	ZEND_INIT_STRING_SPEC_HANDLER,
37935   	ZEND_NULL_HANDLER,
37936   	ZEND_NULL_HANDLER,
37937   	ZEND_NULL_HANDLER,
37938   	ZEND_NULL_HANDLER,
37939   	ZEND_NULL_HANDLER,
37940   	ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER,
37941   	ZEND_NULL_HANDLER,
37942   	ZEND_NULL_HANDLER,
37943   	ZEND_NULL_HANDLER,
37944   	ZEND_NULL_HANDLER,
37945   	ZEND_NULL_HANDLER,
37946   	ZEND_NULL_HANDLER,
37947   	ZEND_NULL_HANDLER,
37948   	ZEND_NULL_HANDLER,
37949   	ZEND_NULL_HANDLER,
37950   	ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER,
37951   	ZEND_NULL_HANDLER,
37952   	ZEND_NULL_HANDLER,
37953   	ZEND_NULL_HANDLER,
37954   	ZEND_NULL_HANDLER,
37955   	ZEND_NULL_HANDLER,
37956   	ZEND_NULL_HANDLER,
37957   	ZEND_NULL_HANDLER,
37958   	ZEND_NULL_HANDLER,
37959   	ZEND_NULL_HANDLER,
37960   	ZEND_NULL_HANDLER,
37961   	ZEND_NULL_HANDLER,
37962   	ZEND_NULL_HANDLER,
37963   	ZEND_NULL_HANDLER,
37964   	ZEND_NULL_HANDLER,
37965   	ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER,
37966   	ZEND_NULL_HANDLER,
37967   	ZEND_NULL_HANDLER,
37968   	ZEND_NULL_HANDLER,
37969   	ZEND_NULL_HANDLER,
37970   	ZEND_NULL_HANDLER,
37971   	ZEND_NULL_HANDLER,
37972   	ZEND_NULL_HANDLER,
37973   	ZEND_NULL_HANDLER,
37974   	ZEND_NULL_HANDLER,
37975   	ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER,
37976   	ZEND_NULL_HANDLER,
37977   	ZEND_NULL_HANDLER,
37978   	ZEND_NULL_HANDLER,
37979   	ZEND_NULL_HANDLER,
37980   	ZEND_NULL_HANDLER,
37981   	ZEND_NULL_HANDLER,
37982   	ZEND_NULL_HANDLER,
37983   	ZEND_NULL_HANDLER,
37984   	ZEND_NULL_HANDLER,
37985   	ZEND_NULL_HANDLER,
37986   	ZEND_NULL_HANDLER,
37987   	ZEND_NULL_HANDLER,
37988   	ZEND_NULL_HANDLER,
37989   	ZEND_NULL_HANDLER,
37990   	ZEND_NULL_HANDLER,
37991   	ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER,
37992   	ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER,
37993   	ZEND_NULL_HANDLER,
37994   	ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER,
37995   	ZEND_NULL_HANDLER,
37996   	ZEND_NULL_HANDLER,
37997   	ZEND_NULL_HANDLER,
37998   	ZEND_NULL_HANDLER,
37999   	ZEND_NULL_HANDLER,
38000   	ZEND_NULL_HANDLER,
38001   	ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER,
38002   	ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER,
38003   	ZEND_NULL_HANDLER,
38004   	ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER,
38005   	ZEND_NULL_HANDLER,
38006   	ZEND_NULL_HANDLER,
38007   	ZEND_NULL_HANDLER,
38008   	ZEND_NULL_HANDLER,
38009   	ZEND_NULL_HANDLER,
38010   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38011   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38012   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38013   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38014   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38015   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38016   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38017   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38018   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38019   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38020   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38021   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38022   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38023   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38024   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38025   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38026   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38027   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38028   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38029   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38030   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38031   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38032   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38033   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38034   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
38035   	ZEND_NULL_HANDLER,
38036   	ZEND_NULL_HANDLER,
38037   	ZEND_NULL_HANDLER,
38038   	ZEND_NULL_HANDLER,
38039   	ZEND_NULL_HANDLER,
38040   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
38041   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
38042   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
38043   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
38044   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
38045   	ZEND_NULL_HANDLER,
38046   	ZEND_NULL_HANDLER,
38047   	ZEND_NULL_HANDLER,
38048   	ZEND_NULL_HANDLER,
38049   	ZEND_NULL_HANDLER,
38050   	ZEND_NULL_HANDLER,
38051   	ZEND_NULL_HANDLER,
38052   	ZEND_NULL_HANDLER,
38053   	ZEND_NULL_HANDLER,
38054   	ZEND_NULL_HANDLER,
38055   	ZEND_NULL_HANDLER,
38056   	ZEND_NULL_HANDLER,
38057   	ZEND_NULL_HANDLER,
38058   	ZEND_NULL_HANDLER,
38059   	ZEND_NULL_HANDLER,
38060   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38061   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
38062   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
38063   	ZEND_NULL_HANDLER,
38064   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
38065   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38066   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
38067   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
38068   	ZEND_NULL_HANDLER,
38069   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
38070   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38071   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
38072   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
38073   	ZEND_NULL_HANDLER,
38074   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
38075   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38076   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
38077   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
38078   	ZEND_NULL_HANDLER,
38079   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
38080   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38081   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
38082   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
38083   	ZEND_NULL_HANDLER,
38084   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
38085   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
38086   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
38087   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
38088   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
38089   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
38090   	ZEND_NULL_HANDLER,
38091   	ZEND_NULL_HANDLER,
38092   	ZEND_NULL_HANDLER,
38093   	ZEND_NULL_HANDLER,
38094   	ZEND_NULL_HANDLER,
38095   	ZEND_NULL_HANDLER,
38096   	ZEND_NULL_HANDLER,
38097   	ZEND_NULL_HANDLER,
38098   	ZEND_NULL_HANDLER,
38099   	ZEND_NULL_HANDLER,
38100   	ZEND_NULL_HANDLER,
38101   	ZEND_NULL_HANDLER,
38102   	ZEND_NULL_HANDLER,
38103   	ZEND_NULL_HANDLER,
38104   	ZEND_NULL_HANDLER,
38105   	ZEND_NULL_HANDLER,
38106   	ZEND_NULL_HANDLER,
38107   	ZEND_NULL_HANDLER,
38108   	ZEND_NULL_HANDLER,
38109   	ZEND_NULL_HANDLER,
38110   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38111   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38112   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38113   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38114   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38115   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38116   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38117   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38118   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38119   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38120   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38121   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38122   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38123   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38124   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38125   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38126   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38127   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38128   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38129   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38130   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38131   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38132   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38133   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38134   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
38135   	ZEND_RETURN_SPEC_CONST_HANDLER,
38136   	ZEND_RETURN_SPEC_CONST_HANDLER,
38137   	ZEND_RETURN_SPEC_CONST_HANDLER,
38138   	ZEND_RETURN_SPEC_CONST_HANDLER,
38139   	ZEND_RETURN_SPEC_CONST_HANDLER,
38140   	ZEND_RETURN_SPEC_TMP_HANDLER,
38141   	ZEND_RETURN_SPEC_TMP_HANDLER,
38142   	ZEND_RETURN_SPEC_TMP_HANDLER,
38143   	ZEND_RETURN_SPEC_TMP_HANDLER,
38144   	ZEND_RETURN_SPEC_TMP_HANDLER,
38145   	ZEND_RETURN_SPEC_VAR_HANDLER,
38146   	ZEND_RETURN_SPEC_VAR_HANDLER,
38147   	ZEND_RETURN_SPEC_VAR_HANDLER,
38148   	ZEND_RETURN_SPEC_VAR_HANDLER,
38149   	ZEND_RETURN_SPEC_VAR_HANDLER,
38150   	ZEND_NULL_HANDLER,
38151   	ZEND_NULL_HANDLER,
38152   	ZEND_NULL_HANDLER,
38153   	ZEND_NULL_HANDLER,
38154   	ZEND_NULL_HANDLER,
38155   	ZEND_RETURN_SPEC_CV_HANDLER,
38156   	ZEND_RETURN_SPEC_CV_HANDLER,
38157   	ZEND_RETURN_SPEC_CV_HANDLER,
38158   	ZEND_RETURN_SPEC_CV_HANDLER,
38159   	ZEND_RETURN_SPEC_CV_HANDLER,
38160   	ZEND_RECV_SPEC_HANDLER,
38161   	ZEND_RECV_SPEC_HANDLER,
38162   	ZEND_RECV_SPEC_HANDLER,
38163   	ZEND_RECV_SPEC_HANDLER,
38164   	ZEND_RECV_SPEC_HANDLER,
38165   	ZEND_RECV_SPEC_HANDLER,
38166   	ZEND_RECV_SPEC_HANDLER,
38167   	ZEND_RECV_SPEC_HANDLER,
38168   	ZEND_RECV_SPEC_HANDLER,
38169   	ZEND_RECV_SPEC_HANDLER,
38170   	ZEND_RECV_SPEC_HANDLER,
38171   	ZEND_RECV_SPEC_HANDLER,
38172   	ZEND_RECV_SPEC_HANDLER,
38173   	ZEND_RECV_SPEC_HANDLER,
38174   	ZEND_RECV_SPEC_HANDLER,
38175   	ZEND_RECV_SPEC_HANDLER,
38176   	ZEND_RECV_SPEC_HANDLER,
38177   	ZEND_RECV_SPEC_HANDLER,
38178   	ZEND_RECV_SPEC_HANDLER,
38179   	ZEND_RECV_SPEC_HANDLER,
38180   	ZEND_RECV_SPEC_HANDLER,
38181   	ZEND_RECV_SPEC_HANDLER,
38182   	ZEND_RECV_SPEC_HANDLER,
38183   	ZEND_RECV_SPEC_HANDLER,
38184   	ZEND_RECV_SPEC_HANDLER,
38185   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
38186   	ZEND_NULL_HANDLER,
38187   	ZEND_NULL_HANDLER,
38188   	ZEND_NULL_HANDLER,
38189   	ZEND_NULL_HANDLER,
38190   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
38191   	ZEND_NULL_HANDLER,
38192   	ZEND_NULL_HANDLER,
38193   	ZEND_NULL_HANDLER,
38194   	ZEND_NULL_HANDLER,
38195   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
38196   	ZEND_NULL_HANDLER,
38197   	ZEND_NULL_HANDLER,
38198   	ZEND_NULL_HANDLER,
38199   	ZEND_NULL_HANDLER,
38200   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
38201   	ZEND_NULL_HANDLER,
38202   	ZEND_NULL_HANDLER,
38203   	ZEND_NULL_HANDLER,
38204   	ZEND_NULL_HANDLER,
38205   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
38206   	ZEND_NULL_HANDLER,
38207   	ZEND_NULL_HANDLER,
38208   	ZEND_NULL_HANDLER,
38209   	ZEND_NULL_HANDLER,
38210   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
38211   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
38212   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
38213   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
38214   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
38215   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
38216   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
38217   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
38218   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
38219   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
38220   	ZEND_NULL_HANDLER,
38221   	ZEND_NULL_HANDLER,
38222   	ZEND_NULL_HANDLER,
38223   	ZEND_NULL_HANDLER,
38224   	ZEND_NULL_HANDLER,
38225   	ZEND_NULL_HANDLER,
38226   	ZEND_NULL_HANDLER,
38227   	ZEND_NULL_HANDLER,
38228   	ZEND_NULL_HANDLER,
38229   	ZEND_NULL_HANDLER,
38230   	ZEND_NULL_HANDLER,
38231   	ZEND_NULL_HANDLER,
38232   	ZEND_NULL_HANDLER,
38233   	ZEND_NULL_HANDLER,
38234   	ZEND_NULL_HANDLER,
38235   	ZEND_NULL_HANDLER,
38236   	ZEND_NULL_HANDLER,
38237   	ZEND_NULL_HANDLER,
38238   	ZEND_NULL_HANDLER,
38239   	ZEND_NULL_HANDLER,
38240   	ZEND_NULL_HANDLER,
38241   	ZEND_NULL_HANDLER,
38242   	ZEND_NULL_HANDLER,
38243   	ZEND_NULL_HANDLER,
38244   	ZEND_NULL_HANDLER,
38245   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
38246   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
38247   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
38248   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
38249   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
38250   	ZEND_NULL_HANDLER,
38251   	ZEND_NULL_HANDLER,
38252   	ZEND_NULL_HANDLER,
38253   	ZEND_NULL_HANDLER,
38254   	ZEND_NULL_HANDLER,
38255   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
38256   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
38257   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
38258   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
38259   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
38260   	ZEND_NULL_HANDLER,
38261   	ZEND_NULL_HANDLER,
38262   	ZEND_NULL_HANDLER,
38263   	ZEND_NULL_HANDLER,
38264   	ZEND_NULL_HANDLER,
38265   	ZEND_NULL_HANDLER,
38266   	ZEND_NULL_HANDLER,
38267   	ZEND_NULL_HANDLER,
38268   	ZEND_NULL_HANDLER,
38269   	ZEND_NULL_HANDLER,
38270   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
38271   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
38272   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
38273   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
38274   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
38275   	ZEND_NULL_HANDLER,
38276   	ZEND_NULL_HANDLER,
38277   	ZEND_NULL_HANDLER,
38278   	ZEND_NULL_HANDLER,
38279   	ZEND_NULL_HANDLER,
38280   	ZEND_SEND_REF_SPEC_CV_HANDLER,
38281   	ZEND_SEND_REF_SPEC_CV_HANDLER,
38282   	ZEND_SEND_REF_SPEC_CV_HANDLER,
38283   	ZEND_SEND_REF_SPEC_CV_HANDLER,
38284   	ZEND_SEND_REF_SPEC_CV_HANDLER,
38285   	ZEND_NEW_SPEC_HANDLER,
38286   	ZEND_NEW_SPEC_HANDLER,
38287   	ZEND_NEW_SPEC_HANDLER,
38288   	ZEND_NEW_SPEC_HANDLER,
38289   	ZEND_NEW_SPEC_HANDLER,
38290   	ZEND_NEW_SPEC_HANDLER,
38291   	ZEND_NEW_SPEC_HANDLER,
38292   	ZEND_NEW_SPEC_HANDLER,
38293   	ZEND_NEW_SPEC_HANDLER,
38294   	ZEND_NEW_SPEC_HANDLER,
38295   	ZEND_NEW_SPEC_HANDLER,
38296   	ZEND_NEW_SPEC_HANDLER,
38297   	ZEND_NEW_SPEC_HANDLER,
38298   	ZEND_NEW_SPEC_HANDLER,
38299   	ZEND_NEW_SPEC_HANDLER,
38300   	ZEND_NEW_SPEC_HANDLER,
38301   	ZEND_NEW_SPEC_HANDLER,
38302   	ZEND_NEW_SPEC_HANDLER,
38303   	ZEND_NEW_SPEC_HANDLER,
38304   	ZEND_NEW_SPEC_HANDLER,
38305   	ZEND_NEW_SPEC_HANDLER,
38306   	ZEND_NEW_SPEC_HANDLER,
38307   	ZEND_NEW_SPEC_HANDLER,
38308   	ZEND_NEW_SPEC_HANDLER,
38309   	ZEND_NEW_SPEC_HANDLER,
38310   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38311   	ZEND_NULL_HANDLER,
38312   	ZEND_NULL_HANDLER,
38313   	ZEND_NULL_HANDLER,
38314   	ZEND_NULL_HANDLER,
38315   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38316   	ZEND_NULL_HANDLER,
38317   	ZEND_NULL_HANDLER,
38318   	ZEND_NULL_HANDLER,
38319   	ZEND_NULL_HANDLER,
38320   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38321   	ZEND_NULL_HANDLER,
38322   	ZEND_NULL_HANDLER,
38323   	ZEND_NULL_HANDLER,
38324   	ZEND_NULL_HANDLER,
38325   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38326   	ZEND_NULL_HANDLER,
38327   	ZEND_NULL_HANDLER,
38328   	ZEND_NULL_HANDLER,
38329   	ZEND_NULL_HANDLER,
38330   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
38331   	ZEND_NULL_HANDLER,
38332   	ZEND_NULL_HANDLER,
38333   	ZEND_NULL_HANDLER,
38334   	ZEND_NULL_HANDLER,
38335   	ZEND_NULL_HANDLER,
38336   	ZEND_NULL_HANDLER,
38337   	ZEND_NULL_HANDLER,
38338   	ZEND_NULL_HANDLER,
38339   	ZEND_NULL_HANDLER,
38340   	ZEND_FREE_SPEC_TMP_HANDLER,
38341   	ZEND_FREE_SPEC_TMP_HANDLER,
38342   	ZEND_FREE_SPEC_TMP_HANDLER,
38343   	ZEND_FREE_SPEC_TMP_HANDLER,
38344   	ZEND_FREE_SPEC_TMP_HANDLER,
38345   	ZEND_FREE_SPEC_VAR_HANDLER,
38346   	ZEND_FREE_SPEC_VAR_HANDLER,
38347   	ZEND_FREE_SPEC_VAR_HANDLER,
38348   	ZEND_FREE_SPEC_VAR_HANDLER,
38349   	ZEND_FREE_SPEC_VAR_HANDLER,
38350   	ZEND_NULL_HANDLER,
38351   	ZEND_NULL_HANDLER,
38352   	ZEND_NULL_HANDLER,
38353   	ZEND_NULL_HANDLER,
38354   	ZEND_NULL_HANDLER,
38355   	ZEND_NULL_HANDLER,
38356   	ZEND_NULL_HANDLER,
38357   	ZEND_NULL_HANDLER,
38358   	ZEND_NULL_HANDLER,
38359   	ZEND_NULL_HANDLER,
38360   	ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER,
38361   	ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER,
38362   	ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER,
38363   	ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER,
38364   	ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER,
38365   	ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER,
38366   	ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER,
38367   	ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER,
38368   	ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER,
38369   	ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER,
38370   	ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER,
38371   	ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER,
38372   	ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER,
38373   	ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER,
38374   	ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER,
38375   	ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER,
38376   	ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER,
38377   	ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER,
38378   	ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER,
38379   	ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER,
38380   	ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER,
38381   	ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER,
38382   	ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER,
38383   	ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER,
38384   	ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER,
38385   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER,
38386   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER,
38387   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER,
38388   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER,
38389   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER,
38390   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER,
38391   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER,
38392   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER,
38393   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER,
38394   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER,
38395   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER,
38396   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER,
38397   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER,
38398   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER,
38399   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER,
38400   	ZEND_NULL_HANDLER,
38401   	ZEND_NULL_HANDLER,
38402   	ZEND_NULL_HANDLER,
38403   	ZEND_NULL_HANDLER,
38404   	ZEND_NULL_HANDLER,
38405   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER,
38406   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER,
38407   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER,
38408   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER,
38409   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER,
38410   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
38411   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
38412   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
38413   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
38414   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
38415   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
38416   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
38417   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
38418   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
38419   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
38420   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
38421   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
38422   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
38423   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
38424   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
38425   	ZEND_NULL_HANDLER,
38426   	ZEND_NULL_HANDLER,
38427   	ZEND_NULL_HANDLER,
38428   	ZEND_NULL_HANDLER,
38429   	ZEND_NULL_HANDLER,
38430   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
38431   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
38432   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
38433   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
38434   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
38435   	ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER,
38436   	ZEND_NULL_HANDLER,
38437   	ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER,
38438   	ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER,
38439   	ZEND_NULL_HANDLER,
38440   	ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER,
38441   	ZEND_NULL_HANDLER,
38442   	ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER,
38443   	ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER,
38444   	ZEND_NULL_HANDLER,
38445   	ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER,
38446   	ZEND_NULL_HANDLER,
38447   	ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER,
38448   	ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER,
38449   	ZEND_NULL_HANDLER,
38450   	ZEND_NULL_HANDLER,
38451   	ZEND_NULL_HANDLER,
38452   	ZEND_NULL_HANDLER,
38453   	ZEND_NULL_HANDLER,
38454   	ZEND_NULL_HANDLER,
38455   	ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER,
38456   	ZEND_NULL_HANDLER,
38457   	ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER,
38458   	ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER,
38459   	ZEND_NULL_HANDLER,
38460   	ZEND_NULL_HANDLER,
38461   	ZEND_NULL_HANDLER,
38462   	ZEND_NULL_HANDLER,
38463   	ZEND_NULL_HANDLER,
38464   	ZEND_NULL_HANDLER,
38465   	ZEND_NULL_HANDLER,
38466   	ZEND_NULL_HANDLER,
38467   	ZEND_NULL_HANDLER,
38468   	ZEND_NULL_HANDLER,
38469   	ZEND_NULL_HANDLER,
38470   	ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER,
38471   	ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER,
38472   	ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER,
38473   	ZEND_NULL_HANDLER,
38474   	ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER,
38475   	ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER,
38476   	ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER,
38477   	ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER,
38478   	ZEND_NULL_HANDLER,
38479   	ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER,
38480   	ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER,
38481   	ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER,
38482   	ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER,
38483   	ZEND_NULL_HANDLER,
38484   	ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER,
38485   	ZEND_NULL_HANDLER,
38486   	ZEND_NULL_HANDLER,
38487   	ZEND_NULL_HANDLER,
38488   	ZEND_NULL_HANDLER,
38489   	ZEND_NULL_HANDLER,
38490   	ZEND_NULL_HANDLER,
38491   	ZEND_NULL_HANDLER,
38492   	ZEND_NULL_HANDLER,
38493   	ZEND_NULL_HANDLER,
38494   	ZEND_NULL_HANDLER,
38495   	ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER,
38496   	ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER,
38497   	ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER,
38498   	ZEND_NULL_HANDLER,
38499   	ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER,
38500   	ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER,
38501   	ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER,
38502   	ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER,
38503   	ZEND_NULL_HANDLER,
38504   	ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER,
38505   	ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER,
38506   	ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER,
38507   	ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER,
38508   	ZEND_NULL_HANDLER,
38509   	ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER,
38510   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
38511   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
38512   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
38513   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
38514   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
38515   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
38516   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
38517   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
38518   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
38519   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
38520   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
38521   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
38522   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
38523   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
38524   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
38525   	ZEND_NULL_HANDLER,
38526   	ZEND_NULL_HANDLER,
38527   	ZEND_NULL_HANDLER,
38528   	ZEND_NULL_HANDLER,
38529   	ZEND_NULL_HANDLER,
38530   	ZEND_FE_RESET_SPEC_CV_HANDLER,
38531   	ZEND_FE_RESET_SPEC_CV_HANDLER,
38532   	ZEND_FE_RESET_SPEC_CV_HANDLER,
38533   	ZEND_FE_RESET_SPEC_CV_HANDLER,
38534   	ZEND_FE_RESET_SPEC_CV_HANDLER,
38535   	ZEND_NULL_HANDLER,
38536   	ZEND_NULL_HANDLER,
38537   	ZEND_NULL_HANDLER,
38538   	ZEND_NULL_HANDLER,
38539   	ZEND_NULL_HANDLER,
38540   	ZEND_NULL_HANDLER,
38541   	ZEND_NULL_HANDLER,
38542   	ZEND_NULL_HANDLER,
38543   	ZEND_NULL_HANDLER,
38544   	ZEND_NULL_HANDLER,
38545   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
38546   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
38547   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
38548   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
38549   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
38550   	ZEND_NULL_HANDLER,
38551   	ZEND_NULL_HANDLER,
38552   	ZEND_NULL_HANDLER,
38553   	ZEND_NULL_HANDLER,
38554   	ZEND_NULL_HANDLER,
38555   	ZEND_NULL_HANDLER,
38556   	ZEND_NULL_HANDLER,
38557   	ZEND_NULL_HANDLER,
38558   	ZEND_NULL_HANDLER,
38559   	ZEND_NULL_HANDLER,
38560   	ZEND_EXIT_SPEC_CONST_HANDLER,
38561   	ZEND_EXIT_SPEC_CONST_HANDLER,
38562   	ZEND_EXIT_SPEC_CONST_HANDLER,
38563   	ZEND_EXIT_SPEC_CONST_HANDLER,
38564   	ZEND_EXIT_SPEC_CONST_HANDLER,
38565   	ZEND_EXIT_SPEC_TMP_HANDLER,
38566   	ZEND_EXIT_SPEC_TMP_HANDLER,
38567   	ZEND_EXIT_SPEC_TMP_HANDLER,
38568   	ZEND_EXIT_SPEC_TMP_HANDLER,
38569   	ZEND_EXIT_SPEC_TMP_HANDLER,
38570   	ZEND_EXIT_SPEC_VAR_HANDLER,
38571   	ZEND_EXIT_SPEC_VAR_HANDLER,
38572   	ZEND_EXIT_SPEC_VAR_HANDLER,
38573   	ZEND_EXIT_SPEC_VAR_HANDLER,
38574   	ZEND_EXIT_SPEC_VAR_HANDLER,
38575   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
38576   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
38577   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
38578   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
38579   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
38580   	ZEND_EXIT_SPEC_CV_HANDLER,
38581   	ZEND_EXIT_SPEC_CV_HANDLER,
38582   	ZEND_EXIT_SPEC_CV_HANDLER,
38583   	ZEND_EXIT_SPEC_CV_HANDLER,
38584   	ZEND_EXIT_SPEC_CV_HANDLER,
38585   	ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER,
38586   	ZEND_NULL_HANDLER,
38587   	ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER,
38588   	ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER,
38589   	ZEND_NULL_HANDLER,
38590   	ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER,
38591   	ZEND_NULL_HANDLER,
38592   	ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER,
38593   	ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER,
38594   	ZEND_NULL_HANDLER,
38595   	ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER,
38596   	ZEND_NULL_HANDLER,
38597   	ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER,
38598   	ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER,
38599   	ZEND_NULL_HANDLER,
38600   	ZEND_NULL_HANDLER,
38601   	ZEND_NULL_HANDLER,
38602   	ZEND_NULL_HANDLER,
38603   	ZEND_NULL_HANDLER,
38604   	ZEND_NULL_HANDLER,
38605   	ZEND_FETCH_R_SPEC_CV_CONST_HANDLER,
38606   	ZEND_NULL_HANDLER,
38607   	ZEND_FETCH_R_SPEC_CV_VAR_HANDLER,
38608   	ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER,
38609   	ZEND_NULL_HANDLER,
38610   	ZEND_NULL_HANDLER,
38611   	ZEND_NULL_HANDLER,
38612   	ZEND_NULL_HANDLER,
38613   	ZEND_NULL_HANDLER,
38614   	ZEND_NULL_HANDLER,
38615   	ZEND_NULL_HANDLER,
38616   	ZEND_NULL_HANDLER,
38617   	ZEND_NULL_HANDLER,
38618   	ZEND_NULL_HANDLER,
38619   	ZEND_NULL_HANDLER,
38620   	ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER,
38621   	ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER,
38622   	ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER,
38623   	ZEND_NULL_HANDLER,
38624   	ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER,
38625   	ZEND_NULL_HANDLER,
38626   	ZEND_NULL_HANDLER,
38627   	ZEND_NULL_HANDLER,
38628   	ZEND_NULL_HANDLER,
38629   	ZEND_NULL_HANDLER,
38630   	ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER,
38631   	ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER,
38632   	ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER,
38633   	ZEND_NULL_HANDLER,
38634   	ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER,
38635   	ZEND_NULL_HANDLER,
38636   	ZEND_NULL_HANDLER,
38637   	ZEND_NULL_HANDLER,
38638   	ZEND_NULL_HANDLER,
38639   	ZEND_NULL_HANDLER,
38640   	ZEND_NULL_HANDLER,
38641   	ZEND_NULL_HANDLER,
38642   	ZEND_NULL_HANDLER,
38643   	ZEND_NULL_HANDLER,
38644   	ZEND_NULL_HANDLER,
38645   	ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER,
38646   	ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER,
38647   	ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER,
38648   	ZEND_NULL_HANDLER,
38649   	ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER,
38650   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER,
38651   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER,
38652   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER,
38653   	ZEND_NULL_HANDLER,
38654   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER,
38655   	ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER,
38656   	ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER,
38657   	ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER,
38658   	ZEND_NULL_HANDLER,
38659   	ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER,
38660   	ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER,
38661   	ZEND_NULL_HANDLER,
38662   	ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER,
38663   	ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER,
38664   	ZEND_NULL_HANDLER,
38665   	ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER,
38666   	ZEND_NULL_HANDLER,
38667   	ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER,
38668   	ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER,
38669   	ZEND_NULL_HANDLER,
38670   	ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER,
38671   	ZEND_NULL_HANDLER,
38672   	ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER,
38673   	ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER,
38674   	ZEND_NULL_HANDLER,
38675   	ZEND_NULL_HANDLER,
38676   	ZEND_NULL_HANDLER,
38677   	ZEND_NULL_HANDLER,
38678   	ZEND_NULL_HANDLER,
38679   	ZEND_NULL_HANDLER,
38680   	ZEND_FETCH_W_SPEC_CV_CONST_HANDLER,
38681   	ZEND_NULL_HANDLER,
38682   	ZEND_FETCH_W_SPEC_CV_VAR_HANDLER,
38683   	ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER,
38684   	ZEND_NULL_HANDLER,
38685   	ZEND_NULL_HANDLER,
38686   	ZEND_NULL_HANDLER,
38687   	ZEND_NULL_HANDLER,
38688   	ZEND_NULL_HANDLER,
38689   	ZEND_NULL_HANDLER,
38690   	ZEND_NULL_HANDLER,
38691   	ZEND_NULL_HANDLER,
38692   	ZEND_NULL_HANDLER,
38693   	ZEND_NULL_HANDLER,
38694   	ZEND_NULL_HANDLER,
38695   	ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER,
38696   	ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER,
38697   	ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER,
38698   	ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER,
38699   	ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER,
38700   	ZEND_NULL_HANDLER,
38701   	ZEND_NULL_HANDLER,
38702   	ZEND_NULL_HANDLER,
38703   	ZEND_NULL_HANDLER,
38704   	ZEND_NULL_HANDLER,
38705   	ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER,
38706   	ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER,
38707   	ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER,
38708   	ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER,
38709   	ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER,
38710   	ZEND_NULL_HANDLER,
38711   	ZEND_NULL_HANDLER,
38712   	ZEND_NULL_HANDLER,
38713   	ZEND_NULL_HANDLER,
38714   	ZEND_NULL_HANDLER,
38715   	ZEND_NULL_HANDLER,
38716   	ZEND_NULL_HANDLER,
38717   	ZEND_NULL_HANDLER,
38718   	ZEND_NULL_HANDLER,
38719   	ZEND_NULL_HANDLER,
38720   	ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER,
38721   	ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER,
38722   	ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER,
38723   	ZEND_NULL_HANDLER,
38724   	ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER,
38725   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER,
38726   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER,
38727   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER,
38728   	ZEND_NULL_HANDLER,
38729   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER,
38730   	ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER,
38731   	ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER,
38732   	ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER,
38733   	ZEND_NULL_HANDLER,
38734   	ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER,
38735   	ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER,
38736   	ZEND_NULL_HANDLER,
38737   	ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER,
38738   	ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER,
38739   	ZEND_NULL_HANDLER,
38740   	ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER,
38741   	ZEND_NULL_HANDLER,
38742   	ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER,
38743   	ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER,
38744   	ZEND_NULL_HANDLER,
38745   	ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER,
38746   	ZEND_NULL_HANDLER,
38747   	ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER,
38748   	ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER,
38749   	ZEND_NULL_HANDLER,
38750   	ZEND_NULL_HANDLER,
38751   	ZEND_NULL_HANDLER,
38752   	ZEND_NULL_HANDLER,
38753   	ZEND_NULL_HANDLER,
38754   	ZEND_NULL_HANDLER,
38755   	ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER,
38756   	ZEND_NULL_HANDLER,
38757   	ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER,
38758   	ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER,
38759   	ZEND_NULL_HANDLER,
38760   	ZEND_NULL_HANDLER,
38761   	ZEND_NULL_HANDLER,
38762   	ZEND_NULL_HANDLER,
38763   	ZEND_NULL_HANDLER,
38764   	ZEND_NULL_HANDLER,
38765   	ZEND_NULL_HANDLER,
38766   	ZEND_NULL_HANDLER,
38767   	ZEND_NULL_HANDLER,
38768   	ZEND_NULL_HANDLER,
38769   	ZEND_NULL_HANDLER,
38770   	ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER,
38771   	ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER,
38772   	ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER,
38773   	ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER,
38774   	ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER,
38775   	ZEND_NULL_HANDLER,
38776   	ZEND_NULL_HANDLER,
38777   	ZEND_NULL_HANDLER,
38778   	ZEND_NULL_HANDLER,
38779   	ZEND_NULL_HANDLER,
38780   	ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER,
38781   	ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER,
38782   	ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER,
38783   	ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER,
38784   	ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER,
38785   	ZEND_NULL_HANDLER,
38786   	ZEND_NULL_HANDLER,
38787   	ZEND_NULL_HANDLER,
38788   	ZEND_NULL_HANDLER,
38789   	ZEND_NULL_HANDLER,
38790   	ZEND_NULL_HANDLER,
38791   	ZEND_NULL_HANDLER,
38792   	ZEND_NULL_HANDLER,
38793   	ZEND_NULL_HANDLER,
38794   	ZEND_NULL_HANDLER,
38795   	ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER,
38796   	ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER,
38797   	ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER,
38798   	ZEND_NULL_HANDLER,
38799   	ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER,
38800   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER,
38801   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER,
38802   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER,
38803   	ZEND_NULL_HANDLER,
38804   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER,
38805   	ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER,
38806   	ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER,
38807   	ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER,
38808   	ZEND_NULL_HANDLER,
38809   	ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER,
38810   	ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER,
38811   	ZEND_NULL_HANDLER,
38812   	ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER,
38813   	ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER,
38814   	ZEND_NULL_HANDLER,
38815   	ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER,
38816   	ZEND_NULL_HANDLER,
38817   	ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER,
38818   	ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER,
38819   	ZEND_NULL_HANDLER,
38820   	ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER,
38821   	ZEND_NULL_HANDLER,
38822   	ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER,
38823   	ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER,
38824   	ZEND_NULL_HANDLER,
38825   	ZEND_NULL_HANDLER,
38826   	ZEND_NULL_HANDLER,
38827   	ZEND_NULL_HANDLER,
38828   	ZEND_NULL_HANDLER,
38829   	ZEND_NULL_HANDLER,
38830   	ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER,
38831   	ZEND_NULL_HANDLER,
38832   	ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER,
38833   	ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER,
38834   	ZEND_NULL_HANDLER,
38835   	ZEND_NULL_HANDLER,
38836   	ZEND_NULL_HANDLER,
38837   	ZEND_NULL_HANDLER,
38838   	ZEND_NULL_HANDLER,
38839   	ZEND_NULL_HANDLER,
38840   	ZEND_NULL_HANDLER,
38841   	ZEND_NULL_HANDLER,
38842   	ZEND_NULL_HANDLER,
38843   	ZEND_NULL_HANDLER,
38844   	ZEND_NULL_HANDLER,
38845   	ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER,
38846   	ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER,
38847   	ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER,
38848   	ZEND_NULL_HANDLER,
38849   	ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER,
38850   	ZEND_NULL_HANDLER,
38851   	ZEND_NULL_HANDLER,
38852   	ZEND_NULL_HANDLER,
38853   	ZEND_NULL_HANDLER,
38854   	ZEND_NULL_HANDLER,
38855   	ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER,
38856   	ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER,
38857   	ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER,
38858   	ZEND_NULL_HANDLER,
38859   	ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER,
38860   	ZEND_NULL_HANDLER,
38861   	ZEND_NULL_HANDLER,
38862   	ZEND_NULL_HANDLER,
38863   	ZEND_NULL_HANDLER,
38864   	ZEND_NULL_HANDLER,
38865   	ZEND_NULL_HANDLER,
38866   	ZEND_NULL_HANDLER,
38867   	ZEND_NULL_HANDLER,
38868   	ZEND_NULL_HANDLER,
38869   	ZEND_NULL_HANDLER,
38870   	ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER,
38871   	ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER,
38872   	ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER,
38873   	ZEND_NULL_HANDLER,
38874   	ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER,
38875   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER,
38876   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER,
38877   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER,
38878   	ZEND_NULL_HANDLER,
38879   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER,
38880   	ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER,
38881   	ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER,
38882   	ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER,
38883   	ZEND_NULL_HANDLER,
38884   	ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER,
38885   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER,
38886   	ZEND_NULL_HANDLER,
38887   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER,
38888   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER,
38889   	ZEND_NULL_HANDLER,
38890   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER,
38891   	ZEND_NULL_HANDLER,
38892   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER,
38893   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER,
38894   	ZEND_NULL_HANDLER,
38895   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
38896   	ZEND_NULL_HANDLER,
38897   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
38898   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER,
38899   	ZEND_NULL_HANDLER,
38900   	ZEND_NULL_HANDLER,
38901   	ZEND_NULL_HANDLER,
38902   	ZEND_NULL_HANDLER,
38903   	ZEND_NULL_HANDLER,
38904   	ZEND_NULL_HANDLER,
38905   	ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER,
38906   	ZEND_NULL_HANDLER,
38907   	ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER,
38908   	ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER,
38909   	ZEND_NULL_HANDLER,
38910   	ZEND_NULL_HANDLER,
38911   	ZEND_NULL_HANDLER,
38912   	ZEND_NULL_HANDLER,
38913   	ZEND_NULL_HANDLER,
38914   	ZEND_NULL_HANDLER,
38915   	ZEND_NULL_HANDLER,
38916   	ZEND_NULL_HANDLER,
38917   	ZEND_NULL_HANDLER,
38918   	ZEND_NULL_HANDLER,
38919   	ZEND_NULL_HANDLER,
38920   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
38921   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER,
38922   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
38923   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER,
38924   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER,
38925   	ZEND_NULL_HANDLER,
38926   	ZEND_NULL_HANDLER,
38927   	ZEND_NULL_HANDLER,
38928   	ZEND_NULL_HANDLER,
38929   	ZEND_NULL_HANDLER,
38930   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER,
38931   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER,
38932   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER,
38933   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER,
38934   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER,
38935   	ZEND_NULL_HANDLER,
38936   	ZEND_NULL_HANDLER,
38937   	ZEND_NULL_HANDLER,
38938   	ZEND_NULL_HANDLER,
38939   	ZEND_NULL_HANDLER,
38940   	ZEND_NULL_HANDLER,
38941   	ZEND_NULL_HANDLER,
38942   	ZEND_NULL_HANDLER,
38943   	ZEND_NULL_HANDLER,
38944   	ZEND_NULL_HANDLER,
38945   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
38946   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER,
38947   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
38948   	ZEND_NULL_HANDLER,
38949   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER,
38950   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER,
38951   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER,
38952   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER,
38953   	ZEND_NULL_HANDLER,
38954   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER,
38955   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER,
38956   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER,
38957   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER,
38958   	ZEND_NULL_HANDLER,
38959   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER,
38960   	ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER,
38961   	ZEND_NULL_HANDLER,
38962   	ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER,
38963   	ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER,
38964   	ZEND_NULL_HANDLER,
38965   	ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER,
38966   	ZEND_NULL_HANDLER,
38967   	ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER,
38968   	ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER,
38969   	ZEND_NULL_HANDLER,
38970   	ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER,
38971   	ZEND_NULL_HANDLER,
38972   	ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER,
38973   	ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER,
38974   	ZEND_NULL_HANDLER,
38975   	ZEND_NULL_HANDLER,
38976   	ZEND_NULL_HANDLER,
38977   	ZEND_NULL_HANDLER,
38978   	ZEND_NULL_HANDLER,
38979   	ZEND_NULL_HANDLER,
38980   	ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER,
38981   	ZEND_NULL_HANDLER,
38982   	ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER,
38983   	ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER,
38984   	ZEND_NULL_HANDLER,
38985   	ZEND_NULL_HANDLER,
38986   	ZEND_NULL_HANDLER,
38987   	ZEND_NULL_HANDLER,
38988   	ZEND_NULL_HANDLER,
38989   	ZEND_NULL_HANDLER,
38990   	ZEND_NULL_HANDLER,
38991   	ZEND_NULL_HANDLER,
38992   	ZEND_NULL_HANDLER,
38993   	ZEND_NULL_HANDLER,
38994   	ZEND_NULL_HANDLER,
38995   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER,
38996   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER,
38997   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER,
38998   	ZEND_NULL_HANDLER,
38999   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER,
39000   	ZEND_NULL_HANDLER,
39001   	ZEND_NULL_HANDLER,
39002   	ZEND_NULL_HANDLER,
39003   	ZEND_NULL_HANDLER,
39004   	ZEND_NULL_HANDLER,
39005   	ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER,
39006   	ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER,
39007   	ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER,
39008   	ZEND_NULL_HANDLER,
39009   	ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER,
39010   	ZEND_NULL_HANDLER,
39011   	ZEND_NULL_HANDLER,
39012   	ZEND_NULL_HANDLER,
39013   	ZEND_NULL_HANDLER,
39014   	ZEND_NULL_HANDLER,
39015   	ZEND_NULL_HANDLER,
39016   	ZEND_NULL_HANDLER,
39017   	ZEND_NULL_HANDLER,
39018   	ZEND_NULL_HANDLER,
39019   	ZEND_NULL_HANDLER,
39020   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER,
39021   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER,
39022   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER,
39023   	ZEND_NULL_HANDLER,
39024   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER,
39025   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER,
39026   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER,
39027   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER,
39028   	ZEND_NULL_HANDLER,
39029   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER,
39030   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER,
39031   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER,
39032   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER,
39033   	ZEND_NULL_HANDLER,
39034   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER,
39035   	ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER,
39036   	ZEND_NULL_HANDLER,
39037   	ZEND_NULL_HANDLER,
39038   	ZEND_NULL_HANDLER,
39039   	ZEND_NULL_HANDLER,
39040   	ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER,
39041   	ZEND_NULL_HANDLER,
39042   	ZEND_NULL_HANDLER,
39043   	ZEND_NULL_HANDLER,
39044   	ZEND_NULL_HANDLER,
39045   	ZEND_NULL_HANDLER,
39046   	ZEND_NULL_HANDLER,
39047   	ZEND_NULL_HANDLER,
39048   	ZEND_NULL_HANDLER,
39049   	ZEND_NULL_HANDLER,
39050   	ZEND_NULL_HANDLER,
39051   	ZEND_NULL_HANDLER,
39052   	ZEND_NULL_HANDLER,
39053   	ZEND_NULL_HANDLER,
39054   	ZEND_NULL_HANDLER,
39055   	ZEND_NULL_HANDLER,
39056   	ZEND_NULL_HANDLER,
39057   	ZEND_NULL_HANDLER,
39058   	ZEND_NULL_HANDLER,
39059   	ZEND_NULL_HANDLER,
39060   	ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER,
39061   	ZEND_NULL_HANDLER,
39062   	ZEND_NULL_HANDLER,
39063   	ZEND_NULL_HANDLER,
39064   	ZEND_NULL_HANDLER,
39065   	ZEND_NULL_HANDLER,
39066   	ZEND_NULL_HANDLER,
39067   	ZEND_NULL_HANDLER,
39068   	ZEND_NULL_HANDLER,
39069   	ZEND_NULL_HANDLER,
39070   	ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER,
39071   	ZEND_NULL_HANDLER,
39072   	ZEND_NULL_HANDLER,
39073   	ZEND_NULL_HANDLER,
39074   	ZEND_NULL_HANDLER,
39075   	ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER,
39076   	ZEND_NULL_HANDLER,
39077   	ZEND_NULL_HANDLER,
39078   	ZEND_NULL_HANDLER,
39079   	ZEND_NULL_HANDLER,
39080   	ZEND_NULL_HANDLER,
39081   	ZEND_NULL_HANDLER,
39082   	ZEND_NULL_HANDLER,
39083   	ZEND_NULL_HANDLER,
39084   	ZEND_NULL_HANDLER,
39085   	ZEND_GOTO_SPEC_CONST_HANDLER,
39086   	ZEND_NULL_HANDLER,
39087   	ZEND_NULL_HANDLER,
39088   	ZEND_NULL_HANDLER,
39089   	ZEND_NULL_HANDLER,
39090   	ZEND_GOTO_SPEC_CONST_HANDLER,
39091   	ZEND_NULL_HANDLER,
39092   	ZEND_NULL_HANDLER,
39093   	ZEND_NULL_HANDLER,
39094   	ZEND_NULL_HANDLER,
39095   	ZEND_GOTO_SPEC_CONST_HANDLER,
39096   	ZEND_NULL_HANDLER,
39097   	ZEND_NULL_HANDLER,
39098   	ZEND_NULL_HANDLER,
39099   	ZEND_NULL_HANDLER,
39100   	ZEND_GOTO_SPEC_CONST_HANDLER,
39101   	ZEND_NULL_HANDLER,
39102   	ZEND_NULL_HANDLER,
39103   	ZEND_NULL_HANDLER,
39104   	ZEND_NULL_HANDLER,
39105   	ZEND_GOTO_SPEC_CONST_HANDLER,
39106   	ZEND_NULL_HANDLER,
39107   	ZEND_NULL_HANDLER,
39108   	ZEND_NULL_HANDLER,
39109   	ZEND_NULL_HANDLER,
39110   	ZEND_EXT_STMT_SPEC_HANDLER,
39111   	ZEND_EXT_STMT_SPEC_HANDLER,
39112   	ZEND_EXT_STMT_SPEC_HANDLER,
39113   	ZEND_EXT_STMT_SPEC_HANDLER,
39114   	ZEND_EXT_STMT_SPEC_HANDLER,
39115   	ZEND_EXT_STMT_SPEC_HANDLER,
39116   	ZEND_EXT_STMT_SPEC_HANDLER,
39117   	ZEND_EXT_STMT_SPEC_HANDLER,
39118   	ZEND_EXT_STMT_SPEC_HANDLER,
39119   	ZEND_EXT_STMT_SPEC_HANDLER,
39120   	ZEND_EXT_STMT_SPEC_HANDLER,
39121   	ZEND_EXT_STMT_SPEC_HANDLER,
39122   	ZEND_EXT_STMT_SPEC_HANDLER,
39123   	ZEND_EXT_STMT_SPEC_HANDLER,
39124   	ZEND_EXT_STMT_SPEC_HANDLER,
39125   	ZEND_EXT_STMT_SPEC_HANDLER,
39126   	ZEND_EXT_STMT_SPEC_HANDLER,
39127   	ZEND_EXT_STMT_SPEC_HANDLER,
39128   	ZEND_EXT_STMT_SPEC_HANDLER,
39129   	ZEND_EXT_STMT_SPEC_HANDLER,
39130   	ZEND_EXT_STMT_SPEC_HANDLER,
39131   	ZEND_EXT_STMT_SPEC_HANDLER,
39132   	ZEND_EXT_STMT_SPEC_HANDLER,
39133   	ZEND_EXT_STMT_SPEC_HANDLER,
39134   	ZEND_EXT_STMT_SPEC_HANDLER,
39135   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39136   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39137   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39138   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39139   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39140   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39141   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39142   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39143   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39144   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39145   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39146   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39147   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39148   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39149   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39150   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39151   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39152   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39153   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39154   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39155   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39156   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39157   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39158   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39159   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
39160   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39161   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39162   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39163   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39164   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39165   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39166   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39167   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39168   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39169   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39170   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39171   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39172   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39173   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39174   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39175   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39176   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39177   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39178   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39179   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39180   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39181   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39182   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39183   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39184   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
39185   	ZEND_EXT_NOP_SPEC_HANDLER,
39186   	ZEND_EXT_NOP_SPEC_HANDLER,
39187   	ZEND_EXT_NOP_SPEC_HANDLER,
39188   	ZEND_EXT_NOP_SPEC_HANDLER,
39189   	ZEND_EXT_NOP_SPEC_HANDLER,
39190   	ZEND_EXT_NOP_SPEC_HANDLER,
39191   	ZEND_EXT_NOP_SPEC_HANDLER,
39192   	ZEND_EXT_NOP_SPEC_HANDLER,
39193   	ZEND_EXT_NOP_SPEC_HANDLER,
39194   	ZEND_EXT_NOP_SPEC_HANDLER,
39195   	ZEND_EXT_NOP_SPEC_HANDLER,
39196   	ZEND_EXT_NOP_SPEC_HANDLER,
39197   	ZEND_EXT_NOP_SPEC_HANDLER,
39198   	ZEND_EXT_NOP_SPEC_HANDLER,
39199   	ZEND_EXT_NOP_SPEC_HANDLER,
39200   	ZEND_EXT_NOP_SPEC_HANDLER,
39201   	ZEND_EXT_NOP_SPEC_HANDLER,
39202   	ZEND_EXT_NOP_SPEC_HANDLER,
39203   	ZEND_EXT_NOP_SPEC_HANDLER,
39204   	ZEND_EXT_NOP_SPEC_HANDLER,
39205   	ZEND_EXT_NOP_SPEC_HANDLER,
39206   	ZEND_EXT_NOP_SPEC_HANDLER,
39207   	ZEND_EXT_NOP_SPEC_HANDLER,
39208   	ZEND_EXT_NOP_SPEC_HANDLER,
39209   	ZEND_EXT_NOP_SPEC_HANDLER,
39210   	ZEND_TICKS_SPEC_HANDLER,
39211   	ZEND_TICKS_SPEC_HANDLER,
39212   	ZEND_TICKS_SPEC_HANDLER,
39213   	ZEND_TICKS_SPEC_HANDLER,
39214   	ZEND_TICKS_SPEC_HANDLER,
39215   	ZEND_TICKS_SPEC_HANDLER,
39216   	ZEND_TICKS_SPEC_HANDLER,
39217   	ZEND_TICKS_SPEC_HANDLER,
39218   	ZEND_TICKS_SPEC_HANDLER,
39219   	ZEND_TICKS_SPEC_HANDLER,
39220   	ZEND_TICKS_SPEC_HANDLER,
39221   	ZEND_TICKS_SPEC_HANDLER,
39222   	ZEND_TICKS_SPEC_HANDLER,
39223   	ZEND_TICKS_SPEC_HANDLER,
39224   	ZEND_TICKS_SPEC_HANDLER,
39225   	ZEND_TICKS_SPEC_HANDLER,
39226   	ZEND_TICKS_SPEC_HANDLER,
39227   	ZEND_TICKS_SPEC_HANDLER,
39228   	ZEND_TICKS_SPEC_HANDLER,
39229   	ZEND_TICKS_SPEC_HANDLER,
39230   	ZEND_TICKS_SPEC_HANDLER,
39231   	ZEND_TICKS_SPEC_HANDLER,
39232   	ZEND_TICKS_SPEC_HANDLER,
39233   	ZEND_TICKS_SPEC_HANDLER,
39234   	ZEND_TICKS_SPEC_HANDLER,
39235   	ZEND_NULL_HANDLER,
39236   	ZEND_NULL_HANDLER,
39237   	ZEND_NULL_HANDLER,
39238   	ZEND_NULL_HANDLER,
39239   	ZEND_NULL_HANDLER,
39240   	ZEND_NULL_HANDLER,
39241   	ZEND_NULL_HANDLER,
39242   	ZEND_NULL_HANDLER,
39243   	ZEND_NULL_HANDLER,
39244   	ZEND_NULL_HANDLER,
39245   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
39246   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
39247   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
39248   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
39249   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
39250   	ZEND_NULL_HANDLER,
39251   	ZEND_NULL_HANDLER,
39252   	ZEND_NULL_HANDLER,
39253   	ZEND_NULL_HANDLER,
39254   	ZEND_NULL_HANDLER,
39255   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
39256   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
39257   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
39258   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
39259   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
39260   	ZEND_NULL_HANDLER,
39261   	ZEND_NULL_HANDLER,
39262   	ZEND_NULL_HANDLER,
39263   	ZEND_NULL_HANDLER,
39264   	ZEND_CATCH_SPEC_CONST_CV_HANDLER,
39265   	ZEND_NULL_HANDLER,
39266   	ZEND_NULL_HANDLER,
39267   	ZEND_NULL_HANDLER,
39268   	ZEND_NULL_HANDLER,
39269   	ZEND_NULL_HANDLER,
39270   	ZEND_NULL_HANDLER,
39271   	ZEND_NULL_HANDLER,
39272   	ZEND_NULL_HANDLER,
39273   	ZEND_NULL_HANDLER,
39274   	ZEND_NULL_HANDLER,
39275   	ZEND_NULL_HANDLER,
39276   	ZEND_NULL_HANDLER,
39277   	ZEND_NULL_HANDLER,
39278   	ZEND_NULL_HANDLER,
39279   	ZEND_NULL_HANDLER,
39280   	ZEND_NULL_HANDLER,
39281   	ZEND_NULL_HANDLER,
39282   	ZEND_NULL_HANDLER,
39283   	ZEND_NULL_HANDLER,
39284   	ZEND_NULL_HANDLER,
39285   	ZEND_THROW_SPEC_CONST_HANDLER,
39286   	ZEND_THROW_SPEC_CONST_HANDLER,
39287   	ZEND_THROW_SPEC_CONST_HANDLER,
39288   	ZEND_THROW_SPEC_CONST_HANDLER,
39289   	ZEND_THROW_SPEC_CONST_HANDLER,
39290   	ZEND_THROW_SPEC_TMP_HANDLER,
39291   	ZEND_THROW_SPEC_TMP_HANDLER,
39292   	ZEND_THROW_SPEC_TMP_HANDLER,
39293   	ZEND_THROW_SPEC_TMP_HANDLER,
39294   	ZEND_THROW_SPEC_TMP_HANDLER,
39295   	ZEND_THROW_SPEC_VAR_HANDLER,
39296   	ZEND_THROW_SPEC_VAR_HANDLER,
39297   	ZEND_THROW_SPEC_VAR_HANDLER,
39298   	ZEND_THROW_SPEC_VAR_HANDLER,
39299   	ZEND_THROW_SPEC_VAR_HANDLER,
39300   	ZEND_NULL_HANDLER,
39301   	ZEND_NULL_HANDLER,
39302   	ZEND_NULL_HANDLER,
39303   	ZEND_NULL_HANDLER,
39304   	ZEND_NULL_HANDLER,
39305   	ZEND_THROW_SPEC_CV_HANDLER,
39306   	ZEND_THROW_SPEC_CV_HANDLER,
39307   	ZEND_THROW_SPEC_CV_HANDLER,
39308   	ZEND_THROW_SPEC_CV_HANDLER,
39309   	ZEND_THROW_SPEC_CV_HANDLER,
39310   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
39311   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
39312   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
39313   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
39314   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
39315   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
39316   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
39317   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
39318   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
39319   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
39320   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
39321   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
39322   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
39323   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
39324   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
39325   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
39326   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
39327   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
39328   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
39329   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
39330   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
39331   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
39332   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
39333   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
39334   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
39335   	ZEND_CLONE_SPEC_CONST_HANDLER,
39336   	ZEND_CLONE_SPEC_CONST_HANDLER,
39337   	ZEND_CLONE_SPEC_CONST_HANDLER,
39338   	ZEND_CLONE_SPEC_CONST_HANDLER,
39339   	ZEND_CLONE_SPEC_CONST_HANDLER,
39340   	ZEND_CLONE_SPEC_TMP_HANDLER,
39341   	ZEND_CLONE_SPEC_TMP_HANDLER,
39342   	ZEND_CLONE_SPEC_TMP_HANDLER,
39343   	ZEND_CLONE_SPEC_TMP_HANDLER,
39344   	ZEND_CLONE_SPEC_TMP_HANDLER,
39345   	ZEND_CLONE_SPEC_VAR_HANDLER,
39346   	ZEND_CLONE_SPEC_VAR_HANDLER,
39347   	ZEND_CLONE_SPEC_VAR_HANDLER,
39348   	ZEND_CLONE_SPEC_VAR_HANDLER,
39349   	ZEND_CLONE_SPEC_VAR_HANDLER,
39350   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
39351   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
39352   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
39353   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
39354   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
39355   	ZEND_CLONE_SPEC_CV_HANDLER,
39356   	ZEND_CLONE_SPEC_CV_HANDLER,
39357   	ZEND_CLONE_SPEC_CV_HANDLER,
39358   	ZEND_CLONE_SPEC_CV_HANDLER,
39359   	ZEND_CLONE_SPEC_CV_HANDLER,
39360   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
39361   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
39362   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
39363   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
39364   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
39365   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
39366   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
39367   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
39368   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
39369   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
39370   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
39371   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
39372   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
39373   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
39374   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
39375   	ZEND_NULL_HANDLER,
39376   	ZEND_NULL_HANDLER,
39377   	ZEND_NULL_HANDLER,
39378   	ZEND_NULL_HANDLER,
39379   	ZEND_NULL_HANDLER,
39380   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
39381   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
39382   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
39383   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
39384   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
39385   	ZEND_NULL_HANDLER,
39386   	ZEND_NULL_HANDLER,
39387   	ZEND_NULL_HANDLER,
39388   	ZEND_NULL_HANDLER,
39389   	ZEND_NULL_HANDLER,
39390   	ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER,
39391   	ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER,
39392   	ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER,
39393   	ZEND_NULL_HANDLER,
39394   	ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER,
39395   	ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER,
39396   	ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER,
39397   	ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER,
39398   	ZEND_NULL_HANDLER,
39399   	ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER,
39400   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER,
39401   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER,
39402   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER,
39403   	ZEND_NULL_HANDLER,
39404   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER,
39405   	ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER,
39406   	ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER,
39407   	ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER,
39408   	ZEND_NULL_HANDLER,
39409   	ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER,
39410   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER,
39411   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER,
39412   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER,
39413   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER,
39414   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER,
39415   	ZEND_NULL_HANDLER,
39416   	ZEND_NULL_HANDLER,
39417   	ZEND_NULL_HANDLER,
39418   	ZEND_NULL_HANDLER,
39419   	ZEND_NULL_HANDLER,
39420   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER,
39421   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER,
39422   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER,
39423   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER,
39424   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER,
39425   	ZEND_NULL_HANDLER,
39426   	ZEND_NULL_HANDLER,
39427   	ZEND_NULL_HANDLER,
39428   	ZEND_NULL_HANDLER,
39429   	ZEND_NULL_HANDLER,
39430   	ZEND_NULL_HANDLER,
39431   	ZEND_NULL_HANDLER,
39432   	ZEND_NULL_HANDLER,
39433   	ZEND_NULL_HANDLER,
39434   	ZEND_NULL_HANDLER,
39435   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER,
39436   	ZEND_NULL_HANDLER,
39437   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER,
39438   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER,
39439   	ZEND_NULL_HANDLER,
39440   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER,
39441   	ZEND_NULL_HANDLER,
39442   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER,
39443   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER,
39444   	ZEND_NULL_HANDLER,
39445   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER,
39446   	ZEND_NULL_HANDLER,
39447   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER,
39448   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER,
39449   	ZEND_NULL_HANDLER,
39450   	ZEND_NULL_HANDLER,
39451   	ZEND_NULL_HANDLER,
39452   	ZEND_NULL_HANDLER,
39453   	ZEND_NULL_HANDLER,
39454   	ZEND_NULL_HANDLER,
39455   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER,
39456   	ZEND_NULL_HANDLER,
39457   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER,
39458   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER,
39459   	ZEND_NULL_HANDLER,
39460   	ZEND_NULL_HANDLER,
39461   	ZEND_NULL_HANDLER,
39462   	ZEND_NULL_HANDLER,
39463   	ZEND_NULL_HANDLER,
39464   	ZEND_NULL_HANDLER,
39465   	ZEND_NULL_HANDLER,
39466   	ZEND_NULL_HANDLER,
39467   	ZEND_NULL_HANDLER,
39468   	ZEND_NULL_HANDLER,
39469   	ZEND_NULL_HANDLER,
39470   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER,
39471   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER,
39472   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER,
39473   	ZEND_NULL_HANDLER,
39474   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER,
39475   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER,
39476   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER,
39477   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER,
39478   	ZEND_NULL_HANDLER,
39479   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER,
39480   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER,
39481   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER,
39482   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER,
39483   	ZEND_NULL_HANDLER,
39484   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER,
39485   	ZEND_NULL_HANDLER,
39486   	ZEND_NULL_HANDLER,
39487   	ZEND_NULL_HANDLER,
39488   	ZEND_NULL_HANDLER,
39489   	ZEND_NULL_HANDLER,
39490   	ZEND_NULL_HANDLER,
39491   	ZEND_NULL_HANDLER,
39492   	ZEND_NULL_HANDLER,
39493   	ZEND_NULL_HANDLER,
39494   	ZEND_NULL_HANDLER,
39495   	ZEND_NULL_HANDLER,
39496   	ZEND_NULL_HANDLER,
39497   	ZEND_NULL_HANDLER,
39498   	ZEND_NULL_HANDLER,
39499   	ZEND_NULL_HANDLER,
39500   	ZEND_NULL_HANDLER,
39501   	ZEND_NULL_HANDLER,
39502   	ZEND_NULL_HANDLER,
39503   	ZEND_NULL_HANDLER,
39504   	ZEND_NULL_HANDLER,
39505   	ZEND_NULL_HANDLER,
39506   	ZEND_NULL_HANDLER,
39507   	ZEND_NULL_HANDLER,
39508   	ZEND_NULL_HANDLER,
39509   	ZEND_NULL_HANDLER,
39510   	ZEND_NULL_HANDLER,
39511   	ZEND_NULL_HANDLER,
39512   	ZEND_NULL_HANDLER,
39513   	ZEND_NULL_HANDLER,
39514   	ZEND_NULL_HANDLER,
39515   	ZEND_NULL_HANDLER,
39516   	ZEND_NULL_HANDLER,
39517   	ZEND_NULL_HANDLER,
39518   	ZEND_NULL_HANDLER,
39519   	ZEND_NULL_HANDLER,
39520   	ZEND_NULL_HANDLER,
39521   	ZEND_NULL_HANDLER,
39522   	ZEND_NULL_HANDLER,
39523   	ZEND_NULL_HANDLER,
39524   	ZEND_NULL_HANDLER,
39525   	ZEND_NULL_HANDLER,
39526   	ZEND_NULL_HANDLER,
39527   	ZEND_NULL_HANDLER,
39528   	ZEND_NULL_HANDLER,
39529   	ZEND_NULL_HANDLER,
39530   	ZEND_NULL_HANDLER,
39531   	ZEND_NULL_HANDLER,
39532   	ZEND_NULL_HANDLER,
39533   	ZEND_NULL_HANDLER,
39534   	ZEND_NULL_HANDLER,
39535   	ZEND_NULL_HANDLER,
39536   	ZEND_NULL_HANDLER,
39537   	ZEND_NULL_HANDLER,
39538   	ZEND_NULL_HANDLER,
39539   	ZEND_NULL_HANDLER,
39540   	ZEND_NULL_HANDLER,
39541   	ZEND_NULL_HANDLER,
39542   	ZEND_NULL_HANDLER,
39543   	ZEND_NULL_HANDLER,
39544   	ZEND_NULL_HANDLER,
39545   	ZEND_NULL_HANDLER,
39546   	ZEND_NULL_HANDLER,
39547   	ZEND_NULL_HANDLER,
39548   	ZEND_NULL_HANDLER,
39549   	ZEND_NULL_HANDLER,
39550   	ZEND_NULL_HANDLER,
39551   	ZEND_NULL_HANDLER,
39552   	ZEND_NULL_HANDLER,
39553   	ZEND_NULL_HANDLER,
39554   	ZEND_NULL_HANDLER,
39555   	ZEND_NULL_HANDLER,
39556   	ZEND_NULL_HANDLER,
39557   	ZEND_NULL_HANDLER,
39558   	ZEND_NULL_HANDLER,
39559   	ZEND_NULL_HANDLER,
39560   	ZEND_NULL_HANDLER,
39561   	ZEND_NULL_HANDLER,
39562   	ZEND_NULL_HANDLER,
39563   	ZEND_NULL_HANDLER,
39564   	ZEND_NULL_HANDLER,
39565   	ZEND_NULL_HANDLER,
39566   	ZEND_NULL_HANDLER,
39567   	ZEND_NULL_HANDLER,
39568   	ZEND_NULL_HANDLER,
39569   	ZEND_NULL_HANDLER,
39570   	ZEND_NULL_HANDLER,
39571   	ZEND_NULL_HANDLER,
39572   	ZEND_NULL_HANDLER,
39573   	ZEND_NULL_HANDLER,
39574   	ZEND_NULL_HANDLER,
39575   	ZEND_NULL_HANDLER,
39576   	ZEND_NULL_HANDLER,
39577   	ZEND_NULL_HANDLER,
39578   	ZEND_NULL_HANDLER,
39579   	ZEND_NULL_HANDLER,
39580   	ZEND_NULL_HANDLER,
39581   	ZEND_NULL_HANDLER,
39582   	ZEND_NULL_HANDLER,
39583   	ZEND_NULL_HANDLER,
39584   	ZEND_NULL_HANDLER,
39585   	ZEND_NULL_HANDLER,
39586   	ZEND_NULL_HANDLER,
39587   	ZEND_NULL_HANDLER,
39588   	ZEND_NULL_HANDLER,
39589   	ZEND_NULL_HANDLER,
39590   	ZEND_NULL_HANDLER,
39591   	ZEND_NULL_HANDLER,
39592   	ZEND_NULL_HANDLER,
39593   	ZEND_NULL_HANDLER,
39594   	ZEND_NULL_HANDLER,
39595   	ZEND_NULL_HANDLER,
39596   	ZEND_NULL_HANDLER,
39597   	ZEND_NULL_HANDLER,
39598   	ZEND_NULL_HANDLER,
39599   	ZEND_NULL_HANDLER,
39600   	ZEND_NULL_HANDLER,
39601   	ZEND_NULL_HANDLER,
39602   	ZEND_NULL_HANDLER,
39603   	ZEND_NULL_HANDLER,
39604   	ZEND_NULL_HANDLER,
39605   	ZEND_NULL_HANDLER,
39606   	ZEND_NULL_HANDLER,
39607   	ZEND_NULL_HANDLER,
39608   	ZEND_NULL_HANDLER,
39609   	ZEND_NULL_HANDLER,
39610   	ZEND_NULL_HANDLER,
39611   	ZEND_NULL_HANDLER,
39612   	ZEND_NULL_HANDLER,
39613   	ZEND_NULL_HANDLER,
39614   	ZEND_NULL_HANDLER,
39615   	ZEND_NULL_HANDLER,
39616   	ZEND_NULL_HANDLER,
39617   	ZEND_NULL_HANDLER,
39618   	ZEND_NULL_HANDLER,
39619   	ZEND_NULL_HANDLER,
39620   	ZEND_NULL_HANDLER,
39621   	ZEND_NULL_HANDLER,
39622   	ZEND_NULL_HANDLER,
39623   	ZEND_NULL_HANDLER,
39624   	ZEND_NULL_HANDLER,
39625   	ZEND_NULL_HANDLER,
39626   	ZEND_NULL_HANDLER,
39627   	ZEND_NULL_HANDLER,
39628   	ZEND_NULL_HANDLER,
39629   	ZEND_NULL_HANDLER,
39630   	ZEND_NULL_HANDLER,
39631   	ZEND_NULL_HANDLER,
39632   	ZEND_NULL_HANDLER,
39633   	ZEND_NULL_HANDLER,
39634   	ZEND_NULL_HANDLER,
39635   	ZEND_NULL_HANDLER,
39636   	ZEND_NULL_HANDLER,
39637   	ZEND_NULL_HANDLER,
39638   	ZEND_NULL_HANDLER,
39639   	ZEND_NULL_HANDLER,
39640   	ZEND_NULL_HANDLER,
39641   	ZEND_NULL_HANDLER,
39642   	ZEND_NULL_HANDLER,
39643   	ZEND_NULL_HANDLER,
39644   	ZEND_NULL_HANDLER,
39645   	ZEND_NULL_HANDLER,
39646   	ZEND_NULL_HANDLER,
39647   	ZEND_NULL_HANDLER,
39648   	ZEND_NULL_HANDLER,
39649   	ZEND_NULL_HANDLER,
39650   	ZEND_NULL_HANDLER,
39651   	ZEND_NULL_HANDLER,
39652   	ZEND_NULL_HANDLER,
39653   	ZEND_NULL_HANDLER,
39654   	ZEND_NULL_HANDLER,
39655   	ZEND_NULL_HANDLER,
39656   	ZEND_NULL_HANDLER,
39657   	ZEND_NULL_HANDLER,
39658   	ZEND_NULL_HANDLER,
39659   	ZEND_NULL_HANDLER,
39660   	ZEND_NULL_HANDLER,
39661   	ZEND_NULL_HANDLER,
39662   	ZEND_NULL_HANDLER,
39663   	ZEND_NULL_HANDLER,
39664   	ZEND_NULL_HANDLER,
39665   	ZEND_NULL_HANDLER,
39666   	ZEND_NULL_HANDLER,
39667   	ZEND_NULL_HANDLER,
39668   	ZEND_NULL_HANDLER,
39669   	ZEND_NULL_HANDLER,
39670   	ZEND_NULL_HANDLER,
39671   	ZEND_NULL_HANDLER,
39672   	ZEND_NULL_HANDLER,
39673   	ZEND_NULL_HANDLER,
39674   	ZEND_NULL_HANDLER,
39675   	ZEND_NULL_HANDLER,
39676   	ZEND_NULL_HANDLER,
39677   	ZEND_NULL_HANDLER,
39678   	ZEND_NULL_HANDLER,
39679   	ZEND_NULL_HANDLER,
39680   	ZEND_NULL_HANDLER,
39681   	ZEND_NULL_HANDLER,
39682   	ZEND_NULL_HANDLER,
39683   	ZEND_NULL_HANDLER,
39684   	ZEND_NULL_HANDLER,
39685   	ZEND_NULL_HANDLER,
39686   	ZEND_NULL_HANDLER,
39687   	ZEND_NULL_HANDLER,
39688   	ZEND_NULL_HANDLER,
39689   	ZEND_NULL_HANDLER,
39690   	ZEND_NULL_HANDLER,
39691   	ZEND_NULL_HANDLER,
39692   	ZEND_NULL_HANDLER,
39693   	ZEND_NULL_HANDLER,
39694   	ZEND_NULL_HANDLER,
39695   	ZEND_NULL_HANDLER,
39696   	ZEND_NULL_HANDLER,
39697   	ZEND_NULL_HANDLER,
39698   	ZEND_NULL_HANDLER,
39699   	ZEND_NULL_HANDLER,
39700   	ZEND_NULL_HANDLER,
39701   	ZEND_NULL_HANDLER,
39702   	ZEND_NULL_HANDLER,
39703   	ZEND_NULL_HANDLER,
39704   	ZEND_NULL_HANDLER,
39705   	ZEND_NULL_HANDLER,
39706   	ZEND_NULL_HANDLER,
39707   	ZEND_NULL_HANDLER,
39708   	ZEND_NULL_HANDLER,
39709   	ZEND_NULL_HANDLER,
39710   	ZEND_NULL_HANDLER,
39711   	ZEND_NULL_HANDLER,
39712   	ZEND_NULL_HANDLER,
39713   	ZEND_NULL_HANDLER,
39714   	ZEND_NULL_HANDLER,
39715   	ZEND_NULL_HANDLER,
39716   	ZEND_NULL_HANDLER,
39717   	ZEND_NULL_HANDLER,
39718   	ZEND_NULL_HANDLER,
39719   	ZEND_NULL_HANDLER,
39720   	ZEND_NULL_HANDLER,
39721   	ZEND_NULL_HANDLER,
39722   	ZEND_NULL_HANDLER,
39723   	ZEND_NULL_HANDLER,
39724   	ZEND_NULL_HANDLER,
39725   	ZEND_NULL_HANDLER,
39726   	ZEND_NULL_HANDLER,
39727   	ZEND_NULL_HANDLER,
39728   	ZEND_NULL_HANDLER,
39729   	ZEND_NULL_HANDLER,
39730   	ZEND_NULL_HANDLER,
39731   	ZEND_NULL_HANDLER,
39732   	ZEND_NULL_HANDLER,
39733   	ZEND_NULL_HANDLER,
39734   	ZEND_NULL_HANDLER,
39735   	ZEND_NULL_HANDLER,
39736   	ZEND_NULL_HANDLER,
39737   	ZEND_NULL_HANDLER,
39738   	ZEND_NULL_HANDLER,
39739   	ZEND_NULL_HANDLER,
39740   	ZEND_NULL_HANDLER,
39741   	ZEND_NULL_HANDLER,
39742   	ZEND_NULL_HANDLER,
39743   	ZEND_NULL_HANDLER,
39744   	ZEND_NULL_HANDLER,
39745   	ZEND_NULL_HANDLER,
39746   	ZEND_NULL_HANDLER,
39747   	ZEND_NULL_HANDLER,
39748   	ZEND_NULL_HANDLER,
39749   	ZEND_NULL_HANDLER,
39750   	ZEND_NULL_HANDLER,
39751   	ZEND_NULL_HANDLER,
39752   	ZEND_NULL_HANDLER,
39753   	ZEND_NULL_HANDLER,
39754   	ZEND_NULL_HANDLER,
39755   	ZEND_NULL_HANDLER,
39756   	ZEND_NULL_HANDLER,
39757   	ZEND_NULL_HANDLER,
39758   	ZEND_NULL_HANDLER,
39759   	ZEND_NULL_HANDLER,
39760   	ZEND_NULL_HANDLER,
39761   	ZEND_NULL_HANDLER,
39762   	ZEND_NULL_HANDLER,
39763   	ZEND_NULL_HANDLER,
39764   	ZEND_NULL_HANDLER,
39765   	ZEND_NULL_HANDLER,
39766   	ZEND_NULL_HANDLER,
39767   	ZEND_NULL_HANDLER,
39768   	ZEND_NULL_HANDLER,
39769   	ZEND_NULL_HANDLER,
39770   	ZEND_NULL_HANDLER,
39771   	ZEND_NULL_HANDLER,
39772   	ZEND_NULL_HANDLER,
39773   	ZEND_NULL_HANDLER,
39774   	ZEND_NULL_HANDLER,
39775   	ZEND_NULL_HANDLER,
39776   	ZEND_NULL_HANDLER,
39777   	ZEND_NULL_HANDLER,
39778   	ZEND_NULL_HANDLER,
39779   	ZEND_NULL_HANDLER,
39780   	ZEND_NULL_HANDLER,
39781   	ZEND_NULL_HANDLER,
39782   	ZEND_NULL_HANDLER,
39783   	ZEND_NULL_HANDLER,
39784   	ZEND_NULL_HANDLER,
39785   	ZEND_NULL_HANDLER,
39786   	ZEND_NULL_HANDLER,
39787   	ZEND_NULL_HANDLER,
39788   	ZEND_NULL_HANDLER,
39789   	ZEND_NULL_HANDLER,
39790   	ZEND_NULL_HANDLER,
39791   	ZEND_NULL_HANDLER,
39792   	ZEND_NULL_HANDLER,
39793   	ZEND_NULL_HANDLER,
39794   	ZEND_NULL_HANDLER,
39795   	ZEND_NULL_HANDLER,
39796   	ZEND_NULL_HANDLER,
39797   	ZEND_NULL_HANDLER,
39798   	ZEND_NULL_HANDLER,
39799   	ZEND_NULL_HANDLER,
39800   	ZEND_NULL_HANDLER,
39801   	ZEND_NULL_HANDLER,
39802   	ZEND_NULL_HANDLER,
39803   	ZEND_NULL_HANDLER,
39804   	ZEND_NULL_HANDLER,
39805   	ZEND_NULL_HANDLER,
39806   	ZEND_NULL_HANDLER,
39807   	ZEND_NULL_HANDLER,
39808   	ZEND_NULL_HANDLER,
39809   	ZEND_NULL_HANDLER,
39810   	ZEND_NULL_HANDLER,
39811   	ZEND_NULL_HANDLER,
39812   	ZEND_NULL_HANDLER,
39813   	ZEND_NULL_HANDLER,
39814   	ZEND_NULL_HANDLER,
39815   	ZEND_NULL_HANDLER,
39816   	ZEND_NULL_HANDLER,
39817   	ZEND_NULL_HANDLER,
39818   	ZEND_NULL_HANDLER,
39819   	ZEND_NULL_HANDLER,
39820   	ZEND_NULL_HANDLER,
39821   	ZEND_NULL_HANDLER,
39822   	ZEND_NULL_HANDLER,
39823   	ZEND_NULL_HANDLER,
39824   	ZEND_NULL_HANDLER,
39825   	ZEND_NULL_HANDLER,
39826   	ZEND_NULL_HANDLER,
39827   	ZEND_NULL_HANDLER,
39828   	ZEND_NULL_HANDLER,
39829   	ZEND_NULL_HANDLER,
39830   	ZEND_NULL_HANDLER,
39831   	ZEND_NULL_HANDLER,
39832   	ZEND_NULL_HANDLER,
39833   	ZEND_NULL_HANDLER,
39834   	ZEND_NULL_HANDLER,
39835   	ZEND_NULL_HANDLER,
39836   	ZEND_NULL_HANDLER,
39837   	ZEND_NULL_HANDLER,
39838   	ZEND_NULL_HANDLER,
39839   	ZEND_NULL_HANDLER,
39840   	ZEND_NULL_HANDLER,
39841   	ZEND_NULL_HANDLER,
39842   	ZEND_NULL_HANDLER,
39843   	ZEND_NULL_HANDLER,
39844   	ZEND_NULL_HANDLER,
39845   	ZEND_NULL_HANDLER,
39846   	ZEND_NULL_HANDLER,
39847   	ZEND_NULL_HANDLER,
39848   	ZEND_NULL_HANDLER,
39849   	ZEND_NULL_HANDLER,
39850   	ZEND_NULL_HANDLER,
39851   	ZEND_NULL_HANDLER,
39852   	ZEND_NULL_HANDLER,
39853   	ZEND_NULL_HANDLER,
39854   	ZEND_NULL_HANDLER,
39855   	ZEND_NULL_HANDLER,
39856   	ZEND_NULL_HANDLER,
39857   	ZEND_NULL_HANDLER,
39858   	ZEND_NULL_HANDLER,
39859   	ZEND_NULL_HANDLER,
39860   	ZEND_NULL_HANDLER,
39861   	ZEND_NULL_HANDLER,
39862   	ZEND_NULL_HANDLER,
39863   	ZEND_NULL_HANDLER,
39864   	ZEND_NULL_HANDLER,
39865   	ZEND_NULL_HANDLER,
39866   	ZEND_NULL_HANDLER,
39867   	ZEND_NULL_HANDLER,
39868   	ZEND_NULL_HANDLER,
39869   	ZEND_NULL_HANDLER,
39870   	ZEND_NULL_HANDLER,
39871   	ZEND_NULL_HANDLER,
39872   	ZEND_NULL_HANDLER,
39873   	ZEND_NULL_HANDLER,
39874   	ZEND_NULL_HANDLER,
39875   	ZEND_NULL_HANDLER,
39876   	ZEND_NULL_HANDLER,
39877   	ZEND_NULL_HANDLER,
39878   	ZEND_NULL_HANDLER,
39879   	ZEND_NULL_HANDLER,
39880   	ZEND_NULL_HANDLER,
39881   	ZEND_NULL_HANDLER,
39882   	ZEND_NULL_HANDLER,
39883   	ZEND_NULL_HANDLER,
39884   	ZEND_NULL_HANDLER,
39885   	ZEND_NULL_HANDLER,
39886   	ZEND_NULL_HANDLER,
39887   	ZEND_NULL_HANDLER,
39888   	ZEND_NULL_HANDLER,
39889   	ZEND_NULL_HANDLER,
39890   	ZEND_NULL_HANDLER,
39891   	ZEND_NULL_HANDLER,
39892   	ZEND_NULL_HANDLER,
39893   	ZEND_NULL_HANDLER,
39894   	ZEND_NULL_HANDLER,
39895   	ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER,
39896   	ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER,
39897   	ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER,
39898   	ZEND_NULL_HANDLER,
39899   	ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER,
39900   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER,
39901   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER,
39902   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER,
39903   	ZEND_NULL_HANDLER,
39904   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER,
39905   	ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER,
39906   	ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER,
39907   	ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER,
39908   	ZEND_NULL_HANDLER,
39909   	ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER,
39910   	ZEND_NULL_HANDLER,
39911   	ZEND_NULL_HANDLER,
39912   	ZEND_NULL_HANDLER,
39913   	ZEND_NULL_HANDLER,
39914   	ZEND_NULL_HANDLER,
39915   	ZEND_NULL_HANDLER,
39916   	ZEND_NULL_HANDLER,
39917   	ZEND_NULL_HANDLER,
39918   	ZEND_NULL_HANDLER,
39919   	ZEND_NULL_HANDLER,
39920   	ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER,
39921   	ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER,
39922   	ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER,
39923   	ZEND_NULL_HANDLER,
39924   	ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER,
39925   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER,
39926   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER,
39927   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER,
39928   	ZEND_NULL_HANDLER,
39929   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER,
39930   	ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER,
39931   	ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER,
39932   	ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER,
39933   	ZEND_NULL_HANDLER,
39934   	ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER,
39935   	ZEND_NULL_HANDLER,
39936   	ZEND_NULL_HANDLER,
39937   	ZEND_NULL_HANDLER,
39938   	ZEND_NULL_HANDLER,
39939   	ZEND_NULL_HANDLER,
39940   	ZEND_NULL_HANDLER,
39941   	ZEND_NULL_HANDLER,
39942   	ZEND_NULL_HANDLER,
39943   	ZEND_NULL_HANDLER,
39944   	ZEND_NULL_HANDLER,
39945   	ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER,
39946   	ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER,
39947   	ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER,
39948   	ZEND_NULL_HANDLER,
39949   	ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER,
39950   	ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER,
39951   	ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER,
39952   	ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER,
39953   	ZEND_NULL_HANDLER,
39954   	ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER,
39955   	ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER,
39956   	ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER,
39957   	ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER,
39958   	ZEND_NULL_HANDLER,
39959   	ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER,
39960   	ZEND_NULL_HANDLER,
39961   	ZEND_NULL_HANDLER,
39962   	ZEND_NULL_HANDLER,
39963   	ZEND_NULL_HANDLER,
39964   	ZEND_NULL_HANDLER,
39965   	ZEND_NULL_HANDLER,
39966   	ZEND_NULL_HANDLER,
39967   	ZEND_NULL_HANDLER,
39968   	ZEND_NULL_HANDLER,
39969   	ZEND_NULL_HANDLER,
39970   	ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER,
39971   	ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER,
39972   	ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER,
39973   	ZEND_NULL_HANDLER,
39974   	ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER,
39975   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER,
39976   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER,
39977   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER,
39978   	ZEND_NULL_HANDLER,
39979   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER,
39980   	ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER,
39981   	ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER,
39982   	ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER,
39983   	ZEND_NULL_HANDLER,
39984   	ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER,
39985   	ZEND_NULL_HANDLER,
39986   	ZEND_NULL_HANDLER,
39987   	ZEND_NULL_HANDLER,
39988   	ZEND_NULL_HANDLER,
39989   	ZEND_NULL_HANDLER,
39990   	ZEND_NULL_HANDLER,
39991   	ZEND_NULL_HANDLER,
39992   	ZEND_NULL_HANDLER,
39993   	ZEND_NULL_HANDLER,
39994   	ZEND_NULL_HANDLER,
39995   	ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER,
39996   	ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER,
39997   	ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER,
39998   	ZEND_NULL_HANDLER,
39999   	ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER,
40000   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER,
40001   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER,
40002   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER,
40003   	ZEND_NULL_HANDLER,
40004   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER,
40005   	ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER,
40006   	ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER,
40007   	ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER,
40008   	ZEND_NULL_HANDLER,
40009   	ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER,
40010   	ZEND_NULL_HANDLER,
40011   	ZEND_NULL_HANDLER,
40012   	ZEND_NULL_HANDLER,
40013   	ZEND_NULL_HANDLER,
40014   	ZEND_NULL_HANDLER,
40015   	ZEND_NULL_HANDLER,
40016   	ZEND_NULL_HANDLER,
40017   	ZEND_NULL_HANDLER,
40018   	ZEND_NULL_HANDLER,
40019   	ZEND_NULL_HANDLER,
40020   	ZEND_NULL_HANDLER,
40021   	ZEND_NULL_HANDLER,
40022   	ZEND_NULL_HANDLER,
40023   	ZEND_NULL_HANDLER,
40024   	ZEND_NULL_HANDLER,
40025   	ZEND_NULL_HANDLER,
40026   	ZEND_NULL_HANDLER,
40027   	ZEND_NULL_HANDLER,
40028   	ZEND_NULL_HANDLER,
40029   	ZEND_NULL_HANDLER,
40030   	ZEND_NULL_HANDLER,
40031   	ZEND_NULL_HANDLER,
40032   	ZEND_NULL_HANDLER,
40033   	ZEND_NULL_HANDLER,
40034   	ZEND_NULL_HANDLER,
40035   	ZEND_NULL_HANDLER,
40036   	ZEND_NULL_HANDLER,
40037   	ZEND_NULL_HANDLER,
40038   	ZEND_NULL_HANDLER,
40039   	ZEND_NULL_HANDLER,
40040   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
40041   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
40042   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
40043   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
40044   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
40045   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
40046   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
40047   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
40048   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
40049   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
40050   	ZEND_NULL_HANDLER,
40051   	ZEND_NULL_HANDLER,
40052   	ZEND_NULL_HANDLER,
40053   	ZEND_NULL_HANDLER,
40054   	ZEND_NULL_HANDLER,
40055   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
40056   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
40057   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
40058   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
40059   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
40060   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40061   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40062   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40063   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40064   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40065   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40066   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40067   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40068   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40069   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40070   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40071   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40072   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40073   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40074   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40075   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40076   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40077   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40078   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40079   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40080   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40081   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40082   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40083   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40084   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
40085   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40086   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40087   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40088   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40089   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40090   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40091   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40092   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40093   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40094   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40095   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40096   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40097   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40098   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40099   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40100   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40101   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40102   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40103   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40104   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40105   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40106   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40107   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40108   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40109   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
40110   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40111   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40112   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40113   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40114   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40115   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40116   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40117   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40118   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40119   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40120   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40121   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40122   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40123   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40124   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40125   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40126   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40127   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40128   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40129   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40130   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40131   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40132   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40133   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40134   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
40135   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40136   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40137   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40138   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40139   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40140   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40141   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40142   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40143   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40144   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40145   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40146   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40147   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40148   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40149   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40150   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40151   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40152   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40153   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40154   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40155   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40156   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40157   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40158   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40159   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
40160   	ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER,
40161   	ZEND_NULL_HANDLER,
40162   	ZEND_NULL_HANDLER,
40163   	ZEND_NULL_HANDLER,
40164   	ZEND_NULL_HANDLER,
40165   	ZEND_NULL_HANDLER,
40166   	ZEND_NULL_HANDLER,
40167   	ZEND_NULL_HANDLER,
40168   	ZEND_NULL_HANDLER,
40169   	ZEND_NULL_HANDLER,
40170   	ZEND_NULL_HANDLER,
40171   	ZEND_NULL_HANDLER,
40172   	ZEND_NULL_HANDLER,
40173   	ZEND_NULL_HANDLER,
40174   	ZEND_NULL_HANDLER,
40175   	ZEND_NULL_HANDLER,
40176   	ZEND_NULL_HANDLER,
40177   	ZEND_NULL_HANDLER,
40178   	ZEND_NULL_HANDLER,
40179   	ZEND_NULL_HANDLER,
40180   	ZEND_NULL_HANDLER,
40181   	ZEND_NULL_HANDLER,
40182   	ZEND_NULL_HANDLER,
40183   	ZEND_NULL_HANDLER,
40184   	ZEND_NULL_HANDLER,
40185   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
40186   	ZEND_NULL_HANDLER,
40187   	ZEND_NULL_HANDLER,
40188   	ZEND_NULL_HANDLER,
40189   	ZEND_NULL_HANDLER,
40190   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
40191   	ZEND_NULL_HANDLER,
40192   	ZEND_NULL_HANDLER,
40193   	ZEND_NULL_HANDLER,
40194   	ZEND_NULL_HANDLER,
40195   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
40196   	ZEND_NULL_HANDLER,
40197   	ZEND_NULL_HANDLER,
40198   	ZEND_NULL_HANDLER,
40199   	ZEND_NULL_HANDLER,
40200   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
40201   	ZEND_NULL_HANDLER,
40202   	ZEND_NULL_HANDLER,
40203   	ZEND_NULL_HANDLER,
40204   	ZEND_NULL_HANDLER,
40205   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
40206   	ZEND_NULL_HANDLER,
40207   	ZEND_NULL_HANDLER,
40208   	ZEND_NULL_HANDLER,
40209   	ZEND_NULL_HANDLER,
40210   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40211   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40212   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40213   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40214   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40215   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40216   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40217   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40218   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40219   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40220   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40221   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40222   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40223   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40224   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40225   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40226   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40227   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40228   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40229   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40230   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40231   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40232   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40233   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40234   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
40235   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40236   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40237   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40238   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40239   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40240   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40241   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40242   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40243   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40244   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40245   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40246   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40247   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40248   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40249   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40250   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40251   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40252   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40253   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40254   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40255   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40256   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40257   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40258   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40259   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
40260   	ZEND_NULL_HANDLER,
40261   	ZEND_NULL_HANDLER,
40262   	ZEND_NULL_HANDLER,
40263   	ZEND_NULL_HANDLER,
40264   	ZEND_NULL_HANDLER,
40265   	ZEND_NULL_HANDLER,
40266   	ZEND_NULL_HANDLER,
40267   	ZEND_NULL_HANDLER,
40268   	ZEND_NULL_HANDLER,
40269   	ZEND_NULL_HANDLER,
40270   	ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER,
40271   	ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER,
40272   	ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER,
40273   	ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER,
40274   	ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER,
40275   	ZEND_NULL_HANDLER,
40276   	ZEND_NULL_HANDLER,
40277   	ZEND_NULL_HANDLER,
40278   	ZEND_NULL_HANDLER,
40279   	ZEND_NULL_HANDLER,
40280   	ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER,
40281   	ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER,
40282   	ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER,
40283   	ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER,
40284   	ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER,
40285   	ZEND_NULL_HANDLER,
40286   	ZEND_NULL_HANDLER,
40287   	ZEND_NULL_HANDLER,
40288   	ZEND_NULL_HANDLER,
40289   	ZEND_NULL_HANDLER,
40290   	ZEND_NULL_HANDLER,
40291   	ZEND_NULL_HANDLER,
40292   	ZEND_NULL_HANDLER,
40293   	ZEND_NULL_HANDLER,
40294   	ZEND_NULL_HANDLER,
40295   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER,
40296   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER,
40297   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER,
40298   	ZEND_NULL_HANDLER,
40299   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER,
40300   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER,
40301   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER,
40302   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER,
40303   	ZEND_NULL_HANDLER,
40304   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER,
40305   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER,
40306   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER,
40307   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER,
40308   	ZEND_NULL_HANDLER,
40309   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER,
40310   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40311   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40312   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40313   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40314   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40315   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40316   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40317   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40318   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40319   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40320   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40321   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40322   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40323   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40324   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40325   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40326   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40327   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40328   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40329   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40330   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40331   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40332   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40333   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40334   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
40335   	ZEND_USER_OPCODE_SPEC_HANDLER,
40336   	ZEND_USER_OPCODE_SPEC_HANDLER,
40337   	ZEND_USER_OPCODE_SPEC_HANDLER,
40338   	ZEND_USER_OPCODE_SPEC_HANDLER,
40339   	ZEND_USER_OPCODE_SPEC_HANDLER,
40340   	ZEND_USER_OPCODE_SPEC_HANDLER,
40341   	ZEND_USER_OPCODE_SPEC_HANDLER,
40342   	ZEND_USER_OPCODE_SPEC_HANDLER,
40343   	ZEND_USER_OPCODE_SPEC_HANDLER,
40344   	ZEND_USER_OPCODE_SPEC_HANDLER,
40345   	ZEND_USER_OPCODE_SPEC_HANDLER,
40346   	ZEND_USER_OPCODE_SPEC_HANDLER,
40347   	ZEND_USER_OPCODE_SPEC_HANDLER,
40348   	ZEND_USER_OPCODE_SPEC_HANDLER,
40349   	ZEND_USER_OPCODE_SPEC_HANDLER,
40350   	ZEND_USER_OPCODE_SPEC_HANDLER,
40351   	ZEND_USER_OPCODE_SPEC_HANDLER,
40352   	ZEND_USER_OPCODE_SPEC_HANDLER,
40353   	ZEND_USER_OPCODE_SPEC_HANDLER,
40354   	ZEND_USER_OPCODE_SPEC_HANDLER,
40355   	ZEND_USER_OPCODE_SPEC_HANDLER,
40356   	ZEND_USER_OPCODE_SPEC_HANDLER,
40357   	ZEND_USER_OPCODE_SPEC_HANDLER,
40358   	ZEND_USER_OPCODE_SPEC_HANDLER,
40359   	ZEND_USER_OPCODE_SPEC_HANDLER,
40360   	ZEND_NULL_HANDLER,
40361   	ZEND_NULL_HANDLER,
40362   	ZEND_NULL_HANDLER,
40363   	ZEND_NULL_HANDLER,
40364   	ZEND_NULL_HANDLER,
40365   	ZEND_NULL_HANDLER,
40366   	ZEND_NULL_HANDLER,
40367   	ZEND_NULL_HANDLER,
40368   	ZEND_NULL_HANDLER,
40369   	ZEND_NULL_HANDLER,
40370   	ZEND_NULL_HANDLER,
40371   	ZEND_NULL_HANDLER,
40372   	ZEND_NULL_HANDLER,
40373   	ZEND_NULL_HANDLER,
40374   	ZEND_NULL_HANDLER,
40375   	ZEND_NULL_HANDLER,
40376   	ZEND_NULL_HANDLER,
40377   	ZEND_NULL_HANDLER,
40378   	ZEND_NULL_HANDLER,
40379   	ZEND_NULL_HANDLER,
40380   	ZEND_NULL_HANDLER,
40381   	ZEND_NULL_HANDLER,
40382   	ZEND_NULL_HANDLER,
40383   	ZEND_NULL_HANDLER,
40384   	ZEND_NULL_HANDLER,
40385   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
40386   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
40387   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
40388   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
40389   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
40390   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
40391   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
40392   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
40393   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
40394   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
40395   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
40396   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
40397   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
40398   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
40399   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
40400   	ZEND_NULL_HANDLER,
40401   	ZEND_NULL_HANDLER,
40402   	ZEND_NULL_HANDLER,
40403   	ZEND_NULL_HANDLER,
40404   	ZEND_NULL_HANDLER,
40405   	ZEND_JMP_SET_SPEC_CV_HANDLER,
40406   	ZEND_JMP_SET_SPEC_CV_HANDLER,
40407   	ZEND_JMP_SET_SPEC_CV_HANDLER,
40408   	ZEND_JMP_SET_SPEC_CV_HANDLER,
40409   	ZEND_JMP_SET_SPEC_CV_HANDLER,
40410   	ZEND_NULL_HANDLER,
40411   	ZEND_NULL_HANDLER,
40412   	ZEND_NULL_HANDLER,
40413   	ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER,
40414   	ZEND_NULL_HANDLER,
40415   	ZEND_NULL_HANDLER,
40416   	ZEND_NULL_HANDLER,
40417   	ZEND_NULL_HANDLER,
40418   	ZEND_NULL_HANDLER,
40419   	ZEND_NULL_HANDLER,
40420   	ZEND_NULL_HANDLER,
40421   	ZEND_NULL_HANDLER,
40422   	ZEND_NULL_HANDLER,
40423   	ZEND_NULL_HANDLER,
40424   	ZEND_NULL_HANDLER,
40425   	ZEND_NULL_HANDLER,
40426   	ZEND_NULL_HANDLER,
40427   	ZEND_NULL_HANDLER,
40428   	ZEND_NULL_HANDLER,
40429   	ZEND_NULL_HANDLER,
40430   	ZEND_NULL_HANDLER,
40431   	ZEND_NULL_HANDLER,
40432   	ZEND_NULL_HANDLER,
40433   	ZEND_NULL_HANDLER,
40434   	ZEND_NULL_HANDLER,
40435   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40436   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40437   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40438   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40439   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40440   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40441   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40442   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40443   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40444   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40445   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40446   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40447   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40448   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40449   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40450   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40451   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40452   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40453   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40454   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40455   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40456   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40457   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40458   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40459   	ZEND_ADD_TRAIT_SPEC_HANDLER,
40460   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40461   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40462   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40463   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40464   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40465   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40466   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40467   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40468   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40469   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40470   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40471   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40472   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40473   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40474   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40475   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40476   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40477   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40478   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40479   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40480   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40481   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40482   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40483   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40484   	ZEND_BIND_TRAITS_SPEC_HANDLER,
40485   	ZEND_NULL_HANDLER,
40486   	ZEND_NULL_HANDLER,
40487   	ZEND_NULL_HANDLER,
40488   	ZEND_NULL_HANDLER,
40489   	ZEND_NULL_HANDLER,
40490   	ZEND_NULL_HANDLER,
40491   	ZEND_NULL_HANDLER,
40492   	ZEND_NULL_HANDLER,
40493   	ZEND_NULL_HANDLER,
40494   	ZEND_NULL_HANDLER,
40495   	ZEND_NULL_HANDLER,
40496   	ZEND_NULL_HANDLER,
40497   	ZEND_NULL_HANDLER,
40498   	ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER,
40499   	ZEND_NULL_HANDLER,
40500   	ZEND_NULL_HANDLER,
40501   	ZEND_NULL_HANDLER,
40502   	ZEND_NULL_HANDLER,
40503   	ZEND_NULL_HANDLER,
40504   	ZEND_NULL_HANDLER,
40505   	ZEND_NULL_HANDLER,
40506   	ZEND_NULL_HANDLER,
40507   	ZEND_NULL_HANDLER,
40508   	ZEND_NULL_HANDLER,
40509   	ZEND_NULL_HANDLER,
40510   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
40511   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
40512   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
40513   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
40514   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
40515   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
40516   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
40517   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
40518   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
40519   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
40520   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
40521   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
40522   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
40523   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
40524   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
40525   	ZEND_NULL_HANDLER,
40526   	ZEND_NULL_HANDLER,
40527   	ZEND_NULL_HANDLER,
40528   	ZEND_NULL_HANDLER,
40529   	ZEND_NULL_HANDLER,
40530   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
40531   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
40532   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
40533   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
40534   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
40535   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
40536   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
40537   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
40538   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
40539   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
40540   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
40541   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
40542   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
40543   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
40544   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
40545   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
40546   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
40547   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
40548   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
40549   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
40550   	ZEND_NULL_HANDLER,
40551   	ZEND_NULL_HANDLER,
40552   	ZEND_NULL_HANDLER,
40553   	ZEND_NULL_HANDLER,
40554   	ZEND_NULL_HANDLER,
40555   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
40556   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
40557   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
40558   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
40559   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
40560   	ZEND_NULL_HANDLER
40561   };
40562   zend_opcode_handlers = (opcode_handler_t*)labels;
40563 }
zend_vm_get_opcode_handler(zend_uchar opcode,zend_op * op)40564 static opcode_handler_t zend_vm_get_opcode_handler(zend_uchar opcode, zend_op* op)
40565 {
40566 		static const int zend_vm_decode[] = {
40567 			_UNUSED_CODE, /* 0              */
40568 			_CONST_CODE,  /* 1 = IS_CONST   */
40569 			_TMP_CODE,    /* 2 = IS_TMP_VAR */
40570 			_UNUSED_CODE, /* 3              */
40571 			_VAR_CODE,    /* 4 = IS_VAR     */
40572 			_UNUSED_CODE, /* 5              */
40573 			_UNUSED_CODE, /* 6              */
40574 			_UNUSED_CODE, /* 7              */
40575 			_UNUSED_CODE, /* 8 = IS_UNUSED  */
40576 			_UNUSED_CODE, /* 9              */
40577 			_UNUSED_CODE, /* 10             */
40578 			_UNUSED_CODE, /* 11             */
40579 			_UNUSED_CODE, /* 12             */
40580 			_UNUSED_CODE, /* 13             */
40581 			_UNUSED_CODE, /* 14             */
40582 			_UNUSED_CODE, /* 15             */
40583 			_CV_CODE      /* 16 = IS_CV     */
40584 		};
40585 		return zend_opcode_handlers[opcode * 25 + zend_vm_decode[op->op1_type] * 5 + zend_vm_decode[op->op2_type]];
40586 }
40587 
zend_vm_set_opcode_handler(zend_op * op)40588 ZEND_API void zend_vm_set_opcode_handler(zend_op* op)
40589 {
40590 	op->handler = zend_vm_get_opcode_handler(zend_user_opcodes[op->opcode], op);
40591 }
40592 
zend_do_fcall(ZEND_OPCODE_HANDLER_ARGS)40593 ZEND_API int zend_do_fcall(ZEND_OPCODE_HANDLER_ARGS)
40594 {
40595 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40596 }
40597 
40598